<p><img src="https://miro.medium.com/v2/resize:fit:1400/1*DhZp7fFDI69JXyE1m7JylQ.png" /></p><h2 id="header-0">Overview</h2><p>On October 13, 2024, the Morpho PAXG/USDC market was exploited due to a misconfigured oracle. This vulnerability allowed the attacker to withdraw $230,000 USD by exploiting an inflated gold valuation caused by a miscalculated SCALE_FACTOR in the price oracle. The issue arose due to an incorrect understanding of decimal differences between PAXG and USDC tokens</p><h2 id="header-1"><strong>About Project</strong></h2><p><a href="https://morpho.org/" rel="noopener noreferrer nofollow">Morpho</a> (formerly known as Morpho Blue) is a decentralized protocol enabling the overcollateralized lending and borrowing of crypto assets (ERC20 &amp; ERC4626 Tokens) on the EVM. The protocol is implemented as an immutable smart contract, engineered to serve as a trustless base layer for lenders, borrowers, and applications.</p><h2 id="header-2">Exploit Details</h2><p>Vulnerable Contract Address: <a href="https://etherscan.io/address/0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb#code" rel="noopener noreferrer nofollow">0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb</a></p><p>Attack Transaction : <a href="https://etherscan.io/tx/0x256979ae169abb7fbbbbc14188742f4b9debf48b48ad5b5207cadcc99ccb493b" rel="noopener noreferrer nofollow">0x256979</a></p><p>Attacker Address : <a href="https://etherscan.io/address/0x02DBE46169fDf6555F2A125eEe3dce49703b13f5" rel="noopener noreferrer nofollow">0x02DBE46169fDf6555F2A125eEe3dce49703b13f5</a></p><h2 id="header-3">Attack Process</h2><p>The attacker identified a misconfiguration in the oracle price calculations for the PAXG/USDC market.</p><p><img src="https://miro.medium.com/v2/resize:fit:1400/1*z5xG_Vm9xCb0pSjf6QU3Vw.png" /></p><p>The oracle incorrectly valued PAXG due to a mismatched SCALE_FACTOR.</p><p>The SCALE_FACTOR was miscalculated because of a 12-decimal difference between USDC (6 decimals) and PAXG (18 decimals).</p><p>This caused PAXG to be overvalued by a factor of 10¹², setting gold’s price at $2.6 trillion.</p><p>Using the inflated price, the attacker deposited only $351 worth of PAXG tokens into the vulnerable market.</p><p><img src="https://miro.medium.com/v2/resize:fit:1400/1*sOryE_JxDU1BqMD7tLg16g.png" /></p><p>Exploiting the inflated collateral value, the attacker borrowed $230,000 in USDC.</p><p>The attacker successfully withdrew the borrowed USDC, causing a significant loss to the protocol.</p><h2 id="header-4">The Root Cause</h2><p>The SCALE_FACTOR for the oracle price calculations was incorrectly configured during the market creation process. Decimal differences between the tokens (PAXG with 18 decimals and USDC with 6 decimals) were overlooked, resulting in a 12-decimal inflation in PAXG’s valuation.</p><h2 id="header-5">Flow of Funds</h2><p>See the funds flow <a href="https://app.blocksec.com/explorer/tx/eth/0x256979ae169abb7fbbbbc14188742f4b9debf48b48ad5b5207cadcc99ccb493b" rel="noopener noreferrer nofollow">here</a>:</p><p><img src="https://miro.medium.com/v2/resize:fit:1400/1*tbRG1i9Lv3TXNJ3JvyB72g.png" /></p><p>How could they have prevented the Exploit?</p><ol><li>Implement automated checks to ensure decimal consistency between base and quote tokens when configuring oracles.</li><li>Implement limits on borrowable amounts based on absolute collateral values to prevent over-collateralization due to oracle errors.</li><li>Engage with reputable audit firms like QuiilAudits to conduct comprehensive security audits and fix potential vulnerabilities before they can be exploited.</li></ol><h2 id="header-6">Why QuillAudits?</h2><p>Choosing a reputable audit firm like <a href="https://www.quillaudits.com/smart-contract-audit" rel="noopener noreferrer nofollow">QuillAudits ensures that your protocol undergoes rigorous scrutiny</a> from experienced security professionals. QuillAudits specializes in uncovering critical vulnerabilities and providing actionable remediation strategies. Our expertise helps safeguard your project from attacks, ensuring that security issues are addressed proactively.</p><p><img src="https://miro.medium.com/v2/resize:fit:1400/1*8sCpjI_y5wAFblYZCMgHKQ.png" /></p>

Decoding MorphoBlue’s $230K Exploit

Table of Contents

QuillAudits

Other articles published on Nov 28, 2024

Japan’s Metaplanet Unveils $62M Worth Bitcoin Acquisition Strategy

TON Crypto: Volatility Rises Post-Golden Cross, Is $14 Next?

Bitwise Multi-Coin Fund’s ETP Proposal Brings XRP Closer to Mainstream

Base Network Achieves Record Transaction Volume with Clanker AI Agent

21Shares Introduces Four New ETPs for Pyth, Ondo, Render, and Near

W-Coin Telegram community introduces W-coin burns for offline users

Join our free newsletter for daily crypto updates!