Morpho Builder

Morpho Vaults v2 — the newer vault contract. ERC-4626 compliant. Allocates deposits across multiple markets via adapters, which can wrap MetaMorpho (v1) vaults and Morpho Blue markets. Preferred for new vault deployments. In the SDK: vaultV2Abi, VaultV2, fetchVaultV2.

MetaMorpho (vault v1) — the original vault contract. Still functional and widely deployed on-chain. In the SDK: metaMorphoAbi, Vault, fetchVault. The two vault versions have incompatible ABIs — use the correct one for the contract you're interacting with.

Singleton contract: 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb — same address on Ethereum (chain 1) and Base (chain 8453) via CREATE2.

Key Entities

Key Quantities

SDK Registry

All packages are published under @morpho-org on npm.

SDK Details

@morpho-org/blue-sdk

Types, entity classes, and constants.

• Market — class with operation methods (.supply(), .borrow(), .repay(), .withdraw()) and conversion methods (.toSupplyAssets(), .toBorrowAssets())
• MarketParams — new MarketParams({ loanToken, collateralToken, oracle, irm, lltv })
• MarketId — branded type identifying a market
• Position — new Position({ supplyShares, borrowShares, collateral })
• VaultV2 — vault v2 entity class (preferred for new integrations)
• Vault — MetaMorpho (vault v1) entity class
• VaultConfig — configuration class for MetaMorpho vaults

@morpho-org/blue-sdk-viem

ABIs, fetch helpers, and viem augmentation.

ABI catalog — import these instead of hand-rolling ABI JSON:

Fetch helpers — fetchMarket, fetchVaultV2 (v2) / fetchVault (v1), fetchPosition read on-chain state into SDK entity objects. Use the fetch helper matching the on-chain vault version. Entity methods include market.toSupplyAssets(), vault.toShares(), etc.

@morpho-org/blue-sdk-wagmi

React hooks wrapping the core SDK. Requires wagmi v2.

Hooks: useMarket, useVault, usePosition, useToken, useHolding, useMarkets, useVaults, usePositions, useTokens, useHoldings, useVaultMarketConfig, useVaultMarketConfigs, useVaultUser, useVaultUsers, useMarketParams, plus plural variants.

@morpho-org/simulation-sdk + @morpho-org/simulation-sdk-wagmi

Client-side simulation of Morpho operations. useSimulationState hook provides simulated post-state for UI previews without submitting transactions.

GraphQL API

Endpoint: https://api.morpho.org/graphql

Key queries: vaults (fields: address, name, symbol, asset, state.netApy, state.totalAssets) and markets (fields: uniqueKey, loanAsset, collateralAsset, state.supplyApy, state.borrowApy, state.utilization, lltv).

Filters and Pagination

Paginate with first and skip. Iterate until items.length < first.

Value Interpretation

Integration Approaches

• Direct SDK (viem) — for backends, scripts, bots. Use createPublicClient + readContract/encodeFunctionData with ABIs from @morpho-org/blue-sdk-viem.
• React (wagmi + SDK hooks) — for frontend apps. Use useVault, usePosition, etc. from @morpho-org/blue-sdk-wagmi with useSendTransaction from wagmi.

Protocol Mechanics

Dead Deposits (Inflation Attack Protection)

Detailed reference

ERC-4626 vaults are vulnerable to share-price inflation attacks on their first deposit. A dead deposit — minting shares to the burn address 0x000000000000000000000000000000000000dEaD — must be the very first transaction on any new vault or market. Any user deposit before this enables the attack.

Vault V2 — target shares depend on the asset's decimals:

Formula: targetShares = max(1e9, 10^(6 + max(0, 18 - decimals))) — 18-dec assets: 1e9, 8-dec: 1e16, 6-dec: 1e18. Call vault.mint(TARGET_SHARES, 0xdead).

Market V1 — fixed 1e9 shares regardless of decimals. Call morpho.supply(marketParams, 0, 1e9, 0xdead, "").

Vault V1 — 1e9 shares standard; use 1e12 for tokens with fewer than 9 decimals.

Active-cap requirement: When a Vault V2 references underlying markets/vaults, 0xdead must also hold:

• 1e9 supplyShares in each Market V1 with non-zero vault caps
• 1e9 shares in each Vault V1 with non-zero caps or present in withdraw queues

AdaptiveCurveIRM

Detailed reference

Morpho's approved IRM uses a two-pronged mechanism:

1. Curve — instantly adjusts rates when utilization changes (e.g., 90% ↔ 0% scales rate ×4 or ÷4)
2. Adaptive — continuously shifts the target rate over time based on sustained utilization

Operational warnings: Avoid 100% utilization — rates compound aggressively. Seed markets with initial supply immediately after creation; an empty market at 0% utilization triggers automatic rate decay.

