Jan 9, 2025
Useful Links
Introduction
This report will disclose all unique risk considerations when using Morpho vaults as collateral in lending platforms or CDP stablecoin protocols such as Defi.money or LlamaLend. First, we will explain the product to readers and how it distinguishes itself from other similar products. We then disclose the risk involved in utilizing vaults as collateral assets, which has unique implications for borrowers and the integrating protocol.
Protocol Overview
Morpho is a semi-permissionless lending market protocol that offers primitives for creating lending markets of customizable complexity. Markets are inherently siloed, meaning they are composed of a single collateral/borrow pair. Lending markets can be created by anyone; an interested party simply needs to provide five parameters when defining a supported market:
a Loan Token,
a Collateral Token,
an Oracle,
a Liquidation Loan-to-Value (LLTV) and
the address to an Interest Rate Model contract (IRM).
Interested parties who would like to deploy new markets have a limited choice of the latter two parameters based on Morpho's specifications. Morpho DAO has sole authority in choosing which LLTVs and IRM contracts users can use when defining a new market.
All markets on Morpho are simply accounts stored in a single smart contract on each chain Morpho is deployed. There is essentially a single “pool”, with each account’s assets, liabilities, and collateral accounted for in a single contract.
Morpho Vaults
Morpho allows for the creation of ERC-4626 compliant vaults composed of one or more Morpho markets. Morpho's strategy to scale access to diverse markets involves offloading risk and operational management of vaults to third-party risk managers. Vaults involve a single deposit token (the borrowable asset) that is paired against various collateral types. Risk Managers can curate vault markets by whitelisting markets and allocating the deposit token to the underlying markets.
These vaults allow a convenient UX for suppliers by delegating the curation and allocation across isolated market pairs to designated Risk Managers. In exchange for this service, Risk Managers can set and accrue fees for their services; this fee is taken from interest to be distributed to suppliers.
The amount of assets each vault can hold custody of can be capped (known as the "market cap" of the vault), and certain administrator operations within these vaults are timelocked. If suppliers disagree with any proposed changes subjected to a timelock, they can withdraw their liquidity before any of these changes are committed to the vault.
The following is an illustration of the Morpho architecture, which includes two Morpho markets and two Morpho vaults. Notice that suppliers also have the choice of supplying to markets directly.
Morpho Vault Collateral Risk Disclaimer
There are unique risk considerations when utilizing Morpho vaults as collateral in lending protocols and CDP stablecoins. In this section, we will detail the risks suppliers are exposed to when engaging with Morpho vaults and specifically when employing this collateral type.
Bad Debt
Bad Debt occurs on loans where the value of the collateral relative to the borrowed asset has depreciated critically such that the value of the debt exceeds the value of the collateral. This may leave a portion of the loaned token that is never returned to lenders.
A liquidation mechanism is in place to mitigate the possibility of bad debt, but a variety of circumstances may inhibit the timely execution of liquidations. Such circumstances include:
Third-party liquidators are not actively monitoring the market (i.e. immature MEV market) and fail to execute liquidations on time.
A failure in the underlying collateral (e.g. an ETH LST protocol insolvency) results in illiquidity and/or rapid depreciation that cannot be profitably liquidated.
Excessive network fees inhibit profitable liquidation of the collateral
The Liquidation Loan-to-Value set on the market does not align with the collateral's volatility profile, allowing for aggressive borrowing that cannot be reliably liquidated in adverse market scenarios.
In Morpho Blue, this Bad Debt is socialized amongst all lenders evenly. It is crucial for the collateral used to be sufficiently correlated to the loan token to minimize these effects under market stress. Quality of the collateral is also crucial to consider, as technical, operational, or liquidity deficiencies with the underlying collateral may impact liquidators' ability to profitably process liquidation.
The LLTV for the market must also be chosen carefully to minimize risk to suppliers. This parameter limits how aggressively borrowers can leverage, and if this setting is inappropriately set for the volatility characteristics of the collateral type, it may inhibit the potential for safely processing liquidations.
Suppliers must also be aware of attacks such as the Bad Debt Socialization attack. This attack essentially allows an adversarial supplier to liquidate an under-water position, withdraw their assets, and avoid incurring the effects of Bad Debt socialization whilst profiting from the liquidation. The attacker essentially steals from their fellow suppliers, and the victims of this attack essentially incur a greater loss than they would otherwise. We should note that this attack is known to Morpho, but its likelihood is low due to the sophistication of the attack, which they have acknowledged.
Ultimately, a Morpho vault's viability depends on the careful curation of appropriate markets with high-quality collateral types that will maintain healthy markets in all market scenarios. Risk Managers can add markets (usually with a timelock), so vault suppliers must remain vigilant that underlying vault markets continue to align with their personal risk tolerance.
Interest Rate Model
When evaluating Morpho vault shares as potential collateral, the AdaptiveCurve Interest Rate Model presents unique risk considerations. While the technical implementation of the IRM is managed by Morpho, its ability to adapt to global market dynamics affects the stability and reliability of the available liquidity in the vault.
