Before a DeFi vault runs into trouble, there are usually several quantifiable early on-chain signals. The key is that most signals can be observed before losses happen, not explained after the fact.
Here are 5 on-chain warning signals you can check in advance, along with specific ways to find them.
Signal 1: Share Price Moves at an Unusual Speed
Normal yield vaults have a gradual price change (e.g., a 15% APY translates to about 0.04% daily movement). If the share price drops more than 1% or jumps more than 2% in a short period, it's likely an attack or a structural issue.
To monitor the speed of share price changes: query the sharePrice field via the Morpho GraphQL API, or use vaults.fyi's MCP tool to read price history in vault_details. If the price at any checkpoint drops more than 1% or jumps more than 2%, trigger an alert.
Signal 2: A Single Wallet Redeems Over 1% of TVL or $500K in One Day
Large, concentrated redemptions are a direct sign of shaken depositor confidence, often appearing before price declines.
Track large redemption events: use Dune or Etherscan to query the vault's Withdraw events over the last 24 hours, sum up amounts by address. If you find a single redemption exceeding $500,000 or 1% of TVL, consider it a warning signal.
Signal 3: Vault's Performance Fee Share Rises Sharply, Reducing Depositors' Cut
Curators take a cut from total interest via a performance fee. When this rate is raised, the net APY shown on the interface doesn't change immediately (because fees accrue continuously), but the actual share of earnings going to depositors is already shrinking. Some vaults have seen their fee go from 0% to 98% gradually, while depositors saw a "steady" APY all along.
Compare the vault's avgNetApy and avgNetApyExcludingRewards to calculate the actual fee cut. Query the performanceFee field and its history via the Morpho API. If the fee has increased by more than 5 percentage points in the last 30 days, trigger an alert.
Signal 4: A Vault's Underlying Market Reaches 100% Utilization with Zero Idle Funds
This means all funds in a particular lending market are borrowed out, so withdrawals can only come from other markets or wait for repayments. If this persists over 24 hours, withdrawals could be stuck.
Check the vault's liquidity distribution: query totalAssetsUsd, liquidityUsd, idleAssetsUsd, and assetsUsd under each adapter via the Morpho API. If a market's assetsUsd is close to totalAssetsUsd and idleAssetsUsd is less than 5% of total vault assets, trigger an alert.
Signal 5: Curator Submits a New "Increase Risk" Proposal, Entering Timelock Period
In Morpho V2 vaults, risk-increasing actions (like raising supply caps, enabling new markets, changing the allocator, or increasing fees) must go through a timelock delay. Once the proposal is submitted, it means the vault's risk framework will be relaxed after the waiting period ends.
Monitor pending governance proposals: query VaultV2PendingActions via the Morpho GraphQL, or use monitoring tools like Hypernative. If you spot new proposals such as increaseAbsoluteCap, setIsAllocator, or setPerformanceFee, trigger an alert.
Next Steps
It's recommended to review your vault positions with these 5 checks every 3-5 days. The most direct way is to combine the Morpho API and vaults.fyi — the former for underlying data, the latter for risk scores and flags. If 2 or more signals light up at the same time, consider evaluating an exit during the timelock window. Once the window closes, curators can execute the changes, and your reaction window will be closed.
