Morpho Labs Vulnerability Disclosure

generated: '2026-07-20'
method: searched
probe: true
source: https://docs.morpho.org/morpho/concepts/security/bug-bounty/
summary: >-
  Morpho runs an active, funded vulnerability disclosure and bug bounty program
  focused on its onchain smart contracts (Morpho Blue, Morpho Vaults, Morpho
  Midnight). The current program is hosted on Cantina with a reward pool up to
  USD 2,500,000; an Immunefi program has also covered Morpho Blue and periphery
  contracts historically. Public disclosure requires prior approval from the
  Morpho team (Immunefi category 3 / Cantina consent). There is no
  /.well-known/security.txt and no RFC 9116 file on the web hosts (all probed
  404); the disclosure surface is documentation-driven, appropriate for a DeFi
  protocol whose primary attack surface is smart contracts rather than the read
  API.
policy:
  - https://docs.morpho.org/morpho/concepts/security/bug-bounty/
  - https://cantina.xyz/bounties/35a5f0a1-2ffd-432c-8f3b-77d169add8c3
  - https://immunefi.com/bug-bounty/morpho/
contact: []
programs:
  - platform: Cantina
    scope: [Morpho Blue, Morpho Midnight, Morpho Vaults]
    max_reward_usd: 2500000
    url: https://cantina.xyz/bounties/35a5f0a1-2ffd-432c-8f3b-77d169add8c3
    disclosure: consent-required
  - platform: Immunefi
    scope: [Morpho Blue, MetaMorpho / Morpho Blue periphery]
    max_reward_usd: 2500000
    url: https://immunefi.com/bug-bounty/morpho/
    disclosure: approval-required (category 3)
security_reviews:
  url: https://docs.morpho.org/security-reviews/
  detail: >-
    Morpho publishes completed audit reports; the protocol has been audited 27
    times by 12 different security firms, alongside formal verification, mutation
    testing, and fuzzing.
evidence:
  - {source: https://docs.morpho.org/morpho/concepts/security/bug-bounty/, kind: disclosure-page, keywords: [bug bounty, vulnerability, Cantina]}
  - {source: https://cantina.xyz/bounties/35a5f0a1-2ffd-432c-8f3b-77d169add8c3, kind: bug-bounty, keywords: [bounty, morpho]}
  - {source: https://immunefi.com/bug-bounty/morpho/, kind: bug-bounty, keywords: [bug bounty, morpho]}