Resolv Exploit: How an Unbounded USR Mint Became a Vault Curation Disaster

The Resolv exploit started with an unbounded USR mint. Morpho Vault V1 accounting widened the loss. Attackers could push USDC into an insolvent market on behalf of a vault. This bypassed the vault's supply cap. The vault then counted the forced position as an asset. Attackers used that accounting change to withdraw real USDC from healthy markets.

The focus here is that second attack and what it meant for vault curators and depositors.

Table of Contents

1. TLDR
2. Two Failures Created One Loss Event
3. How the Resolv Exploit Broke USR
4. The Morpho Architecture Behind the Vault Attack
5. How Supply on Behalf Bypassed the Cap
6. The Vault Attack, Step by Step
7. The Limits of the Supply Cap
8. Public Allocator Flows Were a Separate Risk
9. Who Was Responsible?
10. What Curators and Vault Designers Should Change
11. Conclusion
12. FAQ

TLDR

• Attackers compromised Resolv's off-chain signing infrastructure. They then minted 80 million unbacked USR.
• USR collapsed on decentralized exchanges. Some Morpho markets still valued USR-related collateral near its old price.
• Morpho Vault V1 supply caps applied to actions made through the vault. Direct calls to Morpho Blue remained open.
• Anyone could call supply(..., onBehalf=vault) on Morpho Blue. This let attackers force USDC into a bad market for the vault.
• The vault treated the forced USDC position as part of totalAssets. Its share price increased even though the new position was economically insolvent.
• Attackers could use flash loans to buy most of the vault shares. They then inflated the share price, borrowed back the donated USDC, and redeemed their shares. The redemption pulled real USDC from healthy markets.
• A vault could gain more exposure to a failed asset than its curator intended. Even a zero supply cap left this path open.
• Resolv caused the depeg. Curators chose the markets and oracles. Morpho supplied an architecture in which the stated risk limit did not bound this attack.

Two Failures Created One Loss Event

The incident had two separate parts.

The first part was the Resolv exploit. It created 80 million unbacked USR. That broke the token's peg and made several USR-related collateral assets insolvent.

The second part happened in Morpho Vault V1. Morpho Blue processed valid, permissionless actions. Their interaction with the vault layer created the extraction path.

A third party could increase a vault's position in a bad market without curator approval. Direct supply created exposure above the cap. The attacker could then extract liquid assets from other markets in the same vault.

A third party could force a Morpho Vault V1 above its published supply cap.

Exposure control is a curator's main job. Depositors delegate market selection and position sizing to the curator. A visible cap is unreliable if outsiders can change the position behind it.

For background on the curator model, see our guide to DeFi vault curation.

How the Resolv Exploit Broke USR

Resolv operated USR as a crypto-backed dollar asset. The protocol used an off-chain service to complete some mint requests. That service checked the request and selected the amount of USR to issue.

The on-chain Counter contract trusted the authorized service. It did not enforce an independent price check or mint limit.

Resolv's postmortem describes a multi-stage infrastructure attack. The attackers first reached a third-party project. They then gained access to Resolv repositories and cloud credentials. From there, they obtained authority to use the signing key behind the minting service.

The first illicit transaction minted 50 million USR at 02:21:35 UTC. It is visible on Etherscan. A second transaction minted another 30 million USR.

The attackers sold part of that supply. Resolv estimated that they extracted about $25 million in ETH. USR then traded far below its intended $1 price.

Resolv's collateral pool remained in place. The new USR tokens were additional claims on that collateral. The extra supply diluted existing holders and broke assumptions across DeFi.

Some lending markets used an oracle that continued to value USR or wrapped USR near $1. Market prices had collapsed while the lending market still treated the collateral as sound.

That price gap made undercollateralized borrowing possible. An attacker could buy USR-related collateral cheaply. They could then post it at the much higher oracle value and borrow USDC.

This oracle failure created bad debt at the Morpho market layer. The Vault V1 design allowed that bad debt to spread further.

