Morpho Vault Re-Ratings Under the Updated Framework

On March 22, 2026, the Resolv USR exploit exposed gaps in our rating framework - gaps we documented in our Framework Update article and closed with three targeted changes to v0.1-beta. With the updated framework in hand, we re-rated all eight Morpho vaults. Here's what changed.

Summary of Changes

Six out of eight vaults dropped. The Frontier V1 vault - the only one with direct Resolv exposure - fell the hardest, dropping three grade notches from BB- to CCC+. Even vaults with no direct Resolv exposure saw one-notch downgrades from the framework's new structural requirements.

What Changed for Every Vault

Three framework changes affected all Morpho vaults equally:

1. Monitoring Verification Principle

The old framework gave credit for naming a monitoring provider. The updated framework requires demonstrated automated protective actions - claiming to use Hypernative or Chainalysis isn't enough if monitoring can't trigger a halt when it matters. All Morpho vaults were downgraded on this question because none have monitoring connected to automated on-chain protections.

The one exception is Smokehouse USDC, which initially retained its score based on demonstrated rapid response times (4-minute rollback in April 2025). This was later aligned downward for platform consistency, since the underlying Morpho architecture still lacks automated protection capabilities regardless of curator response speed.

2. New Question: Automated Exposure Increase

This question didn't exist before. It was added specifically because the Resolv exploit showed that permissionless functions (like Morpho's Public Allocator) can increase vault exposure without human approval. Most vaults scored Mid Risk (caps exist but no automatic kill-switch). The Frontier V1 vault scored High Risk because the Public Allocator's supplyOnBehalf function was exploited to inject capital into compromised markets.

3. Circuit Breaker Scope Expansion

The updated framework requires circuit breakers to cover all automated capital flows, not just protocol-level pause mechanisms. Morpho Blue is immutable by design and has no automatic circuit breakers. Vaults with manual Sentinel roles or Guardian veto scored Mid Risk; those without any mechanism scored High Risk.

These three changes alone account for the one-notch downgrades seen across vaults that had no other issues.

Additional Changes by Vault Type

Steakhouse Vaults (USDC, USDT, ETH)

The three Steakhouse vaults were the least affected beyond the common changes. No vault-specific scoring changes were needed - these vaults had no Resolv exposure, no exotic collateral failures, and a clean operational track record. Steakhouse USDT and ETH held their BB+ grades; Steakhouse USDC dropped one notch from BBB- to BB+.

The re-rating also updated two question texts (on oracle correction capability and protocol mechanics scope) to match the expanded v0.1-beta wording. Neither text change affected scores.

Smokehouse USDC

Same pattern as the Steakhouse vaults - common framework changes only, dropping one notch from BB to BB-. The gap between Smokehouse and Steakhouse USDC remains entirely in Strategy, reflecting Smokehouse's exotic collateral exposure (sUSDe, syrupUSDC, mF-ONE, Pendle PT tokens). This gap predated the framework update and was unaffected by it.

Gauntlet USDC Prime

Gauntlet Prime was completely unaffected by the Resolv exploit itself - its blue-chip-only collateral mandate (wstETH, cbBTC, WBTC) prevented any USR exposure. But the framework update still hit it harder than the Steakhouse vaults (BBB- to BB+, same as Steakhouse USDC on the surface, but with additional question-level downgrades) because of ripple effects from Gauntlet's involvement with the Frontier vault:

• Historical Losses: The Frontier vault is a "comparable variant" managed by the same curator. Under the updated framework's guidance on comparable variant losses, the Frontier's confirmed bad debt counts against Prime.
• Incident Response: Gauntlet's incident response during the Resolv exploit did not include halting the automated allocation mechanism. The updated framework requires incident response procedures to cover automated systems.
• Manager Loss History: Gauntlet now has confirmed uncompensated depositor losses on its record via the Frontier vault.

VaultBridge WBTC

VaultBridge WBTC followed the same pattern as Gauntlet Prime - common framework changes plus the same Gauntlet-specific ripple effects. It dropped one notch from B+ to B. VaultBridge remains the lowest-scoring non-Frontier Morpho vault due to its heavy WBTC custody risk and 100% wrapped asset concentration, which predated the framework update.

Gauntlet USDC Frontier V2

Frontier V2 is a new vault deployed after the Resolv exploit, designed to address V1's failures. It dropped one notch from B+ to B, with additional downgrades beyond the common changes:

• Oracle Redundancy: V2 still uses immutable oracles for exotic collateral that has demonstrated depeg capability. The updated framework's mandatory hardcoded oracle pre-check makes this an automatic High Risk.
• Historical Losses: Upgraded from Mid to High Risk because the Resolv comparable variant loss exceeded the framework's severity threshold.

V2 also inherits the Gauntlet-specific incident response and manager loss history penalties. Despite this, V2 grades significantly above V1 (B vs CCC+), reflecting its improved architecture: adapter-based allocation with caps, no permissionless supplyOnBehalf, and clean exploit history on the vault itself.