Slippage and Share/Asset Conversion

Detailed reference

The exchange rate between assets and shares can shift between transaction preparation and on-chain execution. With a proper dead deposit this is a UX concern, not a security vulnerability, but integrations should still protect users.

Defensive pattern: Use previewDeposit() to estimate shares, apply a 1% tolerance floor, verify actual result meets minimum.

Full withdrawals: Use redeem(), not withdraw() — avoids leaving dust behind.

Vault V2 quirk: maxDeposit, maxMint, maxWithdraw, and maxRedeem always return zero. Do not rely on these for capacity checks.

Bad Debt Tracking

Detailed reference

• V1.0: Realized immediately — share price drops atomically for all suppliers in the affected market. Vulnerable to flash-loan amplification of bad debt realization.
• V1.1+: Tracked via lostAssets field — share price is unaffected until explicit realization. Prevents flash-loan manipulation.

Common Pitfalls

Detailed reference

Safety Notes

Addresses: Discover via GraphQL API or SDK fetch helpers. Present candidates to the user for confirmation before use. Never hardcode vault, market, or token addresses.

Chain: Always parameterize — accept chain as a function parameter. Never assume Ethereum or Base. Morpho is deployed on both chains at the same singleton address.

Write flow: All write operations follow: query → prepare → simulate → confirm → execute. Simulate transactions before execution to catch reverts early. The server returns unsigned transactions — your app handles signing.

Token decimals: USDC/USDT = 6, WETH/DAI = 18. Read decimals from the API or contract — never assume 18. Use parseUnits(amount, decimals) for conversion.

USDT approval quirk: Must reset allowance to 0 before setting a new value. Implement as a conditional check for USDT or as a general reset-before-set pattern.

DAI permit: Non-standard — use ERC-20 approve() instead of EIP-2612 permit.

Health factor: For borrow operations, validate the health factor after the intended borrow. Prevent proceeding if the position would become unsafe (health factor < 1.0). Warn at ~1.1.

Dead deposits: Any vault or market creation must include the dead deposit as the first transaction. See Protocol Mechanics > Dead Deposits above.

Testing

Detailed reference

• @morpho-org/test — Vitest/Anvil fixtures for Morpho-specific test setup.
• See the testing guide for a full catalog of test cases covering vaults, markets, input validation, health factors, token approvals, signature security, and bad debt. Implementations should include these checks in their test suites.

Best Practices

Prefer vault v2 for new deployments: When creating new vaults, prefer vault v2 over MetaMorpho (v1). When interacting with existing vaults, match the ABI to the on-chain contract — vaultV2Abi for v2, metaMorphoAbi for v1. They are not interchangeable.

Prefer Morpho Blue over Morpho Optimizer: The original Morpho Optimizer (Morpho-Aave, Morpho-Compound) is deprecated. Prefer Morpho Blue contracts and SDKs for new integrations.

No Bundler3: Deprecated. Do not reference in new code.

ABIs: Always import from @morpho-org/blue-sdk-viem. Never hand-roll ABI JSON.

Post-Implementation Review

After finishing code or a plan, review it against these Morpho-specific checks before presenting the result. For each, mark CRITICAL (fund loss), WARNING (broken UX), or N/A.

1. Dead Deposit Protection — vault/market creation includes dead deposit to 0xdead as the first tx; correct formula per version (reference)
2. Slippage Protection — deposits/withdrawals use preview functions + tolerance check; full exits use redeem() not withdraw(); no reliance on Vault V2 max* functions (reference)
3. IRM Awareness — new markets seeded promptly; no sustained 100% utilization; APY formulas correct (reference)
4. Bad Debt Safety — no V1.0 vault as collateral; no ERC4626 vault as loan asset; dashboards surface lostAssets (reference)
5. Token Approvals — USDT resets allowance to 0 first; DAI uses approve() not permit() (reference)
6. Vault Governance — UI surfaces role holders; trust assumptions documented (reference)
7. General Safety — no hardcoded addresses; chain ID parameterized; decimals read not assumed; write ops simulate before execute; health factor validated; ABIs from @morpho-org/blue-sdk-viem
8. Test Coverage — implementation includes tests for relevant cases from the testing guide; edge cases (dead deposits, USDT approvals, health factor boundaries, full withdrawals via redeem()) are covered