TL;DR
- What it is: ERC-4626 Morpho Vault V2 (
0x7cBc…6B57) curated by Sentora, lending PYUSD into a single Morpho Blue market against mWIN — Midas’s tokenized Wellington credit portfolio — $21.2M TVL, 15% performance fee, live since 2026-07-31. - Yield source: borrower interest only — ~0.70% enters NAV; the ~8% headline adds ~7.3pp of off-NAV Merkl rewards escrowed one week at a time.
- Biggest risk: liquidations can’t clear — mWIN is transfer-gated to 85 greenlisted wallets, 90.5% of its supply sits in Morpho, and its price is a Midas-posted daily NAV (Risk R1).
- For detail: The Defiant and CryptoBriefing cover launch terms; no third-party rating of the vault or of mWIN exists — control-plane findings re-verified from
morpho-paypal-usd-main.
How it works
PYUSD deposits mint senPYUSDmWIN. The vault supplies a single immutable Morpho Blue market via one adapter — mWIN collateral, PYUSD loan, 77% LLTV, $25M cap. Allocation (2026-08-14, block 25,752,875): market $17.52M (82.6%), idle $3.68M (17.4%), utilisation 50.7%, five borrowers. Labelled an mWIN product, the position is a credit line to five wallets secured by one permissioned RWA token: mWIN (launched 2026-08-05) wraps a Wellington-managed active credit book (CLOs, MBS, ABS, IG corporates; ~5% target) in a Luxembourg securitization compartment, Northern Trust custodian (The Defiant, 2026-08-06).
Oracle setup. The vault only lends; it is never liquidated — NAV absorbs bad debt. Collateral is priced as mWIN/USD ÷ PYUSD/USD: the mWIN leg is a Midas push feed (0x1725…9517, $130,504.26, at round 24 of its lifetime) posted ~daily by one bare EOA, and the oracle contract has no staleness check — a silent feed prices liquidations at the last NAV forever. The PYUSD leg is Chainlink, 24h heartbeat (observed 24.0h round spacing).
Yield. Borrower interest is the only leg entering NAV: ~0.70% net of utilisation, idle drag and the 15% fee (IRM read, 2026-08-14; Merkl: 0.69%). ~91% of the ~8.0% headline is off-NAV Merkl PYUSD (7.3pp), escrowed 7 days at a time. Size on the 0.70%. Two weeks old, no crisis history: capital renting a 91%-subsidy yield leaves with it.
Risks
Verified on-chain (2026-08-14, block 25,752,875): vault name/asset/fees, the single market id + params + caps from adapter reads and IncreaseAbsoluteCap history, positions and LTV per borrower, both oracle legs + full mWIN feed round history, selector timelocks + gate abdications, sentinel/allocator sets, owner/curator getOwners/getThreshold + codesize per signer, byte-diff of runtime vs the PYUSD Main vault (identical), simulated withdraw to the exact idle cap, mWIN transfer sims proving the greenlist (role M_WIN_GREENLISTED_ROLE, 85 members enumerated), mWIN supply vs Morpho balance, Midas proxy-admin/timelock/role-holder chain, share-holder ledger from full Transfer history, Merkl campaign escrow + funder balances. Taken on trust: Wellington’s portfolio composition and NAV correctness, Northern Trust custody, the Luxembourg structure, Midas redemption mechanics (docs), audit scope of Vault V2 (runtime identity with the audited PYUSD vault proved by byte-diff), Merkl distribution correctness.
