Morpho User Exploits Oracle Error To Turn $350 Into $230K

Morpho Labs, a top 10 DeFi lending protocol, fell victim to an oracle misconfiguration exploit allowing a cunning user to turn $350 into $230,000.

The incident occurred on Oct.13 and targeted a Morpho pool for PAXG/USDC. The issue resulted in Morpho’s oracle mispricing PAXG due to a decimal misconfiguration.

Omer Goldberg, the founder of Chaos Labs, a risk management firm, said an opportunistic user took advantage of the oracle that incorrectly valued PAXG at a whopping $2.6 trillion.

Paxos Gold (PAXG) is a gold-backed token issued by Paxos. At the time of writing, PAXG is trading at $2,675.

“The Oracle SCALE_FACTOR was misconfigured, failing to account for the differences between decimals in USDC (6 decimals) and PAXG (18 decimals),” Goldberg said. “The exploiter realized the $2T dollar pricing of gold, supplied $350 dollars of $PAXG, and withdrew $250K.”

Goldberg attributed the error to a mistake made by the Morpho user who launched the pool. He said the user likely failed to monitor the post-calculation PAXG price provided by Morpho’s oracle.

“Decentralized systems like Morpho are robust but require setup precision, especially around risk and oracles,” Goldberg added.

Morpho Labs acknowledged the incident, confirming that the attack was isolated to a permissionlessly deployed market with a misconfigured oracle.

Morpho is the seventh-largest DeFi lending protocol with a total value locked of $1.36 billion, according to DeFi Llama. Morpho has grown 642% since the start of 2023. Morpho’s TVL tagged an all-time high above $1.91 billion in July

Largest Gold-Backed Tokens

Pax Gold is the second-largest gold-backed token with a market cap of $517.1 million, according to CoinGecko.

Tether Gold (XAUT) is the market leader with a capitalization of $656.7 million, while Quorium (QGOLD) comes in third with $223 million, followed by Kinesis Gold (KAU) with $118.7 million, and Gold DAO (GLDGOV) with $31.7 million.

Gold tokens have enjoyed an increase in adoption this year, with the combined capitalization of gold tokens currently sitting at nearly $1.6 billion. The figure marks a 54% increase since Feb. 25, while the price of gold is up 31% over the same period.