{"investigation":{"slug":"leadblocks-morpho-blue-market","entity_name":"LeadBlock's Morpho Blue Market","trust_score":38,"severity_base":null,"score_modifier":-10,"confidence":0.72,"status":"published","content_type":"investigation","summary":"LeadBlock's Morpho Blue Market refers to a permissionless lending market and associated MetaMorpho vault curated by LeadBlock Partners on the Morpho Blue protocol. On October 13, 2024, an oracle misconfiguration in the LeadBlock-curated PAXG/USDC market enabled an opportunistic user to borrow approximately $230,000 in USDC against only $350 of PAXG collateral, exploiting an overvalued asset price of $2.6 trillion per unit of gold. The incident was attributed to an incorrectly configured SCALE_FACTOR by LeadBlock's oracle provider and raised questions about the adequacy of pre-launch testing and risk curation practices.","sections":[{"content":"LeadBlock Partners is a London and Paris-based venture capital firm founded in 2019 by former Goldman Sachs employees David Chreng-Messembourg, Baptiste Cota, and Jean-Marc Puel. The firm focuses exclusively on the digital assets and blockchain ecosystem with an emphasis on institutional and corporate blockchain adoption. LeadBlock closed its second fund, LeadBlock Fund II, at $150 million in November 2022. Its portfolio includes investments in Yuga Labs, Bitpanda, BlockFi, and Talos. LeadBlock also participated as a limited partner in Morpho's $50 million private-sale funding round led by Ribbit Capital in August 2024. In addition to its venture activities, LeadBlock acts as a risk curator on the Morpho Blue lending protocol, where curators are responsible for configuring market allocations, supply caps, and oracle parameters for MetaMorpho vaults. The firm's team background includes traditional finance experience at Goldman Sachs, Rothschild, Barclays, and GE Capital.","heading":"Overview of LeadBlock Partners","sources":[{"url":"https://www.theblock.co/post/184000/european-crypto-venture-firm-leadblock-partners-hits-first-close-of-150-million-fund-exclusive","name":"theblock.co","type":"other","credibility":3},{"url":"https://leadblockpartners.com/","name":"leadblockpartners.com","type":"other","credibility":3},{"url":"https://morpho.mirror.xyz/bgUB21hQoy-w7T9je7sEpgTp4EsMMkwbO3sFJmWAwGw","name":"morpho.mirror.xyz","type":"other","credibility":3},{"url":"https://forum.morpho.org/t/leadblock-rwa-backed-usdc-vault/507","name":"forum.morpho.org","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 13, 2024, the PAXG/USDC lending market on Morpho Blue — curated by LeadBlock Partners — was exploited following an oracle misconfiguration. The oracle's SCALE_FACTOR was incorrectly configured during market creation, failing to account for the decimal difference between PAXG (18 decimals) and USDC (6 decimals). This 12-decimal gap caused the oracle to value PAXG at approximately $2.6 trillion per token instead of its actual market price, inflating PAXG's collateral value by a factor of 10^12. An opportunistic user identified the pricing error and exploited it by depositing approximately $350 worth of PAXG as collateral, then borrowing approximately $230,000 in USDC against the artificially inflated position. The exploit transaction hash is 0x256979ae169abb7fbbbbc14188742f4b9debf48b48ad5b5207cadcc99ccb493b and the attacker's address is 0x02DBE46169fDf6555F2A125eEe3dce49703b13f5. The vulnerable Morpho protocol contract is 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb. The total reported loss from the incident was approximately $230,000 USD. LeadBlock's post-incident retrospective, published on the Morpho governance forum on October 15, 2024, attributed the error to an oracle provider rather than LeadBlock's own configuration process, though LeadBlock accepted responsibility for not catching the error before deployment.","heading":"Oracle Misconfiguration Incident — October 2024","sources":[{"url":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","name":"forum.morpho.org","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/decoding-morphoblues-230k-exploit-6296565ced40","name":"medium.com","type":"other","credibility":3},{"url":"https://blog.solidityscan.com/morphoblue-hack-analysis-638b685f8bf2/","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://blog.verichains.io/p/morpho-protocol-market-oracle-price","name":"blog.verichains.io","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560604270503","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"},{"content":"LeadBlock's