The Morpho Architecture Behind the Vault Attack

Morpho had two relevant layers.

Morpho Blue markets

Morpho Blue is the base lending protocol. Each market has one loan asset and one collateral asset. It also has a fixed oracle, interest-rate model, and liquidation loan-to-value ratio.

Markets keep separate accounts. Bad debt stays with the lenders in the affected market at the Morpho Blue layer.

Users can interact with Morpho Blue directly. They can supply, withdraw, borrow, repay, add collateral, and liquidate positions.

Morpho Vault V1

A Morpho Vault V1, also called MetaMorpho, sits above those markets. It is an ERC-4626 vault. Users deposit one asset, such as USDC, and receive vault shares.

The curator approves markets and sets supply caps. Allocators move the vault's USDC between approved markets. Two queues control normal fund movement:

• The supply queue decides where new deposits go.
• The withdrawal queue decides where the vault looks for USDC during redemptions.

The vault calculates its assets by adding its supply position in every market in the withdrawal queue:

01function totalAssets() public view returns (uint256 assets) {02    for (uint256 i; i < withdrawQueue.length; ++i) {03        assets += MORPHO.expectedSupplyAssets(04            marketParams(withdrawQueue[i]),05            address(this)06        );07    }08}

The simplified vault share price is:

share price = totalAssets / totalSupply

This works during normal lending. Interest increases the vault's market positions. totalAssets rises, while the number of shares stays almost unchanged. Existing shares become worth more.

The same accounting becomes dangerous after an oracle failure. Morpho may still record a USDC supply claim at face value even when the borrower cannot repay it. Vault V1.1 does not immediately write that bad debt down. This creates a gap between accounting value and recoverable value.

How Supply on Behalf Bypassed the Cap

Morpho Blue lets a supplier choose the owner of the new supply position. The function includes an onBehalf address.

That feature has normal uses. A router can supply for a user. A strategy can add funds for another contract. No permission from the receiver is required.

It also means anyone can supply USDC on behalf of a MetaMorpho vault.

This action happens at the Morpho Blue layer. It does not pass through the vault's deposit or reallocation functions, so the vault's supply cap is never checked.

The position still belongs to the vault. If the market remains in the withdrawal queue, totalAssets() includes it. The vault share price rises because the position increased, but no new vault shares were issued.

During normal operation, this is a donation. Existing depositors benefit, while the donor loses money.

After the USR depeg, the donor could recover the donation. They posted cheap USR-related collateral and borrowed the donated USDC back out. The vault kept the supply claim. The attacker recovered the cash.

The vault now appeared richer. In reality, it held a claim against an insolvent position.

Morpho's current security documentation describes this Vault V1 behavior in detail. It states that the potential loss is not bounded by the supply cap.

The Vault Attack, Step by Step

The attack combined a flash loan, a donation, an oracle mispricing, and a vault redemption.

Step 1: Temporarily own a large part of the vault

The attacker took a flash loan of USDC. They deposited most of that USDC into the target vault and received vault shares. They kept the rest for the forced supply.

The flash loan let the attacker own a large share of the vault for one transaction. That percentage determined how much of the artificial increase the attacker could claim.

If deposits were enabled, the attacker could make this fraction very large.

Step 2: Force USDC into the broken market

The attacker called Morpho Blue directly. They supplied USDC to the USR-related market with the vault as onBehalf.

The vault's supply position increased. Its totalAssets also increased. Its share count did not.

This raised the vault share price.

The vault supply cap did not block the call. The attacker never used the vault's allocation function.

Step 3: Borrow the donated USDC back

The attacker bought depegged USR or a related wrapper on the market. They posted it as collateral in the same Morpho market.

The market oracle still valued the collateral near its old price. The attacker borrowed the USDC that had just been supplied on behalf of the vault.

This recovered most or all of the donation. The costs were the depegged collateral, swaps, gas, and flash-loan fees.

