Same-root-cause repeat exploit

Morpho V1 (Morpho Blue + MetaMorpho)'s assessment for RD-F-079 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Two incidents have distinct root-cause classes: (1) oracle decimal scaling misconfiguration at market-creation layer; (2) SDK approval routing to wrong contract address in frontend. No same-root-cause repeat.

Sources #

URL
https://morpho.org/blog/morpho-app-incident-april-10-2025/retrieved 2026-04-27
URL
https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891retrieved 2026-04-27

Methodology #

Determine whether the protocol has been exploited ≥2 times via the same root-cause cluster.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol morpho-v1 factor RD-F-079 score green collected_at 2026-04-30 21:19:13