public retrospective on the Morpho governance forum stated that the borrow was 'fully repaid to the vault and the lender' and that 'no user funds were lost.' However, third-party analysis from governance participant PGov contested this characterization. According to PGov's analysis, an initial borrower maintained approximately 17,800 USDC borrowed using minimal collateral, and direct lenders holding approximately 95,000 USDC in the affected market faced potential bad debt exposure — with at least three borrower addresses using roughly $150 in collateral. Morpho Blue's protocol architecture isolates risk by market: when all collateral in a position is depleted but debt remains, the protocol distributes the resulting bad debt among all lenders in that specific market by reducing total borrow and supply asset balances proportionally. Due to this market isolation design, losses were contained to depositors in the PAXG/USDC market and did not affect Morpho's other markets or vaults. The PAXG/USDC market represented approximately 4% of LeadBlock's vault allocation at the time of the incident. The contested claims regarding whether all lenders were ultimately made whole have not been independently resolved in available public sources.","heading":"Disputed Loss Outcome and Lender Impact","sources":[{"url":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","name":"forum.morpho.org","type":"other","credibility":3},{"url":"https://docs.morpho.org/learn/resources/risks/","name":"docs.morpho.org","type":"other","credibility":3},{"url":"https://docs.morpho.org/curate/tutorials-v1/bad-debt/","name":"docs.morpho.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Morpho Blue is a permissionless protocol: any party can deploy a market with any combination of loan asset, collateral asset, liquidation loan-to-value ratio, oracle, and interest rate model. The risk curator role — held by LeadBlock for its USDC RWA vault — carries responsibility for market selection, oracle configuration, supply cap setting, and ongoing risk monitoring. Morpho Labs issued a public statement following the incident emphasizing that the exploit was not due to an underlying smart contract vulnerability but was instead a failure at the risk curation layer. Morpho Labs stated: 'The Morpho protocol provides permissionless infrastructure that enables an open market for risk curation. While errors at the risk curation layer may occasionally occur, the underlying protocol remains secure and resilient.' Following the incident, Morpho added risk warnings to its user interface, alerting depositors of possible risks associated with specific markets and, in some cases, requiring opt-in acknowledgment before proceeding. LeadBlock disclosed it implemented 'new processes during market creation and testing to catch such issues before launch.' The incident was noted across DeFi security communities as an example of the risks inherent in permissionless curator models where market deployers may not fully understand decimal precision requirements for oracle configuration.","heading":"Risk Curation Responsibilities and Morpho Protocol Response","sources":[{"url":"https://x.com/MorphoLabs/status/1845746698393391167","name":"x.com","type":"other","credibility":3},{"url":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","name":"forum.morpho.org","type":"other","credibility":3},{"url":"https://morpho.org/blog/introducing-risk-warnings-transitioning-to-a-permissionless-interface/","name":"morpho.org","type":"other","credibility":3},{"url":"https://docs.morpho.org/learn/resources/risks/","name":"docs.morpho.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Separate from the PAXG/USDC incident, LeadBlock operates a USDC RWA MetaMorpho vault on Morpho Blue (contract address: 0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6) that allocates deposited USDC to lending markets backed by real-world assets. At launch, the primary collateral asset was mTBILL, a tokenized Treasury bond product issued by Midas and described as backed 1:1 by short-dated U.S. Treasuries through BlackRock's Treasury Bond ETF. A collaborative announcement between Midas and LeadBlock in 2024 described the vault as enabling access to yields from tokenized assets while capturing incentives from RWA issuers. The