Morpho Midnight Bundles audit
A private security review of Morpho Blue Bundles (lending), conducted with Blackthorn and completed on 14th July 2026 over 17 days. 0xSimao disclosed 1 finding: 1 informational.
What Morpho Midnight is
Morpho Midnight is Morpho's fixed-rate, fixed-maturity lending layer: isolated markets where credit and debt positions behave like zero-coupon obligations settling at maturity, traded through offers that lock no capital until they are taken. Midnight Bundles V1 is the entry layer over it, giving end users opinionated, one-transaction paths into positions that would otherwise take several approvals and calls.
Scope
The review covered the bundles contract against the morpho-org/midnight and morpho-org/bundles repositories. A bundle composes steps such as supplying collateral, taking an offer, rolling a position and settling repayment, forwarding value and callback data between the bundler and Midnight's take() flow; correctness turns on each step leaving no residual approvals, balances or state that a later step, or a later caller, can pick up.
Informational findings
The report