Audit log

Every state-changing event for LeadBlock's Morpho Blue Market: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-29 16:47:17Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,977,539

   sig

   4s8iMsYjfdDN…NUYrnKDJcopyexplorer ↗

   hash

   B8spqMZe1RoF…Y5X4aZuWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6186 B) ▸

   {"actor":"system:backfill","investigation_id":"0d100113-16a1-4e26-89b0-e41049bbd95e","kind":"publish","page_slug":"leadblocks-morpho-blue-market","published_at":"2026-05-29T16:47:16.968Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"LeadBlock's Morpho Blue Market","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/184000/european-crypto-venture-firm-leadblock-partners-hits-first-close-of-150-million-fund-exclusive","type":"other","url":""},{"credibility":3,"name":"https://leadblockpartners.com/","type":"other","url":""},{"credibility":3,"name":"https://morpho.mirror.xyz/bgUB21hQoy-w7T9je7sEpgTp4EsMMkwbO3sFJmWAwGw","type":"other","url":""},{"credibility":3,"name":"https://forum.morpho.org/t/leadblock-rwa-backed-usdc-vault/507","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/decoding-morphoblues-230k-exploit-6296565ced40","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/morphoblue-hack-analysis-638b685f8bf2/","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/morpho-protocol-market-oracle-price","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604270503","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","type":"other","url":""},{"credibility":3,"name":"https://docs.morpho.org/learn/resources/risks/","type":"other","url":""},{"credibility":3,"name":"https://docs.morpho.org/curate/tutorials-v1/bad-debt/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/MorphoLabs/status/1845746698393391167","type":"other","url":""},{"credibility":3,"name":"https://forum.morpho.org/t/retrospective-paxg-usdc-market-oracle-configuration/891","type":"other","url":""},{"credibility":3,"name":"https://morpho.org/blog/introducing-risk-warnings-transitioning-to-a-permissionless-interface/","type":"other","url":""},{"credibility":3,"name":"https://docs.morpho.org/learn/resources/risks/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://app.morpho.org/ethereum/vault/0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6/leadblock-usdc-rwa","type":"other","url":""},{"credibility":3,"name":"https://forum.morpho.org/t/leadblock-rwa-backed-usdc-vault/507","type":"other","url":""},{"credibility":3,"name":"https://blog.midas.app/midas-and-leadblock-pioneering-the-mtbill-backed-lending-market-on-morpho-blue/","type":"other","url":""},{"credibility":3,"name":"https://www.chainsecurity.com/security-audit/morpho-vault-v2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/decoding-morphoblues-230k-exploit-6296565ced40","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/morphoblue-hack-analysis-638b685f8bf2/","type":"other","url":""}]}],"sources_used":[],"summary":"LeadBlock's Morpho Blue Market refers to a permissionless lending market and associated MetaMorpho vault curated by LeadBlock Partners on the Morpho Blue protocol. On October 13, 2024, an oracle misconfiguration in the LeadBlock-curated PAXG/USDC market enabled an opportunistic user to borrow approximately $230,000 in USDC against only $350 of PAXG collateral, exploiting an overvalued asset price of $2.6 trillion per unit of gold. The incident was attributed to an incorrectly configured SCALE_FACTOR by LeadBlock's oracle provider and raised questions about the adequacy of pre-launch testing and risk curation practices.","timeline":[{"date":"2019-01-01","event":"LeadBlock Partners founded in London by former Goldman Sachs employees David Chreng-Messembourg, Baptiste Cota, and Jean-Marc Puel, focusing on digital assets and blockchain venture capital.","source":""},{"date":"2022-11-01","event":"LeadBlock Partners closes Fund II at $150 million, backed by family offices, hedge fund managers, and financial institutions.","source":""},{"date":"2024-08-01","event":"Morpho raises $50 million in a private sale round led by Ribbit Capital; LeadBlock Bitpanda Ventures participates as a backer.","source":""},{"date":"2024-01-01","event":"LeadBlock Partners establishes role as risk curator on Morpho Blue, launching its USDC RWA MetaMorpho vault (0x4cA0E178c94f039d7F202E09d8d1a655Ed3fb6b6) in collaboration with Midas, allocating against mTBILL collateral.","source":""},{"date":"2024-10-13","event":"Oracle misconfiguration in the LeadBlock-curated PAXG/USDC market on Morpho Blue is exploited. An attacker deposits $350 of PAXG and borrows approximately $230,000 USDC by exploiting an inflated oracle price of $2.6 trillion per PAXG unit caused by a 12-decimal SCALE_FACTOR error. Attacker address: 0x02DBE46169fDf6555F2A125eEe3dce49703b13f5.","source":""},{"date":"2024-10-15","event":"LeadBlock publishes a retrospective on the Morpho governance forum acknowledging the oracle misconfiguration, stating the error was introduced by an oracle provider, claiming all borrowed funds were repaid, and disclosing new internal testing processes for future market creation.","source":""},{"date":"2024-10-18","event":"Multiple DeFi security firms — including QuillAudits, SolidityScan, and Verichains — publish technical post-mortems on the exploit, detailing on-chain transactions and the decimal mismatch root cause.","source":""},{"date":"2024-10-14","event":"Morpho Labs posts on X (formerly Twitter) distinguishing the risk curation failure from any underlying protocol vulnerability; Morpho subsequently introduces opt-in risk warnings on its interface for flagged markets.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0116a122-bfab-42b3-9df0-21e8a64cbf6acopy
2. #2reviewby reviewerreviewer

