Is Morpho Token (MORPHO) Safe? Smart Contract Security Analysis

Security Checklist

1/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

Audit History

2 audits on record

Jul 2276Jul 2350

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

This audit covers an ERC1967Proxy contract, which is a standard OpenZeppelin UUPS proxy. While the proxy contract itself is robust and well-audited, the critical finding is that its associated implementation contract (0xa860498f8a299526174b539fcc49f13cc082fb18) has unverified source code. This lack of transparency prevents a full security assessment of the system's core logic and introduces significant risks, including unknown vulnerabilities, potential malicious behavior, and unverified upgrade mechanisms.

Final Recommendation: It is imperative that the source code for the implementation contract (0xa860498f8a299526174b539fcc49f13cc082fb18) be verified and made publicly available. A comprehensive security audit of the implementation contract is strongly recommended to identify and mitigate any vulnerabilities, assess its access control mechanisms, and confirm its adherence to secure development practices. Users should exercise extreme caution when interacting with this contract until the implementation's code is fully transparent and audited.

Category Ratings

TechnicalHigh

3/10

The proxy contract (7.1 Architecture) utilizes well-vetted OpenZeppelin libraries for its core functionality, ensuring a high standard of code security for the proxy itself (7.2 Code Security). However, the primary technical risk stems from the unverified source code of the implementation contract (

GovernanceHigh

1/10

Without access to the implementation contract's source code, the governance and economic models (7.4 Economic, 7.5 Governance) cannot be assessed. Specifically, the mechanism for authorizing upgrades (7.3 Access Control) is unknown, posing a significant risk. This lack of transparency means tha

UpgradesHigh

1/10

The contract employs the ERC-1967 (UUPS) proxy pattern (7.7 Upgrades), which is a robust standard for upgradeability. However, the control mechanism for authorizing upgrades resides within the unverified implementation contract. This means the identity of the entity or mechanism (e.g., multisig, gov

Proxy Upgrade Controls

Proxy TypeEip1967 Uups

ImplementationVerified source

Upgrades (30d)0 · stable

LP Distribution

Top-1 Unlocked Holder69.4%

Top-3 Unlocked83.3%

What Raised This Score

9 factors

Ownership NOT renounced — strong Multisig (5-of-9)
Mintable supply — no cap found, dilution unbounded
Proxy contract (upgradeable — admin can replace logic)
Top-10 concentration > 30% (84.8% total → 45.8% effective; 19.8% in EOAs, 65.0% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 69.4% (independent LP — depth risk, pool = 43% of DEX liquidity)
LP top3 unlocked holders = 83.3% (independent LP — depth risk, pool = 43% of DEX liquidity)
1 Critical finding(s) from audit
2 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

3 total

1 Critical 2 High

C-01CriticalUnresolved

Unverified Implementation Contract Source Code

The implementation contract at 0xa860498f8a299526174b539fcc49f13cc082fb18, which the ERC1967Proxy delegates all calls to, has unverified source code on the blockchain explorer. This prevents any security analysis of the core business logic, potential vulnerabilities, or malicious functionality. Users cannot independently verify what code they are interacting with, leading to a complete lack of trust and transparency.

Recommendation: Immediately verify and publish the full source code of the implementation contract on the blockchain explorer. Once verified, a thorough security audit of the implementation contract should be conducted to ensure its integrity and security.

H-01HighUnresolved

Unknown Upgrade Authorization Mechanism

As an ERC1967 (UUPS) proxy, the authorization logic for upgrades resides within the implementation contract. With the implementation's source code unverified, the specific mechanism (e.g., an owner address, a multisig, a governance contract) that controls the ability to upgrade the proxy is unknown. This poses a significant risk, as an attacker who discovers or exploits this unknown mechanism could unilaterally upgrade the contract to a malicious version, potentially draining funds or seizing control.

Recommendation: Upon verification of the implementation contract's source code, clearly document and audit the upgrade authorization mechanism. Ensure that upgrade permissions are secured by robust access control, ideally a multi-signature wallet or a well-tested governance system, to prevent single points of failure.

H-02HighUnresolved

Potential Storage Collisions in Unverified Implementation

The pre-analysis notes indicate a 'non-standard storage layout' for the implementation contract. In UUPS proxies, the implementation contract must carefully manage its storage to avoid collisions with the proxy's reserved storage slots (e.g., for implementation address, admin address). Without verified source code, it's impossible to confirm if the implementation correctly adheres to ERC-1967 storage slot conventions or if its custom layout could inadvertently overwrite critical proxy state variables, leading to severe data corruption or loss of control.

Recommendation: After verifying the implementation's source code, conduct a detailed storage layout analysis to confirm that there are no potential collisions with the ERC-1967 proxy's reserved slots. Ensure that the implementation's storage variables are declared in a way that is compatible with the proxy pattern, especially if custom storage patterns are used.

Is Morpho Token Safe? MORPHO