# Morpho Midnight Bundles audit Blackthorn · Lending · 14th July 2026 A private security review of Morpho Blue Bundles (lending), conducted with Blackthorn and completed on 14th July 2026 over 17 days. 0xSimao disclosed 1 finding: 1 informational. ## What Morpho Midnight is Morpho Midnight is Morpho's fixed-rate, fixed-maturity lending layer: isolated markets where credit and debt positions behave like zero-coupon obligations settling at maturity, traded through offers that lock no capital until they are taken. Midnight Bundles V1 is the entry layer over it, giving end users opinionated, one-transaction paths into positions that would otherwise take several approvals and calls. ## Scope The review covered the bundles contract against the morpho-org/midnight and morpho-org/bundles repositories. A bundle composes steps such as supplying collateral, taking an offer, rolling a position and settling repayment, forwarding value and callback data between the bundler and Midnight's take() flow; correctness turns on each step leaving no residual approvals, balances or state that a later step, or a later caller, can pick up. ## Informational findings - [`BlueBundlesV1::blueBundlesV1RepayAndWithdrawCollateral()` may transfer a null leftover](https://0xsimao.com/findings/morpho-blue-bundles-repay-collateral-transfer-leftover) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2026-07-14-morpho-blue-bundles.pdf)