Morpho's AdaptiveCurve IRM responds dynamically to market conditions (a time-based modifier) with a kink at 90% utilization (the target utilization). These combined properties attempt to ensure that the market can adapt to both short-term and long-term market dynamics, and ultimately to stabilize liquidity availability at around 10% of the vault supply.
Risk Managers can regulate interest rates through allocation decisions across available markets, which gives the Manager direct control over each respective market's utilization, and therefore the interest rate and overall behavior of the AdaptiveCurve IRM. These operations may influence borrower behaviors and require trust in the adaptive capability of the IRM and proper operational management.
The primary concern from a risk management perspective is how interest rate fluctuations affect available liquidity in the vault. During periods of high market stress, rapid changes in interest rates could exceed the IRM's adaptive capability. For example, the max rate is capped at 4x the target rate at 90% utilization while the time-based mechanism will gradually increase the target rate as a function of the current utilization.
A rapid increase in global market rates may cause suppliers to exit the vault as they seek yield opportunities elsewhere, inhibiting the Risk Manager's ability to regulate market rates. This may result in periods of illiquidity if all tokens deposited to the vault are borrowed, preventing depositors from withdrawing their position. In such a scenario, the time-based mechanism will increase borrow rates over time until either borrowers repay their loan or the vault attracts additional suppliers.
Note also the Risk Manager's role in regulating rates. It may be the case that rates are kept artificially low, especially in the case of immature markets or where additional incentives are offered to vault suppliers. If the manager is negligent about properly managing market utilizations, the rates may deviate from global market rates, increasing the likelihood that periods of vault illiquidity may occur.
A key takeaway for using Morpho vaults as collateral is that even in cases where the vault is technically solvent and operating properly, temporary periods of illiquidity may prevent liquidations (or arbitrage in the case of soft-liquidation mechanisms) from taking place. This has implications for borrowers, who may experience greater losses in soft liquidation. It also has implications for protocol solvency, since a combined decline in vault token value and vault illiquidity may result in bad debt. Therefore, especially conservative liquidation parameters and debt ceilings must be adhered to when using Morpho vaults as collateral.
Oracles
Morpho allows for the permissionless creation of markets, allowing Risk Managers to define which Oracle is used to price the collateral relative to the loan token currency. Users therefore need to be mindful of the Oracle contract and service provider that is used for each market.
There have been incidents where Oracles in Morpho markets have been misconfigured, allowing malicious borrowers to drain the assets supplied to the vault. Oracles are always a critical dependency in lending markets, and this is a particular concern for protocols like Morpho that offload the responsibility to properly configure oracles to a third-party Risk Manager.
Users can and should verify the Oracle in all markets underlying the Morpho vault they supply to. As additional markets can be whitelisted by the Risk Manager, users should be vigilant about any markets added to the vault. This has implications for the solvency of the vault and therefore the solvency of any lending protocol/CDP stablecoin that integrates Morpho vaults as a collateral type.
Share <> Asset Slippage and Pricing
When converting to/from assets/shares ERC-4626 vaults do not offer slippage protection by default, nor do Morpho vaults offer this in their implementation. Morpho has acknowledged this, and state that users should interact with Bundlers instead when interacting with vaults, which add this slippage protection. Indeed, on the user interface for Morpho vaults, users interact with Bundlers by default. Integrations that require interacting with the underlying 4626 vaults, however, should be aware of slippage.
The official ERC-4626 docs also recommend using a time-weighted approach to pricing the shares against the underlying asset. This should be especially considered, since the recommended convertToAssets function does not give an exact, per-user price of the asset, but instead, an average price that does not offer any slippage protections.
This consideration is relevant to liquidators when using Morpho vaults as collateral. Liquidation requires interaction with Morpho as the primary market, with liquidators unwrapping the vault token and selling the underlying for the debt token. Any disruption in the flow of liquidation processing may increase losses to borrowers and/or affect the solvency of the integrating market.
Evolving Regulatory Framework
Morpho vaults are subject to a set of warnings, disclaimers, and Terms of Service provisions aimed at enhancing user awareness. While Morpho’s risk documentation and ToS strive to provide comprehensive explanations of the risks users might face, they cannot fully encompass the breadth of potential exposures.
In Europe, where the nexus of Morpho can be established due to the roots of Morpho Labs SAS, a limited company incorporated in France and ADDMO, a French Association, the regulatory landscape for crypto-asset service providers has been shaped by Markets in Crypto-Assets Regulation (MiCA). However, MiCA’s applicability to decentralized DeFi is ambiguous, requiring further research and guidance from key regulatory bodies, including the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), and the European Commission. These entities are also tasked with evaluating the necessity and feasibility of regulating crypto-asset lending and borrowing activities. Their anticipated report, initially scheduled for release by the end of 2024, remains outstanding, leaving substantial uncertainty around the future approach to DeFi regulation.