The vault was left with a USDC lender position in the broken market. The borrower position looked healthy to the oracle. Economically, it was undercollateralized.

Step 4: Redeem the inflated vault shares

The attacker redeemed the shares bought in step one. The vault calculated the redemption using the inflated totalAssets value.

The attacked market had no liquid USDC left because the attacker had borrowed it. The vault followed its withdrawal queue and pulled USDC from other markets.

Those markets could have sound collateral and working oracles.

This is how the loss crossed market boundaries. Morpho Blue markets stayed isolated, but the MetaMorpho vault held positions across several markets. Its redemption logic turned healthy-market liquidity into payment for an inflated vault share price.

Step 5: Repay the flash loan

The attacker repaid the temporary USDC loan. The remaining USDC was profit.

The vault depositors were left with less liquid USDC and more exposure to the insolvent market.

A simplified numerical example

Assume a vault starts with $1 million of assets and 1 million shares. Each share is worth $1.

1. An attacker flash-borrows $1 million. They deposit $900,000 into the vault and keep $100,000 for the next step. The deposit produces 900,000 shares.
2. The vault now has $1.9 million of assets and 1.9 million shares.
3. The attacker supplies another $100,000 to the broken market on behalf of the vault.
4. The vault reports $2 million of assets. Its share price rises to about $1.0526.
5. The attacker uses cheap, mispriced collateral to borrow the donated $100,000 back.
6. The attacker now holds the recovered $100,000 and redeems 900,000 shares for about $947,000.
7. They repay the $1 million flash loan.

The gross difference is about $47,000. The attacker must subtract the cost of the depegged collateral and transaction fees.

Profit depends on liquidity, LLTV, oracle value, and the attacker's share of the vault. The donation raises the accounting value. Borrowing recovers the donation. Redemption converts the accounting gain into real assets.

An independent transaction-level explanation by Unified Labs walks through the sequence on-chain.

The Limits of the Supply Cap

A curator could reasonably read “supply cap” as the maximum vault exposure to a market. That was not the full guarantee in Vault V1.

The cap limited supplies initiated through the vault. It did not limit a position created directly on Morpho Blue for the vault address.

The official Vault V1.1 repository contained a warning. It said a vault could exceed its supply cap because of donations or interest. The underlying behavior was public.

The warning did not explain the full economic attack. It did not show how a third party could pair a donation with broken collateral, recover the donation through borrowing, and redeem against healthy markets. It also did not explain why a zero cap could leave the whole vault exposed.

The current Morpho security guide is much more direct. It now states all of the following:

• Supply caps do not protect against direct donations.
• A market with a zero cap can remain fully vulnerable.
• The potential loss is not bounded by the cap.
• The dangerous market must be removed from the withdrawal queue.
• Deposits should be stopped by emptying the supply queue during the incident.

Morpho's pre-incident guidance mentioned the low-level behavior. It did not explain the possible loss or emergency steps.

The architecture created the underlying problem. The vault counted any Morpho Blue supply position owned by its address. It could not distinguish an allocator-approved position from an attacker-created position.

Public Allocator Flows Were a Separate Risk

Vault exposure also increased through Public Allocator flows.

Morpho also offered a Public Allocator. It could move liquidity between approved markets when users needed to borrow more than the current market liquidity.

This feature improved capital efficiency during normal operation. During the USR collapse, it could move fresh USDC into a market with heavy borrowing demand and a broken price assumption.

The Public Allocator followed its configuration. It had no check for a market price that had diverged from the oracle. An approved market, available flow capacity, and borrower demand were enough to trigger reallocation.

Post-incident analysis from Staking Rewards estimated about $6.2 million of cascading bad debt across 11 Morpho vaults. It attributed most of that amount to automated capital flows in Gauntlet-curated vaults.

This mechanism differs from the donation attack:

• In the donation attack, an outsider supplies on behalf of the vault and bypasses the cap.
• In the Public Allocator case, the vault moves its own liquidity under curator-configured flow limits.