vault is available to all Morpho users globally; however, mTBILL tokens are not registered under U.S. securities laws and cannot be offered to U.S. persons. LeadBlock states it acts only as risk curator and that user rights derive from Morpho's Terms of Use, not from LeadBlock directly. The underlying Morpho Blue smart contracts have been audited by Spearbit, ChainSecurity, and others, with formal verification by Certora. These audits cover the protocol layer but do not extend to curator-level configurations or specific market parameters set by LeadBlock.","heading":"LeadBlock USDC RWA Vault — Ongoing Operations","sources":[{"url":"https://app.morpho.org/ethereum/vault/0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6/leadblock-usdc-rwa","name":"app.morpho.org","type":"other","credibility":3},{"url":"https://forum.morpho.org/t/leadblock-rwa-backed-usdc-vault/507","name":"forum.morpho.org","type":"other","credibility":3},{"url":"https://blog.midas.app/midas-and-leadblock-pioneering-the-mtbill-backed-lending-market-on-morpho-blue/","name":"blog.midas.app","type":"other","credibility":3},{"url":"https://www.chainsecurity.com/security-audit/morpho-vault-v2","name":"chainsecurity.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, a pseudonymous blockchain investigator and open-source intelligence researcher known for investigating cryptocurrency fraud and exploits, flagged LeadBlock's Morpho Blue market for inclusion in the AVOID.NET risk intelligence database. ZachXBT has been active since 2021 and joined Paradigm as an incident response advisor in February 2025. The precise nature or context of ZachXBT's flag specific to this entity has not been independently confirmed from a publicly accessible post or thread as of the date of this investigation. The DeFi security community, including security firms QuillAudits, SolidityScan, and Verichains, published technical analyses of the October 2024 oracle exploit. No regulatory action (SEC, CFTC, or DOJ) has been identified in connection with LeadBlock Partners or the Morpho Blue market incident. The incident has been discussed primarily in DeFi security and governance forums rather than in formal enforcement proceedings.","heading":"ZachXBT Flag and Community Attention","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/decoding-morphoblues-230k-exploit-6296565ced40","name":"medium.com","type":"other","credibility":3},{"url":"https://blog.solidityscan.com/morphoblue-hack-analysis-638b685f8bf2/","name":"blog.solidityscan.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019","event":"LeadBlock Partners founded in London by former Goldman Sachs employees David Chreng-Messembourg, Baptiste Cota, and Jean-Marc Puel, focusing on digital assets and blockchain venture capital.","source":"","date_original":"2019-01-01"},{"date":"2022-11","event":"LeadBlock Partners closes Fund II at $150 million, backed by family offices, hedge fund managers, and financial institutions.","source":"","date_original":"2022-11-01"},{"date":"2024-08","event":"Morpho raises $50 million in a private sale round led by Ribbit Capital; LeadBlock Bitpanda Ventures participates as a backer.","source":"","date_original":"2024-08-01"},{"date":"2024","event":"LeadBlock Partners establishes role as risk curator on Morpho Blue, launching its USDC RWA MetaMorpho vault (0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6) in collaboration with Midas, allocating against mTBILL collateral.","source":"","date_original":"2024-01-01"},{"date":"2024-10-13","event":"Oracle misconfiguration in the LeadBlock-curated PAXG/USDC market on Morpho Blue is exploited. An attacker deposits $350 of PAXG and borrows approximately $230,000 USDC by exploiting an inflated oracle price of $2.6 trillion per PAXG unit caused by a 12-decimal SCALE_FACTOR error. Attacker address: 0x02DBE46169fDf6555F2A125eEe3dce49703b13f5.","source":""},{"date":"2024-10-15","event":"LeadBlock publishes a retrospective on the Morpho governance forum acknowledging the oracle misconfiguration, stating the error was introduced by an oracle provider, claiming all borrowed funds were repaid, and disclosing new internal testing processes for future market creation.","source":""},{"date":"2024-10-18","event":"Multiple DeFi security firms — including QuillAudits, SolidityScan, and Verichains — publish technical post-mortems on the exploit, detailing on-chain transactions and the decimal