The legal characterization of Morpho Vaults within this regulatory environment is obscure. Vault tokens are unlikely to be classified as units of collective investment undertakings due to their inability to meet the cumulative criteria established under EU law. Specifically, vault tokens do not involve:
the pooling of capital from multiple investors;
the pursuit of an investment purpose guided by a defined investment policy; or
the generation of a pooled return for the benefit of investors.
Furthermore, the absence of day-to-day discretion or operational control over the management of pooled assets—an element emphasized in ESMA’s latest guidance—further distinguishes vault tokens from such classifications.
Despite the intentional design of Morpho Vaults to adhere to these parameters and ensure compliance, regulatory clarity cannot rest solely on public guidance. Each vault token must undergo a tailored legal assessment, considering its specific operational framework and desired protocol integrations, to establish its regulatory standing with greater certainty.
Risk Mitigation Recommendations
The risk considerations cited above highlight a number of composability risks and trust assumptions associated with employing Morpho vaults as collateral in lending platforms and CDP stablecoins. There is a common theme that, even during normal vault operation, there may be challenges in ensuring ample liquidity in all market scenarios. Therefore, we recommend any integrating protocols exercise a highly conservative approach to onboarding and for both users and integrating protocols to do extensive due diligence on any vault introduced as collateral.
For safe integration of Morpho vault shares as collateral, we recommend implementing conservative risk parameters:
The liquidation threshold and loan-to-value ratios should impose a conservative handicap above suitable parameterization of the underlying deposit token that adequately mitigates exposure to additional technical, economic, and operational risks associated with the vault.
The debt ceiling should adequately account for historical vault liquidity and apply a conservative handicap that mitigates exposure to adverse vault liquidity scenarios. The debt ceiling should be actively monitored and adjusted proactively as conditions evolve.
Note that these measures are intended to mitigate the risk to borrowers and to the protocol that integrates this category of collateral. However, risks can never be eliminated completely and users are advised to fully understand the nature of the collateral type before choosing to interact with markets that have integrated them.
Debt Ceiling Handicap
Many of the risks described above have critical implications for maintaining healthy levels of liquidity in the Morpho vault available for immediate redemption. These factors are essential considerations for any lending platform or CDP protocol choosing to integrate Morpho vaults as collateral types. When collateral becomes liquidatable, it is crucial that vault liquidity is sufficient to facilitate liquidation processing. In cases where liquidity is insufficient, there may be an increased risk of missed liquidations and accrual of bad debt to the protocol.
Recall that Morpho vaults enable users to supply their assets into an ERC4626 vault which then redistributes these assets to various lending markets. Before a user withdraws their assets, each vault checks to see if there is enough liquidity in each of the markets it supplies assets to and subsequently checks if there is enough to withdraw a user's assets from the vault. If this check fails, then the user's request to withdraw is denied.
Here is how vaults calculate liquidity for a given market:
Where mTotalSupply and mTotalDebt is a given market's total supply and debt of a particular asset/loan token, respectively, and MorphoBlue_LTB is the Loan Token Balance in the Morpho market.
Furthermore, vaults calculate a separate metric to check if a market is "withdrawable", meaning that users can withdraw all their assets from the vault. It is calculated as follows:
Where TotalSuppliedAssets is the total number of assets supplied by the vault to a given market. This metric essentially tells the vault the maximum amount of assets that are withdrawable from a given market.
We can use liquidity, TotalSuppliedAssets and withdrawable to determine an appropriate debt ceiling when integrating Morpho vaults into lending markets, to ensure that the amount of debt issued against vault shares account for historical vault liquidity. While such monitoring can provide insight into setting appropriate debt ceilings, there is no way to precisely predict liquidity conditions in all future market scenarios. This fact necessitates continuous monitoring and proactive management of the debt ceiling.
Our current methodology involves taking the 60-day moving average of vault liquidity and calculating the 99% percentile of values over that timeframe. This is to mitigate the potential for vault illiquidity that could potentially interfere with liquidations processing. See our Dune Dashboard which tracks and processes liquidity data for Morpho vaults on Base chain.
Markets Parameterization Handicap
Our process for evaluating optimal markets parameterization for Curve ecosystem lending and stablecoin protocols involves agent-based simulations to determine optimal conditions in terms of borrower losses and protocol bad debt. As Morpho vaults are an interest-bearing representation of the underlying deposit token, we conduct our analysis for the underlying.
However, exposure to vaults come with additional risks that may inhibit timely liquidations. Therefore we apply a handicap that limits protocol exposure and improves the likelihood that liquidations can be performed in adverse scenarios. In particular, this involves a reduction in the max LTV/LT (reducing borrower aggressiveness and increasing the bounds for successful liquidation) and reduction in the A parameter. A is a unique parameter in crvUSD-related products that specifies the width of price bands for facilitating soft liquidation arbitrage. Increasing the width of the bands can reduce borrower losses for assets that are more volatile or during times of reduced arbitrage efficiency.