Morpho v3
Lend-Borrow Protocol
Critical / High
Medium
Low / Informative
Report files
Audit lifecycle
This engagement is complete with finalized deliverables.
Completed
Scheduled
Scope, timeline, and review plan were agreed.
Completed
In Progress
Manual review and verification work were carried out.
Completed
Completed
The engagement wrapped with a published final report.
Executive Summary
High-level assessment and conclusions
A concise overview of the audit scope, core findings, and the key outcomes from the engagement.
Morpho Labs engaged Runtime Verification, Inc. to conduct a security audit of the Morpho AAVE v3 protocol, with the primary goal of assessing the correctness and robustness of its smart contract implementation. The initial review was conducted from January 30 to March 24, 2023, with a follow-up review of bug fixes from April 17 to April 28, 2023. The audit focused on the core contracts governing Morpho’s matching engine, position management, reward logic, and internal accounting systems. The reviewed code, drawn from the morpho-dao/morpho-aave-v3 private repository (commit 76525db269), included both core protocol contracts and supporting libraries. Runtime Verification performed a thorough manual analysis and issued detailed findings and recommendations to improve the protocol’s safety and maintainability. All identified issues are documented in the General Findings section of the report.
Reports
Download the audit artifacts
Access the published PDF deliverables associated with this engagement.
PDF report 1
Morpho-Audit-Report.pdf
Download the published report for this engagement.