Morpho Blue vault exploits and MEV risk analysis

The March 22, 2026, Resolv protocol private key compromise allowed attackers to mint 80 million unbacked USR tokens, which crashed the price to $0.025. I observed how this depeg exposed a critical flaw in how MetaMorpho Vaults calculate Net Asset Value per share. Because curators used a hardcoded 1:1 oracle for the USR/USDC market, Morpho Blue incorrectly valued the worthless USR at its full face value. Attackers used flash loans to supply USR on behalf of the vault, a function that allows anyone to specify an onBehalf address. The attacker exploited the fact that the supply(onBehalf) function interacts directly with the Morpho Blue Core contract, which allowed them to bypass the vault’s internal supply cap and allocator permissions to increase the total assets without changing the total supply. This manipulation increased the totalAssets used in the NAV formula while the totalSupply remained constant. The attacker used 14,109 USDC to supply and borrow, then redeemed the inflated surplus from healthy markets like wETH/USDC or cbBTC/USDC and extracted 12,300 USDC from a 10,000 USDC supply. This incident mirrors oracle vulnerabilities where price manipulation produced $30MM in losses. I see similarities to MEV bot exploits. The liquidation incentive for a market with an 86% LLTV works out to a 5% bonus. Morpho Blue remains a massive venue with $8B in TVL across 200+ markets, yet this exploit shows the risk of delegating oversight to curators.

Compound Migration and Euler Modularity

Compound users face different friction after the December 2025 deprecation of the V2 multi-asset pool model. I note the Comet Migrator as the primary tool for moving positions to V3 Comet markets. This migration requires users to approve an Operator smart contract to move assets from V2 to V3, though the protocol logic stays unchanged. Assets and positions exist onchain, so users can manage them via the new compound.xyz interface. Compound V3 borrows against collateral with a factor of 81% to 87%, and I see USDC supply yields between 3.5% and 5.8% depending on utilization. The Compound Foundation also aims to improve the protocol through a $52 million development program. Euler v2 presents a different modularity via the Ethereum Vault Connector. This system allows builders to link vaults and recognize deposits as collateral, but it requires careful management of the different vault classes. I see that Euler v2 provides governed vaults, which use a DAO or curator to manage risk, and ungoverned vaults, which have fixed parameters. Euler also includes a RewardStreams module for permissionless rewards and a FeeFlow module which uses reverse Dutch auctions to auction off fees. Advanced users can also utilize Account Managers to implement conditional orders via smart contract operators that manage user positions.

Technical Comparison

I recommend Morpho Blue for users who want granular control over collateral and interest rate models, provided you vet your curators. The protocol provides a clean primitive, but the vault layer shifts the burden of risk to the curators. The Compound DAO maintains ownership of its vaults and can set performance fees, while Euler allows for permissionless reward streaming. The parameters remain immutable once the market creation is complete. Does the permissionless supply(onBehalf) function require a protocol-level restriction to protect vault depositors?