A five-call RPC check finds 5 unlisted Morpho vaults with no timelock and one EOA owner

The check is a walk, and several steps return a clean wrong answer. Step one is three `cast storage` reads of the EIP-1967 implementation, admin and beacon slots ^[2]. Some proxies never put the admin in storage. On Aave's pool proxies it is compiled into the bytecode as an immutable, so the route runs through ADDRESSES_PROVIDER() and that contract's owner(). Aragon apps, Lido's stETH among them, upgrade through the DAO kernel's ACL, which you reach with kernel() ^[4]. A UUPS proxy has an implementation and no admin, so the upgrade right usually sits behind owner() or an AccessControl role. An OpenZeppelin ProxyAdmin is only a hop to its own owner() ^[15].

Then classify the address. `cast code` returning 0x means an EOA, which is one private key. A Safe answers getThreshold(), an OpenZeppelin TimelockController answers getMinDelay(), and a Compound-style timelock answers delay() ^[5]. Recurse into Safe owners, because a 1-of-1 or 1-of-3 Safe lets one signature move everything ^[6]. A rate-limited public node that returns an error is easy to misread as an empty slot, so the post says to retry against a second endpoint before concluding anything ^[8].

The Morpho scan covered vaults holding at least $2M according to the Morpho API, and it ran on 2026-10-13 ^[10]. Of the 122 listed vaults, 22 had single-key control, about 18% ^[16]. The post calls that a governance-transparency point and not an emergency, and says some of those signers are probably MPC-backed ^[13]. The unlisted five are lopsided: $283M of the $305M sits in one vault, about 93%, and the other four share about $22M ^[18][19][14]. The scan covered 146 vaults, so 24 sit outside the listed group ^[17]. The post as available describes five of them.

The $1.3B in the post's opening statistic and the $1.3B in the 22 vaults are unrelated figures. The first is losses from January to August, taken from a count the post does not name ^[20]. The second is deposits ^[12].

Wasabi is the closer analogue to the unlisted five. According to CoinDesk, as cited in the post, Wasabi lost about $4.5M in April because a single deployer EOA could upgrade its contracts ^[21]. In our view the Morpho evidence supports a narrower claim than the post's framing. Single-key control behind a 3-to-7-day window is a transparency finding by the post's own judgement. Single-key control with no window is the case that matches Wasabi.

The 3-to-7-day figure describes Morpho vaults above $2M on one date ^[11]. It transfers to another protocol only if that protocol also gates its upgrade path behind a delay.