   2026-06-03 01:32:44Z
   Score: 48 → 48 (no score change)
   The core facts of the October 13, 2024 oracle misconfiguration exploit — amounts, attacker address, SCALE_FACTOR root cause, and Morpho's response — are well-supported by multiple independent sources. The most significant accuracy issues are: (1) the page presents LeadBlock's contested repayment claim as uncontested fact despite community-level on-chain dispute evidence; (2) the risk warnings introduction is framed as a post-incident response when it preceded the incident by five months; and (3) the post-mortem publication date claim for QuillAudits and SolidityScan is inaccurate — only Verichains published on October 18. No claims were found to directly contradict a more credible primary source, but several involve material omissions or mischaracterizations that affect the page's narrative.
   anchoranchored

   chain

   ●mainnet-betaslot 423,927,827

   sig

   4LexqnDqpMCY…QqhjRBpPcopyexplorer ↗

   hash

   DaQicAwCzSEa…zYrnYZGkcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1167 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-03T01:32:44.689Z","decision":"review","investigation_id":"0d100113-16a1-4e26-89b0-e41049bbd95e","new_score":48,"page_slug":"leadblocks-morpho-blue-market","prev_score":48,"reason":"The core facts of the October 13, 2024 oracle misconfiguration exploit — amounts, attacker address, SCALE_FACTOR root cause, and Morpho's response — are well-supported by multiple independent sources. The most significant accuracy issues are: (1) the page presents LeadBlock's contested repayment claim as uncontested fact despite community-level on-chain dispute evidence; (2) the risk warnings introduction is framed as a post-incident response when it preceded the incident by five months; and (3) the post-mortem publication date claim for QuillAudits and SolidityScan is inaccurate — only Verichains published on October 18. No claims were found to directly contradict a more credible primary source, but several involve material omissions or mischaracterizations that affect the page's narrative.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8eb2a491-e15a-43d5-8d23-75ea87904d48copy
3. #3review reviseby judgejudge

   2026-06-03 01:32:44Z
   Score: 48 → 38 (-10)
   The core facts of the October 13, 2024 oracle exploit — amounts, attacker address, root cause — are well-supported, and no claim was found to directly contradict a higher-tier source. However, three narrative-level mischaracterizations require correction: claim_findings[7] presents LeadBlock's claim of full repayment as an uncontested fact when community member PGov raised on-chain transaction evidence on the same forum thread showing approximately $113,000 in residual outstanding debt; claim_findings[9] frames Morpho's risk warnings system as a post-incident response when the referenced blog post was published May 2, 2024 — five months before the exploit; and claim_findings[8] incorrectly attributes the same publication date (October 18) to three post-mortems when QuillAudits and SolidityScan published in November 2024. Two high-priority coverage gaps — the repayment dispute and absence of on-chain transaction citations — further support revision rather than approval.
   anchoranchored

   chain

   ●mainnet-betaslot 423,927,830

   sig

   66UYK6tM5Kmu…Gh8zD8D7copyexplorer ↗

   hash

   ECrkQrz1GF7k…WuwfFw22copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1354 B) ▸

   {"actor":"judge","decided_at":"2026-06-03T01:32:44.689Z","decision":"review_revise","investigation_id":"0d100113-16a1-4e26-89b0-e41049bbd95e","new_score":38,"page_slug":"leadblocks-morpho-blue-market","prev_score":48,"reason":"The core facts of the October 13, 2024 oracle exploit — amounts, attacker address, root cause — are well-supported, and no claim was found to directly contradict a higher-tier source. However, three narrative-level mischaracterizations require correction: claim_findings[7] presents LeadBlock's claim of full repayment as an uncontested fact when community member PGov raised on-chain transaction evidence on the same forum thread showing approximately $113,000 in residual outstanding debt; claim_findings[9] frames Morpho's risk warnings system as a post-incident response when the referenced blog post was published May 2, 2024 — five months before the exploit; and claim_findings[8] incorrectly attributes the same publication date (October 18) to three post-mortems when QuillAudits and SolidityScan published in November 2024. Two high-priority coverage gaps — the repayment dispute and absence of on-chain transaction citations — further support revision rather than approval.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 845a0956-2b28-42fe-83e0-0a8db0a20fbfcopy