H-4: Direct Morpho borrow misprices withdrawal-request collateral

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll. Standalone Foundry PoC and full write-up: 62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll_exp in the evm-hack-registry mirror.

Field	Value
Protocol	Notional Exponent
Severity	high
Source	AuditVault / https://github.com/sherlock-audit/2025-06-notional-exponent-judging
Harm	Over-borrow vs request-backed LTV (bad debt) when Morpho price ignores withdraw request

TL;DR#

Over-borrow vs request-backed LTV (bad debt) when Morpho price ignores withdraw request

Vulnerable code#

See the synthetic reproduction in test/62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll.sol — the blamed line is marked // @> VULN.

Root cause#

Faithful reduction of the AuditVault finding. The vulnerable line is preserved so the Playground locator points at the real bug, not scaffolding.

Attack walkthrough#

Deploy the reduced protocol pieces via the Exploit constructor.
run() performs the attack end-to-end and requires the harm.

Diagrams#

sequenceDiagram participant A as Attacker participant V as Vulnerable participant T as Target A->>V: trigger vulnerable path V->>V: @> VULN line executes V->>T: harm materializes A->>A: assert harm

Impact#

Over-borrow vs request-backed LTV (bad debt) when Morpho price ignores withdraw request

Taxonomy#

severity/high
sector/lending
platform/auditvault

Sources#

AuditVault finding: https://github.com/Auditware/AuditVault/blob/main/findings/62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll.md
Original report: https://github.com/sherlock-audit/2025-06-notional-exponent-judging
Reduced from: sherlock-audit/2025-06-notional-exponent@82c87105 (AbstractYieldStrategy price/convertToAssets)

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll_exp (evm-hack-registry mirror).
AuditVault finding: 62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync