Risk
Depositing into Stake DAO frxUSD v2 means underwriting risks you usually can't see: how much you could lose, whether you'd get out in time, and what would cover it.
Left to right, a deeper collateral crash. Hover any point for the scenarios that drive the loss — only a smart-contract bug reaches a total loss.
Collateral & oracles
Each token you're exposed to, and the market it backs. If that market breaks, this is how much the vault loses, in dollars and as a share of the vault. Open a row for the price feed, stress curve, and supply-cap detail. Below, the oracles those prices depend on and what is at stake if one is compromised.
Driven by stakedao-FrxMsUSD $601,751 · stakedao-crvfrxUSD $85,468 · stakedao-frxsUSDS $76,219 · other $50,996 · −100% $3.43m modeled all-to-zero bad-debt ceiling
stakedao-FrxMsUSDHybrid$2.56m69% of vault · bad debtOracle exposure $193,052$2.75m74% of vault$2.56m69% of vault$193,052separate path
Mixes market and exchange-rate inputs — partial depeg insulation, partial market exposure.
- → frxUSD92% LLTV0x9aa3…5b52
stakedao-crvfrxUSDHybrid$329,6619% of vault · bad debtOracle exposure $2,594$332,2549% of vault$329,6619% of vault$2,594separate path
stakedao-crvfrxUSD uses a composite oracle path; verified external provider(s): no verified external provider.
- → frxUSD95% LLTV0xde00…86c2
stakedao-frxsUSDSHybrid$324,3769% of vault · bad debtOracle exposure $39,326$363,70210% of vault$324,3769% of vault$39,326separate path
Mixes market and exchange-rate inputs — partial depeg insulation, partial market exposure.
- → frxUSD92% LLTV0x9ed4…c185
stakedao-frxUsDOLAHybrid$217,0326% of vault · bad debtOracle exposure $31,905$248,9377% of vault$217,0326% of vault$31,905separate path
Mixes market and exchange-rate inputs — partial depeg insulation, partial market exposure.
- → frxUSD92% LLTV0x0c63…820c
+4 markets with no current position
Oracle dependencies
Up to$266,877drainable if these feeds are mispriced · 7% of vault
Each price traces to a feed and the on-chain admin that can move it. Compromise either to misprice the collateral and borrow against it. Per-row amounts overlap and are not summed.
- Unidentified feeds· vendor and on-chain control not resolvedprices stakedao-FrxMsUSD, stakedao-crvfrxUSD, stakedao-frxsUSDS, stakedao-frxUsDOLA$266,877 · 7% of vaultmispriceable if these feeds lie
How you could lose money
Each row is a distinct failure. Possible loss is the share of your deposit at the selected collateral drop; Worst case is the ceiling if everything goes wrong — a conditional loss if it happens, not a likelihood. Price-scaling rows move with the drop selector; the rest are fixed. Enter a deposit to see the dollar figures as your own. Open a row for conditions, mitigations, and the math.
| Full-deposit & protocol-level(2) | |||||
| 100% | $3.7m | Full deposit | Instant | ||
| 22% | $814,435 | up to $3.43m | Instant | ||
| Price-driven collateral stress(1) | |||||
| 22% | $814,435 | up to $3.43m | Instant | ||
| Oracle & liquidation failures(4) | |||||
| 22% | $814,435 | up to $3.43m | Instant | ||
| 22% | $814,435 | up to $3.43m | Instant | ||
| 2% | $85,468 | up to $329,661 | Instant | ||
| — | — | up to $266,877 | Instant | ||
| Vault role & allocator(3) | |||||
| — | — | up to $3.49m | 3 days | ||
| — | — | up to $3.49m | Instant | ||
| — | — | up to $1.85m | 3 days | ||
Who you're trusting
The people and processes that can change this protocol under you.
The roles that can actually move your deposit — the real principal-loss path.
Role timelock 3 days to exit before owner/curator actions land
Sentinels2 · 1 multisig · 1 EOASafety role · veto only
Safety role, not an attack role: can revoke ANY pending timelocked curator change, instantly cut caps, and pull funds from adapters back to idle. Strictly risk-reducing — a captured sentinel cannot introduce new risk.
- single key (EOA)0x52ea…87dc
- 3-of-5 multisig0xb055…c765
Allocators2 · 1 multisig · 1 EOAReaches deposit · instant
Moves funds between markets the curator has ALREADY approved — instantly, with NO timelock and no exit window. Cannot reach a brand-new market, but can concentrate you into an approved-but-stressed market or order withdrawals so you hit weak liquidity first.
- single key (EOA)0x52ea…87dc
- 3-of-5 multisig0xf930…3063
- Certora· 15 Dec, 2025report
- Blackthorn· 4 Dec, 2025report
- Spearbit· 4 Dec, 2025report
- Blackthorn· 15 Sep, 2025report
Protocol-wide governance: bounded context, not the path to your deposit.
Every Morpho Blue market chooses an immutable oracle contract at creation; implementations can be Chainlink-like, exchange-rate, fixed-price, or custom. Failure modes: attacker-favourable price feed (covered in market-oracle-compromise) or price() revert / staleness blocking liquidations (covered in oracle-liveness-or-malfunction).
No quantified loss scenario references this dependency directly.