Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Morpho

Bug bounty on Cantina morpho.org

Accepting reports No KYC web3
Go to program Website
Top reward
$2,500,000
Top severity paid
Critical
Assets in scope
9
Public CVEs
1
Last change

At a glance

What to know before you start testing.

Pays up to $2,500,000
for critical bugs.
Report on Cantina
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Paid by USDC on Ethereum
No identity check to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Cantina lists as the payout for each severity.

Severity Reward
Critical $2,500,000 from $250,000
High $50,000 from $10,000
Medium $10,000 from $3,000
Low $3,000 from $1,000
Safe harbor
Partial Not publicize or exploit a vulnerability in any way, other than through private reporting to us

Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

9 assets you may test.

Web 8

  • https://app.morpho.org
  • https://curator.morpho.org
  • https://curator-v1.morpho.org
  • https://docs.morpho.org/developers/contracts/addresses
  • https://fallback.morpho.org
  • https://liquidation.morpho.org
  • https://markets.morpho.org
  • https://morpho.org

Source code 1

  • https://github.com/morpho-org/sdks

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Morpho (via Cantina)'s policy. "We" in these lines means the program, not this site.

While testing

  • Live testing on public chains, including public mainnet deployments and public testnet deployments.
  • We recommend testing on local forks, for example using foundry.
  • Public disclosure of bugs without the consent of the Morpho team.
  • Not exploit the vulnerability in any way, including through making it public or by obtaining a profit (other than a reward under this Program).
  • Refrain from any privacy violations, destruction of data, interruption or degradation of any of the assets in scope.
  • Not engage in any unlawful conduct when disclosing the bug, including through threats, demands, or any other coercive tactics.

Summarised with AI from the program policy on Cantina, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 3 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://docs.morpho.org/developers/contracts/addresses/

  2. Scope removed

    https://github.com/morpho-org/pre-liquidation/tree/main

  3. Scope removed

    0xfd32fA2ca22c76dD6E550706Ad913FC6CE91c75D

  4. Scope removed

    0xb98c948CFA24072e58935BC004a8A7b376AE746A

  5. Scope removed

    https://github.com/morpho-org/bundles

  6. Scope removed

    https://github.com/morpho-org/morpho-blue-irm

  7. Scope removed

    0x9e2ea2d5785598a163D569D795f286F5C55ad972

  8. Scope removed

    https://github.com/morpho-org/morpho-blue-bundlers/tree/5466a6bedc5c9afc37584c0515ddaf51fc095370

  9. Scope removed

    0xa9c3d3a366466fa809d1ae982fb2c46e5fc41101

  10. Scope removed

    0x6566194141eefa99Af43Bb5Aa71460Ca2Dc90245

  11. Scope removed

    https://github.com/morpho-org/metamorpho

  12. Scope removed

    https://github.com/morpho-org/vault-v2/tree/2f0c4a3885160371369362f624d2a6e9c94c399a/src

  13. Scope removed

    0x03b5259Bd204BfD4A616E5B79b0B786d90c6C38f

  14. Scope removed

    https://github.com/morpho-org/metamorpho-v1.1

  15. Scope removed

    0x2CC8d502a65824B4cF9A58DB03490bA024BDB806

  16. Scope removed

    https://github.com/morpho-org/vault-v2-adapter-registries/tree/d3b239ba9445099fba19109629d9bb9c7c4709f9/src

  17. Scope removed

    https://github.com/morpho-org/morpho-blue-oracles

  18. Scope removed

    https://github.com/morpho-org/metamorpho/tree/c5e758da97d210ede921bf228d37d31e744bd5bf

  19. Scope removed

    0x4011dc6581fA05F9B0c7A12AdCd676e2b1a59ca3

  20. Scope removed

    0x3A7bB36Ee3f3eE32A60e9f2b33c1e5f2E83ad766

  21. Scope removed

    0x9B89c07f480Df1945279031b5fC6fF241b8f1101

  22. Scope removed

    0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb

  23. Scope removed

    https://github.com/morpho-org/bundler3/tree/82e44ddebae998dc8b6e5cbd29ff69786135b1d3

  24. Scope removed

    0xf83D17dFE160597b19e4FdD8ea61A23e9a87F962

  25. Scope removed

    https://github.com/morpho-org/morpho-blue/tree/55d2d99304fb3fb930c688462ae2ccabb1d533ad

  26. Scope removed

    https://github.com/morpho-org/morpho-blue-oracles/tree/7d638ad5f6d7dd1c2355b42aaca406f0531161f6/src/morpho-chainlink

  27. Scope removed

    82e44ddebae998dc8b6e5cbd29ff69786135b1d3

  28. Scope removed

    https://github.com/morpho-org/midnight

  29. Scope removed

    0xdBa5bdE29eA030Bfa6A608592dFcA1D02CB26773

  30. Scope removed

    https://github.com/morpho-org/morpho-blue

  31. Scope removed

    https://github.com/morpho-org/public-allocator/tree/1994f575aed4097196108f83ee19ca9fb59e6cba/src