mismatch root cause.","source":""},{"date":"2024-10-14","event":"Morpho Labs posts on X (formerly Twitter) distinguishing the risk curation failure from any underlying protocol vulnerability; Morpho subsequently introduces opt-in risk warnings on its interface for flagged markets.","source":""}],"sources_used":[{"url":"https://www.theblock.co/post/184000/european-crypto-venture-firm-leadblock-partners-hits-first-close-of-150-million-fund-exclusive","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://leadblockpartners.com/","name":"leadblockpartners.com","type":"other","archive_url":"http://web.archive.org/web/20260829013310/https://leadblockpartners.com/","credibility":3,"archive_timestamp":"2026-08-29T01:33:10+00:00"},{"url":"https://morpho.mirror.xyz/bgUB21hQoy-w7T9je7sEpgTp4EsMMkwbO3sFJmWAwGw","name":"morpho.mirror.xyz","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://forum.morpho.org/t/leadblock-rwa-backed-usdc-vault/507","name":"forum.morpho.org","type":"other","archive_url":"http://web.archive.org/web/20250830205843/https://forum.morpho.org/t/leadblock-rwa-backed-usdc-vault/507","credibility":3,"archive_timestamp":"2025-08-30T20:58:43+00:00"},{"url":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","name":"forum.morpho.org","type":"other","archive_url":"https://web.archive.org/web/20260829133844/https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","credibility":3,"archive_timestamp":"2026-08-29T13:38:44+00:00"},{"url":"https://medium.com/coinmonks/decoding-morphoblues-230k-exploit-6296565ced40","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.solidityscan.com/morphoblue-hack-analysis-638b685f8bf2/","name":"blog.solidityscan.com","type":"other","archive_url":"http://web.archive.org/web/20260622101006/https://blog.solidityscan.com/morphoblue-hack-analysis-638b685f8bf2/","credibility":3,"archive_timestamp":"2026-06-22T10:10:06+00:00"},{"url":"https://blog.verichains.io/p/morpho-protocol-market-oracle-price","name":"blog.verichains.io","type":"other","archive_url":"http://web.archive.org/web/20260419214612/https://blog.verichains.io/p/morpho-protocol-market-oracle-price","credibility":3,"archive_timestamp":"2026-04-19T21:46:12+00:00"},{"url":"https://www.bitget.com/news/detail/12560604270503","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260830003605/https://www.bitget.com/news/detail/12560604270503","credibility":3,"archive_timestamp":"2026-08-30T00:36:05+00:00"},{"url":"https://docs.morpho.org/learn/resources/risks/","name":"docs.morpho.org","type":"other","archive_url":"http://web.archive.org/web/20260825171356/https://docs.morpho.org/learn/resources/risks/","credibility":3,"archive_timestamp":"2026-08-25T17:13:56+00:00"},{"url":"https://docs.morpho.org/curate/tutorials-v1/bad-debt/","name":"docs.morpho.org","type":"other","archive_url":"http://web.archive.org/web/20260415033439/https://docs.morpho.org/curate/tutorials-v1/bad-debt/","credibility":3,"archive_timestamp":"2026-04-15T03:34:39+00:00"},{"url":"https://x.com/MorphoLabs/status/1845746698393391167","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://morpho.org/blog/introducing-risk-warnings-transitioning-to-a-permissionless-interface/","name":"morpho.org","type":"other","archive_url":"http://web.archive.org/web/20260118035857/https://morpho.org/blog/introducing-risk-warnings-transitioning-to-a-permissionless-interface/","credibility":3,"archive_timestamp":"2026-01-18T03:58:57+00:00"},{"url":"https://app.morpho.org/ethereum/vault/0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6/leadblock-usdc-rwa","name":"app.morpho.org","type":"other","archive_url":"http://web.archive.org/web/20260312045943/https://app.morpho.org/ethereum/vault/0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6/leadblock-usdc-rwa","credibility":3,"archive_timestamp":"2026-03-12T04:59:43+00:00"},{"url":"https://blog.midas.app/midas-and-leadblock-pioneering-the-mtbill-backed-lending-market-on-morpho-blue/","name":"blog.midas.app","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.chainsecurity.com/security-audit/morpho-vault-v2","name":"chainsecurity.com","type":"other","archive_url":"http://web.archive.org/web/20260508084910/https://www.chainsecurity.com/security-audit/morpho-vault-v2","credibility":3,"archive_timestamp":"2026-05-08T08:49:10+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:28.563651+00:00","updated_at":"2026-08-30T05:14:05.577807+00:00"}}