Maple's buyback mandate was set by 26 wallets. One held 30%.
Every SYRUP buyback since November 2025 was authorized by a governance mandate approved by 26 wallets. One of those wallets cast 30% of all votes.
Morpho's immutability ends where your curator's flow caps begin
If you're supplying USDC to a Morpho vault, the protection you're depending on isn't the one the protocol advertises. One flow cap setting separated Gauntlet ($5.95M loss) from Steakhouse (zero) in the March 22 Resolv exploit.
The offchain dependency graph is the attack surface
On April 18, 2026, an attacker drained $292 million in rsETH from KelpDAO's LayerZero bridge in roughly 80 minutes. The contracts behaved exactly as designed throughout. OpenZeppelin's post-mortem opens with the line that should reframe the next year of cross-chain security work: zero bugs found. The
Maple made 65M for depositors in 2025. SYRUP holders received 2M.
Three layers of fee extraction sit between borrower interest and any value reaching SYRUP buyers. The 32:1 ratio between depositor yield and buybacks is the structure, not a rounding error.
The audit fix that became Euler's $197M vulnerability
Nine audits. $197M stolen in eight minutes. The function that made it possible was introduced to fix a previous audit finding and reviewed by exactly one of those nine auditors.
$6.2M Left "Safe" Morpho Vaults in 90 Minutes. Here's How.
Morpho's isolation model worked on March 22. The Public Allocator above it didn't. A hardcoded oracle and 90 minutes was all it took to drain $6.2M from 15 curator vaults.
Maple's Stress Test: 18% Is the Number
At 17.7% simultaneous borrower default, syrupUSDC NAV drops below $1.00. The integration surface in Aave and Morpho adds a cascade channel that isn't visible in Maple's own risk model.
Supply followed yield. Both went down. (Ethena stress test)
Ethena's supply collapsed from $14B to $5.92B as sUSDe yields compressed from 11% to 3.72%. This is what the economic stress test actually revealed.