Gauntlet USDC Frontier (V1) - The Outlier

Frontier V1 was the only vault directly impacted by the Resolv exploit. Its three-notch drop from BB- to CCC+ dwarfs every other re-rating because the exploit didn't just trigger framework penalties - it created new facts on the ground:

• Confirmed bad debt from wstUSR collateral that collapsed 94%
• ~$1.9M stuck in markets at 100% utilization
• 88% TVL decline ($115M to $12.7M) as depositors fled
• Active bank run at the time of re-rating

Strategy was the hardest-hit category, with 14 of 32 strategy questions now scoring High Risk. Security also dropped below all other Morpho vaults because the exploit history question was downgraded pending compensation verification. Operations fell as Gauntlet's first confirmed bad debt was recorded.

Validation Results

Every re-rated vault was run through our automated validator. Key findings:

• All eight vaults passed validation (some with auto-fixes or warnings)
• Platform consistency verified: All vaults share the same Security grade after re-rating (except Frontier V1, which dropped lower due to its vault-specific exploit history)
• Auto-fixes applied: Minor category grade corrections in summary files and stale comparison observations
• Open items flagged: Multisig signer identity disclosure is borderline across all vaults - one signer publicly named, but the framework's threshold for "fully unknown" is not clearly met. Flagged for monitoring but no score change applied, to maintain cross-vault consistency

What This Means

The v0.1-beta framework changes were targeted: three new or updated questions, each motivated by a specific failure mode exposed by the Resolv exploit. The impact was proportional to exposure:

• No Resolv exposure (Steakhouse, Smokehouse): One-notch drop from structural requirements alone
• Same curator, no direct exposure (Gauntlet Prime, VaultBridge WBTC): One-notch drop plus additional question-level downgrades from curator reputation effects
• New vault, same curator (Frontier V2): One-notch drop from structural plus inherited risk signals
• Direct exposure (Frontier V1): Three-notch drop from structural, curator, and incident-specific effects

No vault was upgraded. The framework got stricter, and every vault's grade reflected that.

Individual Vault Updates

Morpho Steakhouse USDC — BBB- → BB+

• No Resolv exposure and a clean operational record kept vault-specific scores intact.
• Downgraded solely on the three structural framework changes: monitoring verification, automated exposure controls, and circuit breaker scope.
• Remains the highest-scoring Morpho vault, reflecting Steakhouse's conservative blue-chip collateral mandate.

Morpho Gauntlet USDC Prime — BBB- → BB+

• Blue-chip-only collateral (wstETH, cbBTC, WBTC) prevented any direct Resolv exposure.
• Hit harder than Steakhouse because Gauntlet's Frontier vault losses count as comparable variant bad debt under the updated framework.
• Incident response and manager loss history penalties also applied due to Gauntlet's handling of the Frontier exploit.

Morpho Steakhouse USDT — BB+ → BB+

• Held its grade despite the structural tightening — the cleanest re-rating of the batch.
• All three common framework changes applied, but the vault's existing score cushion absorbed the impact.
• No vault-specific scoring changes were needed; no exotic collateral, no exploit history, no curator penalties.

Morpho Steakhouse ETH — BB+ → BB+

• Same outcome as USDT — framework got stricter, but nothing vault-specific moved the needle.
• The ETH vault benefits from deep on-chain liquidity and straightforward collateral composition.
• Two question texts were updated to match expanded v0.1-beta wording, but neither text change affected scores.

Morpho Smokehouse USDC — BB → BB-

• Dropped one notch from the common framework changes, same as the Steakhouse vaults.
• The gap between Smokehouse and Steakhouse remains entirely in Strategy, reflecting exotic collateral exposure: sUSDe, syrupUSDC, mF-ONE, and Pendle PT tokens.
• That Strategy gap predated the framework update and was unaffected by it — Smokehouse just started from a lower baseline.

Morpho Gauntlet USDC Frontier V2 — B+ → B

• Deployed after the Resolv exploit with improved architecture: adapter-based allocation, caps, no permissionless supplyOnBehalf.
• Still hit by immutable oracles on depeg-prone collateral, which triggers automatic High Risk under the new mandatory oracle pre-check.
• Inherits Gauntlet's curator penalties (incident response, manager loss history) plus comparable variant loss from V1.

Morpho VaultBridge WBTC — B+ → B

• Common framework changes plus the same Gauntlet curator ripple effects as Prime and Frontier V2.
• Remains the lowest-scoring non-Frontier vault due to 100% wrapped-asset concentration and heavy WBTC custody risk.
• These structural weaknesses predated the framework update — the re-rating just added new penalties on top.

Morpho Gauntlet USDC Frontier (V1) — BB- → CCC+

• The only vault directly hit by the Resolv exploit — confirmed bad debt from wstUSR collateral that collapsed 94%.
• Three-notch drop driven by ~$1.9M stuck in markets at 100% utilization, 88% TVL decline, and an active bank run at the time of re-rating.
• Strategy was hardest hit with 14 of 32 questions now scoring High Risk; Security also dropped as exploit history was downgraded pending compensation verification.

Full ratings, validation results, and the updated framework are available in the Staking Rewards DeFi Rating Framework.