Risk
Depositing into KPK USDC Prime means underwriting risks you usually can't see: how much you could lose, whether you'd get out in time, and what would cover it.
Left to right, a deeper collateral crash. Hover any point for the scenarios that drive the loss — only a smart-contract bug reaches a total loss.
Collateral & oracles
Each token you're exposed to, and the market it backs. If that market breaks, this is how much the vault loses, in dollars and as a share of the vault. Open a row for the price feed, stress curve, and supply-cap detail. Below, the oracles those prices depend on and what is at stake if one is compromised.
Driven by cbBTC $1.06m · WBTC $639,101 · rETH $426,490 · other $666,043 · −100% $15.03m modeled all-to-zero bad-debt ceiling
cbBTCMarketChainlink$5.72m34% of vault · bad debtOracle exposure $587,157$6.31m38% of vault$5.72m34% of vault$587,157separate path
cbBTC is priced via BTC / USD — market-rate feed (Chainlink).
- → USDC86% LLTV0xa6d6…182aChainlink
WBTCMarketChainlink$3.44m21% of vault · bad debtOracle exposure $348,790$3.78m23% of vault$3.44m21% of vault$348,790separate path
WBTC is priced via WBTC / BTC × BTC / USD, quoted in USDC / USD — 3-hop market-rate feeds (Chainlink).
- → USDC86% LLTV0xdddd…6b83Chainlink
rETHHybridChainlink$2.29m14% of vault · bad debtOracle exposure $358,568$2.65m16% of vault$2.29m14% of vault$358,568separate path
rETH mixes exchange-rate/NAV (rETH/ETH exchange rate adapter) with market-rate (ETH / USD, USDC / USD) — insulated from rETH/ETH exchange rate adapter market deviation, but exposed to ETH / USD, USDC / USD.
- → USDC86% LLTV0x36cb…f815Chainlink
OETHMarketChainlink$2.16m13% of vault · bad debtOracle exposure $240,138$2.4m14% of vault$2.16m13% of vault$240,138separate path
OETH is priced via ETH / USD, quoted in USDC / USD — 2-hop market-rate feeds (Chainlink).
- → USDC86% LLTV0xe8ad…edb0Chainlink
wstETHMarketChainlink$1.36m8% of vault · bad debtOracle exposure $158,927$1.51m9% of vault$1.36m8% of vault$158,927separate path
wstETH is priced via Custom price feed for wstETH / ETH, quoted in USDC / ETH — 2-hop market-rate feeds (Chainlink).
- → USDC86% LLTV0x48f7…40e2Chainlink
WETHMarketChainlink$62,1180.4% of vault · bad debtOracle exposure $6,379$68,4960.4% of vault$62,1180.4% of vault$6,379separate path
WETH is priced via ETH / USD — market-rate feed (Chainlink).
- → USDC86% LLTV0x0f94…4580Chainlink
weETHMarketChainlink / RedStone$2,193<0.1% of vault · bad debtOracle exposure $227.81$2,421<0.1% of vault$2,193<0.1% of vault$227.81separate path
weETH is priced via Redstone Price Feed — market-rate feed (RedStone).
- → USDC77% LLTV0xa3a7…8411Chainlink
- → USDC86% LLTV0x5635…6a68RedStone
+2 markets with no current position
Oracle dependencies
2 feeds · 2 control pointsUp to$1.7mdrainable if these feeds are mispriced · 10% of vault
Each price traces to a feed and the on-chain admin that can move it. Compromise either to misprice the collateral and borrow against it. Per-row amounts overlap and are not summed.
- Chainlink / RedStone·a 4/9 Safe multisigprices cbBTC, WBTC, LBTC, wstETH, WETH, weETH, tBTC, rETH, OETH0x21f7…73ca$1.7m · 10% of vaultdrainable if it is compromised
- RedStone / Chainlink·a 2/3 Safe multisigprices LBTC, weETH0x6906…4472$227.81 · <1% of vaultdrainable if it is compromised
How you could lose money
Each row is a distinct failure. Possible loss is the share of your deposit at the selected collateral drop; Worst case is the ceiling if everything goes wrong — a conditional loss if it happens, not a likelihood. Price-scaling rows move with the drop selector; the rest are fixed. Enter a deposit to see the dollar figures as your own. Open a row for conditions, mitigations, and the math.
| Full-deposit & protocol-level(2) | |||||
| 100% | $16.73m | Full deposit | Instant | ||
| 17% | $2.8m | up to $15.03m | Instant | ||
| Price-driven collateral stress(1) | |||||
| 17% | $2.8m | up to $15.03m | Instant | ||
| Oracle & liquidation failures(4) | |||||
| 17% | $2.8m | up to $15.03m | Instant | ||
| 17% | $2.8m | up to $15.03m | Instant | ||
| 3% | $426,689 | up to $2.29m | Instant | ||
| — | — | up to $1.7m | Instant | ||
| Vault role & allocator(3) | |||||
| — | — | Full deposit | 3 days | ||
| — | — | Full deposit | Instant | ||
| — | — | up to $8.36m | 3 days | ||
Who you're trusting
The people and processes that can change this protocol under you.
The roles that can actually move your deposit — the real principal-loss path.
Role timelock 3 days to exit before owner/curator actions land
Sentinels1 · 1 multisigSafety role · veto only
Safety role, not an attack role: can revoke ANY pending timelocked curator change, instantly cut caps, and pull funds from adapters back to idle. Strictly risk-reducing — a captured sentinel cannot introduce new risk.
- 5-of-8 multisig0x354c…7478
Allocators4 · 1 multisig · 3 EOAsReaches deposit · instant
Moves funds between markets the curator has ALREADY approved — instantly, with NO timelock and no exit window. Cannot reach a brand-new market, but can concentrate you into an approved-but-stressed market or order withdrawals so you hit weak liquidity first.
- single key (EOA)0x331d…1204
- single key (EOA)0xaf15…9440
- single key (EOA)0xf0cf…2a75
- 2-of-5 multisig0xf818…97be
- Certora· 15 Dec, 2025report
- Blackthorn· 4 Dec, 2025report
- Spearbit· 4 Dec, 2025report
- Blackthorn· 15 Sep, 2025report
Protocol-wide governance: bounded context, not the path to your deposit.
Every Morpho Blue market chooses an immutable oracle contract at creation; implementations can be Chainlink-like, exchange-rate, fixed-price, or custom. Failure modes: attacker-favourable price feed (covered in market-oracle-compromise) or price() revert / staleness blocking liquidations (covered in oracle-liveness-or-malfunction).
No quantified loss scenario references this dependency directly.