Both mechanisms sent more USDC into the broken market after USR had already failed.

Who Was Responsible?

Responsibility follows the controls at each layer.

Resolv

Resolv created the original insolvency. Its off-chain signer could authorize an economically impossible mint. The on-chain contract had no independent amount limit, oracle check, or rate limit.

Without the unbacked mint, the downstream attacks would not have had depegged collateral to use.

Vault curators

Curators approved the USR-related markets. They accepted the market oracles and set the vault queues, caps, and Public Allocator flow limits.

Some curators reacted too slowly or left automated flows active. Their role included understanding collateral risk and limiting losses, even when the protocol interface was unclear.

Morpho

Morpho Blue's contracts performed the requested actions. Vault V1 combined permissionless onBehalf supplies with accounting that counted the resulting position. Morpho also presented supply caps as a core curator risk control.

The cap did not bound exposure in this scenario. A zero cap could still leave the vault open to a donation attack. That is a material protocol design limitation.

The repository mentioned that donations could push exposure above the cap. Earlier guidance did not explain the full loss path or the required emergency response. Morpho shares responsibility for the architecture and for how the cap was described.

A precise description is:

Morpho Blue's core access rules held. Vault V1 still allowed outsiders to alter a vault's risk exposure beyond its supply cap.

What Curators and Vault Designers Should Change

For Vault V1 curators

After an oracle failure, a zero cap leaves the direct-supply path open.

Curators should immediately empty the supply queue. This blocks attackers from buying a large fraction of vault shares through a new deposit. They should then remove the affected market from the withdrawal queue.

If the vault still has funds in an illiquid market, removal may require the forced-removal process and its timelock. Curators need a playbook for that delay.

Automated monitoring should compare oracle value with executable market prices. It should disable deposits and allocator flows when the difference crosses a strict threshold.

Correlated assets must be grouped together. USR, stUSR, wstUSR, and RLP belong to one risk family because they depend on the same issuer and recovery process.

For Morpho integrations

Interfaces should describe a Vault V1 supply cap as a limit on vault-initiated allocations. They should show actual allocation, approved cap, direct donations, and maximum forced exposure separately.

Emergency warnings should explain that a zero cap does not neutralize a market while it remains in the withdrawal queue.

Morpho's current documentation says Vault V2 is not affected when it supplies directly to Morpho markets through the MorphoMarketV1AdapterV2. Vault V2 can still inherit exposure if it invests through a Vault V1 adapter.

For depositors

Depositors should inspect the market list and its automation. A curator's name alone says little about current exposure. Questions include:

• Can anyone increase a vault position outside the curator's allocation path?
• Does a supply cap limit actual exposure or only approved allocations?
• Which markets remain in the withdrawal queue after their cap reaches zero?
• Can a Public Allocator route funds into a market during a depeg?
• Does the oracle track an executable market price or an internal redemption value?
• Can deposits be stopped automatically when the oracle diverges from the market?

Our Morpho risk assessment explains how to review market-level oracle, liquidation, and liquidity assumptions.

Conclusion

The Resolv exploit supplied the broken collateral. The Morpho Vault V1 design turned that collateral failure into a wider vault loss.

The loss came from a gap between two layers. The vault enforced caps on its own allocation functions. Morpho Blue allowed anyone to supply on behalf of the vault. The vault then counted that forced position in its share price.

A flash-loan attacker could exploit the gap. They could become a large vault shareholder, donate into the broken market, borrow the donation back, and redeem against healthy liquidity.

The base Morpho markets remained isolated. The vault joined them together economically.

Curators controlled market and automation choices. Resolv controlled the minting system. Morpho designed a vault whose supply cap did not bound this loss path. Each layer contributed to the final loss.

About Us

SC Audit Studio performs smart-contract security reviews and protocol risk analysis. For questions about this analysis or a security assessment, contact our team.