# Morpho Blue

> Not investment advice. Ratings describe on-chain configuration only and may contain errors.

Snapshot 2026-10-24, methodology v0.2. Source: Celebtir, CC BY 4.0.

## Summary

- Chain: hyper_evm
- Category: lending
- Stage: Stage 0
- TVL: unavailable: DefiLlama has no listing for this protocol
- Website: https://app.morpho.org/
- Every core program has a verified build

## Value

Asset groups unavailable: DefiLlama has no listing for this protocol.
No tokens are listed for this protocol in the registry.

## Activity

- 24h volume: unavailable: DefiLlama has no listing for this protocol
- 24h fees: unavailable: DefiLlama has no listing for this protocol

## Risk summary

- Medium: Protocol parameters can be changed by 5 of 9 voters of multisig 0x34EdAe4f1Fd1b5947f6bE560ca371a56042daCbA using `owner()`.

## Risk analysis

- Upgrade control: **Low**. immutable. To improve: none: LOW is the lowest risk level.
  - Evidence: [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD) `proxy: none (registry)` at slot 49425943
- Upgrade delay: **Low**. immutable: the code cannot change. To improve: none: LOW is the lowest risk level.
  - Evidence: [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD) `proxy: none (registry)` at slot 49425943
- Admin powers: **Medium**. `owner()` can change parameters, held by Safe multisig, 5 of 9 voters, time lock 0 s. To improve: limit admin keys to parameters behind a 24 h+ time lock, or renounce them → LOW.
  - Evidence: [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD) `owner()` at slot 49425943
  - Evidence: [0x34EdAe4f1Fd1b5947f6bE560ca371a56042daCbA](https://hyperevmscan.io/address/0x34EdAe4f1Fd1b5947f6bE560ca371a56042daCbA) `getThreshold(), getOwners()` at slot 49425943
- Code transparency: **Low**. verified build of https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD#code at etherscan:etherscan. To improve: none: LOW is the lowest risk level.
  - Evidence: [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD) `etherscan verified source` at slot 49425943
- Oracle dependency: **Unknown**. price feeds not yet listed in the registry. To improve: verify and register the protocol's price feeds.
  - Evidence: [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD) `proxy: none (registry)` at slot 49425943
- Dependencies: **Low**. calls no other programs with user funds (declared in the registry, not traced from transactions). To improve: none: LOW is the lowest risk level.
  - Evidence: [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD) `registry dependencies` at slot 49425943

## Stage

Stage 0. Stages describe who can change the protocol and how fast. They don't measure code security.

- [x] Stage 0: core programs identified in the registry (1 core programs)
- [x] Stage 0: public source for every core program (all core programs have public source)
- [x] Stage 0: upgrade control readable for every core program (upgrade control read for all core programs)
- [x] Stage 1: upgrade control rated Low or Medium (LOW: immutable)
- [x] Stage 1: upgrade delay of the Stage 1 minimum, unless upgrades need an emergency multisig (every core program waits 5 days+ or needs an emergency multisig)
- [x] Stage 1: admin powers rated Low or Medium (MEDIUM: `owner()` can change parameters, held by Safe multisig, 5 of 9 voters, time lock 0 s)
- [x] Stage 1: no multisig has a single-key config authority (no single-key config authority)
- [x] Stage 1: verified builds for all core programs (all core programs verified)
- [ ] Stage 1: every factor could be read (Unknown caps the Stage at 0) (Unknown: Oracle dependency)
- [x] Stage 2: core programs immutable, or upgradeable only through on-chain governance with a long delay (no core program can be upgraded quickly)
- [x] Stage 2: no key can move or freeze user funds (no admin key can move or freeze funds)

## Control graph

- Morpho → Morpho Blue: core program
- Morpho → Morpho Blue: admin account
- Safe 5 of 9 · no delay → Morpho: can change parameters · no delay

## Permissions

- Safe 5 of 9 · no delay [0x34EdAe4f1Fd1b5947f6bE560ca371a56042daCbA](https://hyperevmscan.io/address/0x34EdAe4f1Fd1b5947f6bE560ca371a56042daCbA)
  - Change parameters: owner() on 0x68…57cD, no delay
- Held by no one: Upgrade the code (Morpho)

## Programs

- Morpho [0x68e37dE8d93d3496ae143F2E900490f6280C57cD](https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD): core, loader not read, controller Immutable, verified build of https://hyperevmscan.io/address/0x68e37dE8d93d3496ae143F2E900490f6280C57cD#code, last upgrade not read

## Upgrades & governance

- Upgrades: 0 so far (history still filling)
- Last upgrade: none
- Average interval: not enough upgrades

## Updates

- 2026-10-24 (info): morpho-blue added to coverage (detected within 3 days)

## Dependencies and sources

The sampled transactions called no other programs with user funds.
- Registry source for admin owner() (0x68e37dE8d93d3496ae143F2E900490f6280C57cD): https://docs.morpho.org/get-started/resources/addresses/
- Registry source for program Morpho (0x68e37dE8d93d3496ae143F2E900490f6280C57cD): https://docs.morpho.org/get-started/resources/addresses/
- Registry entry last reviewed: 2026-10-21 by celebtir-loop-draft

Web page: /protocols/morpho-blue/