# max_rate_at_target is given as apr but morpho blue uses it as apy

Metamorpho's MAX_RATE_AT_TARGET constant is an APR value but Morpho Blue compounds it as APY, causing overflow and locking all market funds.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Metamorpho
- Credited: Christoph Michel
- Disclosed: 2024-02-23
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_metamorpho_dec2023.pdf#3.1.7
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_metamorpho_dec2023%3A3.1.7
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Solidity constants library / Morpho Blue interest accrual
**Root cause:** MAX_RATE_AT_TARGET is specified as a 1e7% APR but Morpho Blue compounds interest via exp(n*x)-1, so the value must be an APY; 1e7 ether/365 days overflows exp() after ~560 seconds.
**Steps:**
1. Read ConstantsLib.sol#L9: MAX_RATE_AT_TARGET = 1e7 ether / 365 days
2. Note Morpho.sol#L477 compounds interest as exp(n*x)-1
3. Solve exp(n*x)-1 = 0.01e9 for n*x = 16.1181, so correct value is 16.1181 ether / 365 days
4. With current value, exp(1e7) yields a 4-million-digit number
5. Any IRM reaching max rate causes accrual to revert after ~560s, blocking withdraw and all accrual-dependent functions
**How found:** Code review comparing the constant's stated APR semantics against Morpho Blue's compounding exp() formula; solving exp(n*x)-1 = 0.01e9 revealed the correct APY value differs by orders of magnitude.
**Exploitation:** Not an attacker-driven exploit; any IRM using the adaptive rebasing mechanism can reach max borrow rate, after which market accrual reverts and users cannot withdraw funds.
**Insight:** When a protocol consumes a rate constant from another protocol, verify the unit semantics (APR vs APY) against the consumer's compounding formula; a value that looks like a sane cap can overflow exp() in minutes.