ERC-4626 virtual-share offset (OZ ≥4.9)

Evidence summary #

MetaMorpho vaults are ERC-4626 but do NOT use OZ >=4.9 virtual-share offset. They rely instead on a recommended dead deposit (1e9 shares to 0xdead). Dead deposit is curator responsibility, not protocol code enforcement. Docs explicitly warn MetaMorpho V1 vaults are vulnerable to inflation front-running if dead deposit not made.

Detail #

MetaMorpho vaults implement ERC-4626 per the MetaMorpho GitHub repo and docs. The data cache shows oz_contracts_version is null (not identified in the morpho-blue repo, which is the core contract). MetaMorpho vault deployment does not automatically include OZ >=4.9 virtual-share offset (which adds decimals_offset to share calculation). Instead, the recommended protection is a dead deposit: curator mints 1e9 shares to 0x000...dEaD immediately after vault creation. This is documented in multiple places (vault mechanics, security considerations, dead deposit tutorial). The docs explicitly state: 'MetaMorpho Vaults V1 are vulnerable to inflation front-running attacks, particularly when newly created and empty.' Template: green = ERC-4626 with OZ >=4.9 virtual shares or equivalent structural protection; yellow = ERC-4626 without automatic virtual shares, relying on curator-performed dead deposit. Yellow applies.

Sources #

Methodology #

Determine whether ERC-4626 vaults use OpenZeppelin ≥4.9 virtual-share offset pattern to prevent first-depositor share-inflation.

See the full factor methodology and distribution across all protocols →