On October 13, 2024, the Morpho PAXG\/USDC market was exploited due to a misconfigured oracle. This vulnerability allowed the attacker to withdraw $230,000 USD by exploiting an inflated gold valuation caused by a miscalculated SCALE_FACTOR in the price oracle. The issue arose due to an incorrect understanding of decimal differences between PAXG and USDC\u00a0tokens<\/p>\n
Morpho<\/a> (formerly known as Morpho Blue) is a decentralized protocol enabling the overcollateralized lending and borrowing of crypto assets (ERC20 & ERC4626 Tokens) on the EVM. The protocol is implemented as an immutable smart contract, engineered to serve as a trustless base layer for lenders, borrowers, and applications.<\/p>\n Vulnerable Contract Address: 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb<\/a><\/p>\n Attack Transaction\u00a0:\u00a00x256979<\/a><\/p>\n Attacker Address\u00a0: 0x02DBE46169fDf6555F2A125eEe3dce49703b13f5<\/a><\/p>\n The attacker identified a misconfiguration in the oracle price calculations for the PAXG\/USDC market.<\/p>\n The oracle incorrectly valued PAXG due to a mismatched SCALE_FACTOR.<\/p>\n The SCALE_FACTOR was miscalculated because of a 12-decimal difference between USDC (6 decimals) and PAXG (18 decimals).<\/p>\n This caused PAXG to be overvalued by a factor of 10\u00b9\u00b2, setting gold\u2019s price at $2.6 trillion.<\/p>\n Using the inflated price, the attacker deposited only $351 worth of PAXG tokens into the vulnerable market.<\/p>\n Exploiting the inflated collateral value, the attacker borrowed $230,000 in\u00a0USDC.<\/p>\n The attacker successfully withdrew the borrowed USDC, causing a significant loss to the protocol.<\/p>\n The SCALE_FACTOR for the oracle price calculations was incorrectly configured during the market creation process. Decimal differences between the tokens (PAXG with 18 decimals and USDC with 6 decimals) were overlooked, resulting in a 12-decimal inflation in PAXG\u2019s valuation.<\/p>\n See the funds flow\u00a0here<\/a>:<\/p>\n Implement automated checks to ensure decimal consistency between base and quote tokens when configuring oracles.Implement limits on borrowable amounts based on absolute collateral values to prevent over-collateralization due to oracle\u00a0errors.Engage with reputable audit firms like QuiilAudits to conduct comprehensive security audits and fix potential vulnerabilities before they can be exploited.<\/p>\n Choosing a reputable audit firm like QuillAudits ensures that your protocol undergoes rigorous scrutiny<\/a> from experienced security professionals. QuillAudits specializes in uncovering critical vulnerabilities and providing actionable remediation strategies. Our expertise helps safeguard your project from attacks, ensuring that security issues are addressed proactively.<\/p>\n Decoding MorphoBlue\u2019s $230K Exploit<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":" Overview On October 13, 2024, the Morpho PAXG\/USDC market was exploited due to a misconfigured oracle. This vulnerability allowed the attacker to withdraw $230,000 USD by exploiting an inflated gold valuation caused by a miscalculated SCALE_FACTOR in the price oracle. The issue arose due to an incorrect understanding of decimal differences between PAXG and USDC\u00a0tokens […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-24314","post","type-post","status-publish","format-standard","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/24314"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=24314"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/24314\/revisions"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Exploit Details<\/h3>\n
Attack Process<\/h3>\n
The Root\u00a0Cause<\/h3>\n
Flow of\u00a0Funds<\/h3>\n
How could they have prevented the\u00a0Exploit?<\/h3>\n
Why QuillAudits?<\/h3>\n