  32. Scope removed

    0xb09e40EbE31b738fbf20289270a397118707D475

  33. Scope removed

    https://github.com/morpho-org/bundles/tree/main/src/midnight

  34. Scope removed

    0x40288815C399709dFC0875A384B637fFe387961B

  35. Scope removed

    0x4A6c312ec70E8747a587EE860a0353cd42Be0aE0

  36. Scope removed

    0x870aC11D48B15DB9a138Cf899d20F13F79Ba00BC

  37. Scope removed

    https://github.com/morpho-org/midnight/tree/main

  38. Scope removed

    https://github.com/morpho-org/vault-v2/tree/21910a002d69ca27b0b622a64c30e7d6e4b49e6c/src

  39. Scope removed

    https://github.com/morpho-org/morpho-blue-irm/tree/a7d9cce3451b4a106bfd40933ac57a785b5228f3

  40. Scope removed

    https://github.com/morpho-org/public-allocator

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2014-2363 High 10.0 26 Jul 2014

Original policy

Copied from cantina.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Morpho @ morpho Live Cantina-Triaged Maximum reward $2,500,000 Severity Max. Reward Critical $2,500,000 High $50,000 Medium $10,000 Low $3,000 Deposit required $30 Findings submitted 1,707 Start date 27 Mar 2024 Please sign in as a researcher to join the bounty. Log in Instructions Scope Morpho is an open lending network that connects lenders and borrowers to the best opportunities globally. Businesses integrate Morpho's neutral infrastructure to power lending or borrowing products at scale, including embedded crypto-backed loans and earn products. Morpho network is powered by multiple protocols: Morpho Midnight : a non-custodial fixed-rate lending protocol. Morpho Blue : a non-custodial variable rate lending protocol. Morpho Vault V2 : non-custodial vaults that can allocate to any protocol via adapters. Morpho Vaults V1 (previously known as MetaMorpho): non-custodial vaults that can allocate to Morpho Blue markets. For more information about Morpho, please visit https://morpho.org/ Morpho provides rewards in USDC on Ethereum, denominated in USD. Reward ranges per severity are listed for each asset group on the Scope tab. Scope WepApps in scope: https://app.morpho.org/ https://curator-v1.morpho.org/ https://curator.morpho.org/ https://fallback.morpho.org/ https://liquidation.morpho.org/ https://morpho.org/ https://markets.morpho.org/ https://github.com/morpho-org/sdks Smart Contracts in Scope The in-scope smart contracts, with their deployed addresses on every supported chain, are listed on the Morpho contract addresses page . That page is the source of truth for scope. Severity Classification SeverityLevel │ Impact: Critical │ Impact: High │ Impact: Medium │ Impact: Low Likelihood: High │ Critical │ High │ Medium │ Low Likelihood: Medium │ High │ High │ Medium │ Low Likelihood: Low │ Medium │ Medium │ Low │ Informational Details on Bounty severity classification: https://docs.cantina.xyz/cantina-docs/cantina-bounties/bounty-severity-classification Eligibility: To participate in this program, security researchers must comply with the rules of engagement and must not: Be listed on OFAC's SDN list Have been an official contributor, either past or present Be employees or individuals closely associated with the project Be security auditors who directly or indirectly participated in the audit review Morpho will require KYC information for processing payments on successful bug submissions. The following details must be provided: Full name Date of birth A copy of your passport or other government-issued ID To be eligible for a reward under this Program, you must: Discover a previously-unreported, non-public vulnerability that is not previously known by the Morpho team and is within the scope of this Program Be the first to disclose the unique vulnerability, in compliance with the disclosure requirements. Not submit a vulnerability caused by an underlying issue that is the same as an issue on which a reward has been paid under this Program. Provide sufficient information to enable our engineers to reproduce and fix the vulnerability. Not exploit the vulnerability in any way, including through making it public or by obtaining a profit (other than a reward under this Program). Not publicize or exploit a vulnerability in any way, other than through private reporting to us Refrain from any privacy violations, destruction of data, interruption or degradation of any of the assets in scope. Not engage in any unlawful conduct when disclosing the bug, including through threats, demands, or any other coercive tactics. Comply with all the rules of the Program, including but not limited to, refraining from engaging in any Prohibited Actions. Prohibited Actions Live testing on public chains, including public mainnet deployments and public testnet deployments. We recommend testing on local forks, for example using foundry. Public disclosure of bugs without the consent of the Morpho team. Conflict of Interest : any individual who is or has ever been employed by Morpho may not participate in the Bug Bounty. Additionally, any individual who has been involved in or contributed to the development of the code of the bug in question may not participate in the Bug Bounty. Disclosure The vulnerability must not be disclosed publicly or to any other person, entity or email address before Morpho has been notified, has fixed the issue, and has granted permission for public disclosure.