Morpho Midnight audit

A private security review of Morpho Midnight (lending), conducted with Blackthorn and completed on 6th April 2026 over 17 days. 0xSimao disclosed 5 findings: 4 low and 1 informational.

What Morpho Midnight is

Morpho Midnight is a non-custodial fixed-rate lending protocol for the EVM, organised around isolated, immutable, permissionlessly created markets with fixed maturities. Lending and borrowing are implemented as trading: credit and debt units whose payoff structure mirrors zero-coupon obligations, settling at the market's maturity.

Scope

The Blackthorn review covered the Midnight core: offer posting and taking, with liquidity locked only at settlement so a maker can quote many markets with one balance, single- and multi-collateral market configurations, the gates imposing access-control policies, and the ratifier scheme letting third parties execute pre-authorised operations on a position holder's behalf.

Low severity findings

• Chain fork changes all obligation Ids, making them unreachable
• Midnight constructor can use msg.sender instead of reading roleSetter from storage
• midnight parameter in MidnightBundles could be set in the constructor
• proof.length can be used instead ofheight in EcrecoverRatifier.isRatified

Informational findings

• testReturnJumps asserts the wrong ratio direction

The report

Download report (PDF)