| ID | Risk | Mechanism | Source + our delta |
|---|---|---|---|
| R1 | Liquidations can’t clear: permissioned collateral on an issuer-posted price | Only 85 greenlisted wallets can receive mWIN; 90.5% of supply sits in Morpho, so a liquidator’s sole exit is Midas redemption — 1–7 business days, pausable. Price is Midas’s own NAV. Exit: NAV −2%, feed silent >3d, or a pause event. | Transfer sims + role enumeration, supply reads; Midas docs Standard-Mode queue + pause rights. NOCA-original — no third-party coverage. The feed re-based ×130,000 to a per-token basis on 2026-07-29 and is itself an upgradeable proxy (one upgrade already). Sentora’s CEO concedes tail returns “could turn negative” (The Defiant). Worse than kBTC in our sibling evals: that wrapper was oracle-blind but freely tradable; this collateral is oracle-captive and transfer-gated. |
| R2 | ~91% of the yield is a 7-day subsidy with near-zero standing budget | 7.3 of 8.0pp is off-NAV Merkl PYUSD. The campaign Safe holds ~$0 — each week is topped up just-in-time; visible upstream runway $4.54M ≈ 12 weeks of all-Sentora spend. Current escrow ends 2026-08-20. Exit: two weeks without a campaign. | Merkl API + funding-chain trace, 2026-08-14: Safe 1/1 (owner EOA 0xfc05…5e87), topped up by two EOAs (~$367k/wk observed spend); address-poisoning mimics already target the chain. Press credits PayPal incentives; on-chain it is an unattributed weekly promise. Same funder family as the PYUSD Main vault. |
| R3 | Single-key curator/owner; the only sentinel is the curator itself | Owner and curator are 1-of-1 Safes over bare EOAs — the same keys as our PYUSD/RLUSD evals. Fee setters, setCurator, setIsSentinel: 0 timelock (caps 50%/5%). The only sentinel is the curator’s own Safe. Exit: any fee raise or unexpected Accept. | getOwners/codesize/timelock reads, 2026-08-14. Siblings run three sentinels (all operator keys); this vault runs one. The identical control plane fired on PYUSD 2026-07-13 (kBTC cap raise); here the market cap went $10M→$25M through the 3-day timelock, executed 2026-08-11. Holding this beside either sibling concentrates the same key family across our Sentora book. |
| R4 | Five borrowers; top one is 47% of the book; thinnest margin 2.4pp from liquidation | Top borrower owes $4.20M (47.3%) at 70.5% LTV; another sits at 74.6% vs the 77% LLTV — a ~3% NAV gap liquidates into Risk R1’s pipeline. One borrower is also a 4.7% depositor. Exit: borrower >80% LTV or top share >60%. | Per-borrower position() reads, 2026-08-14; NOCA-original. Sentora’s operator key 0x13DE…90e1 is greenlisted and holds a $3.60 test borrow — the curator operates both sides of the market. Active credit books move slowly until they gap (COVID-2020 spread widening ≈ −5–10% marks); the LLTV leaves no room for one. |
| R5 | mWIN’s admin plane is single Midas EOAs | A bare EOA holds Midas DEFAULT_ADMIN: it grants the NAV-poster role, mWIN pause, or greenlist entries instantly. Upgrades (token and feed are proxies) sit behind a 48h timelock run by a 1-of-3 Safe. Exit: unexpected RoleGranted, feed-admin change, or pause. | RoleGranted history + hasRole reads, 2026-08-14: 0xd419…1227 (codesize 0) granted the current poster’s role and all 85 greenlist entries. A hostile poster = arbitrary collateral price = drain the lendable PYUSD. No third-party review of Midas key management exists; its transparency page covers reserves, not keys. |
| R6 | Exit is idle-bounded and the venue is two weeks old | A single at-NAV withdraw caps at the $3.68M idle (simulated); the next $8.63M unborrowed needs forceDeallocate — penalty 0% today, raisable to 2% (3d notice). Top holder = 57.7%, 3.3× idle. Exit: idle + unborrowed <15% of TVL, or the top holder exits. | Simulated withdraws to the wei + holder ledger from full Transfer history (21 holders; top-2 67.6%), 2026-08-14. The top holder is an opaque smart-account stack (owner()-chained contracts, ultimate signer unverified). No retention history to read; April-2026 sibling runs cleared at NAV but had 8 markets and deeper buffers. |
Key-compromise threshold
Morpho Blue’s core is immutable; setReceiveAssetsGate, setReceiveSharesGate, setSendSharesGate and setAdapterRegistry read abdicated() = true (the live setSendAssetsGate, 0 timelock, covers deposits only per source). Verified today: owner 0xe8C9…8008 = 1/1 Safe over EOA 0x295D…d7E9, curator 0x9e39…aac0 = 1/1 Safe over EOA 0x9925…0ABE, both signers codesize 0 — the same keys as both sibling Sentora vaults. Allocators: the curator Safe + bare EOA 0xC4Ba…79D3. Sole sentinel: the curator Safe.
