# Midnight constructor can use `msg.sender` instead of reading `roleSetter` from storage Low/Info · Blackthorn · Lending · 6th April, 2026 Finding L-2 of the Morpho Midnight security review. - Protocol: https://morpho.org/ - Report: /reports/morpho-midnight - Codebase: https://github.com/0xsimao/midnight/tree/e9085f8c5fe96df6e075847b95b0dd7cea86110d - Source: https://github.com/morpho-org/midnight/blob/main/audits/2026-07-02-blackthorn.pdf --- ## Summary The constructor emits `roleSetter` (an SLOAD) in the event instead of `msg.sender`, wasting gas since they are the same value. ## Vulnerability Detail In the [constructor](https://github.com/sherlock-audit/2026-04-morpho-midnight-apr-6th-2026/blob/main/morpho-org__midnight/src/Midnight.sol#L135): ```solidity constructor() { roleSetter = msg.sender; emit EventsLib.Constructor(roleSetter); } ``` `roleSetter` was just assigned `msg.sender`, so the emit reads back from storage instead of using the already-available `msg.sender` from the calldata. ## Impact Wastes gas on an unnecessary SLOAD in the constructor. ## Code Snippet https://github.com/sherlock-audit/2026-04-morpho-midnight-apr-6th-2026/blob/main/morpho-org__midnight/src/Midnight.sol#L133-L136 ## Tool Used Manual Review ## Recommendation ```solidity constructor() { roleSetter = msg.sender; emit EventsLib.Constructor(msg.sender); } ``` --- Related findings: - [`Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`](https://0xsimao.com/findings/autonomint-redeem-yields-debits-redeems): Autonomint - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO - [Incorrect `RefundClaim` event due to deleting `idoConfig.accountPositions[msg.sender]`](https://0xsimao.com/findings/blast-ido-pools-refund-deleting-config-positions): Blast IDO Pools - [Depositing to another receiver othan than `msg.sender` will lead to stuck funds by increasing `avgStart` without claiming](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-othan-stuck-increasing-avg): Exactly Protocol Update - Staking Contract