- Funds (theft / principal loss): 1 curator key + 3-day timelock, zero independent veto —
submita cap raise or new adapter (3d), then allocate; the only sentinel that could revoke is the curator itself. Or 1 owner key (instantsetCurator, only the 3d clock remains). At the collateral layer, 1 Midas EOA, instant: the bare-EOADEFAULT_ADMIN(a 1-of-3 Safe holds the role too) grants itself the mWIN feed-poster role, posts an inflated NAV, and a greenlisted borrower drains the lendable PYUSD. - Liveness / economic: 1 key, instant — owner or curator sets fees to 50%/5% caps (0 timelock); 1 Midas pause-operator key (two exist, both EOAs) pauses mWIN transfers, freezing liquidations and collateral flows (vault
redeemof idle PYUSD keeps working). - Single point of failure: yes, both tiers — one Sentora key seizes yield instantly; one Midas EOA controls the price every liquidation engine in this vault relies on.
Liquidity & exit
Primary path is ERC-4626 redeem at NAV. totalAssets() = 21,196,936 PYUSD, idle PYUSD.balanceOf(vault) = 3,679,838 (2026-08-14, block 25,752,875). Same-day at-NAV capacity is the idle alone — simulation clears a withdraw of exactly 3,679,838.975957 and reverts above; maxWithdraw() reads 0 (no liquidity adapter). A further market.totalSupply − totalBorrow = 8,629,747 unborrowed is reachable via permissionless forceDeallocate at 0% penalty today ($12.31M, 58.1% all-in); the remaining ~42% needs repayment from five borrowers. No secondary market for senPYUSDmWIN. PYUSD exit routes per morpho-paypal-usd-main: no Sky backstop, par access via PYUSD/USDC depth.
Defensible size at current liquidity (post-haircut): $2M — 16% of the $12.31M all-in depth and 54% of the at-NAV idle; under a 3× haircut the at-NAV leg falls to ~$1.2M and forceDeallocate (up to $40k per $2M at the 2% penalty cap) covers the rest. Discounted hard for a two-week-old venue (provisional per rubric.md time decay), a 91%-subsidized yield on 7-day tenor, one permissioned-collateral market, and a 57.7% top holder. Stress (“NOCA exits 50% in 7d while peers redeem”): $1M against ~$4.1M post-haircut clears unless mWIN is paused or the top holder front-runs — then exit waits on borrower repayment. Halve if not refreshed by 2026-11-14.
External reviews
No independent rating of this vault, of mWIN, or of Midas’s control plane exists (checked 2026-08-14: LlamaRisk, Chaos Labs, Bluechip, DeFiScan — none). Coverage is launch press and issuer documentation:
- The Defiant — Sentora opens a lending vault against Wellington’s first native onchain credit strategy · 2026-08-06 · accessed 2026-08-14 — launch terms, strategy composition, CEO risk caveats.
- CryptoBriefing — Sentora opens Morpho lending vault with mWIN · 2026-08-06 · accessed 2026-08-14 — issuance date, Luxembourg vehicle, Northern Trust custody.
- Midas Docs — Issuance & Redemption · accessed 2026-08-14 — instant vs 1–7-business-day standard redemption; pause rights. Risk disclaimer likewise.
- Midas — transparency page · accessed 2026-08-14 — reserve reporting; does not cover key management.
- Morpho — protocol & Vault V2 audits · accessed 2026-08-14 — this vault’s runtime is byte-identical to our audited-lineage PYUSD Main vault (0 differing bytes), verified on-chain 2026-08-14.
- Merkl — reward campaigns on this vault · 2026-08-14.
- Control plane + PYUSD asset layer:
morpho-paypal-usd-main· internal · same-curator RLUSD book:morpho-sentora-rlusd-main· internal.