# Morpho Midnight audit Blackthorn · Lending · 6th April 2026 A private security review of Morpho Midnight (lending), conducted with Blackthorn and completed on 6th April 2026 over 17 days. 0xSimao disclosed 5 findings: 4 low and 1 informational. ## What Morpho Midnight is Morpho Midnight is a non-custodial fixed-rate lending protocol for the EVM, organised around isolated, immutable, permissionlessly created markets with fixed maturities. Lending and borrowing are implemented as trading: credit and debt units whose payoff structure mirrors zero-coupon obligations, settling at the market's maturity. ## Scope The Blackthorn review covered the Midnight core: offer posting and taking, with liquidity locked only at settlement so a maker can quote many markets with one balance, single- and multi-collateral market configurations, the gates imposing access-control policies, and the ratifier scheme letting third parties execute pre-authorised operations on a position holder's behalf. ## Low severity findings - [Chain fork changes all obligation Ids, making them unreachable](https://0xsimao.com/findings/morpho-midnight-fork-obligation-ids-unreachable) - [Midnight constructor can use `msg.sender` instead of reading `roleSetter` from storage](https://0xsimao.com/findings/morpho-midnight-midnight-reading-setter-storage) - [`midnight` parameter in `MidnightBundles` could be set in the constructor](https://0xsimao.com/findings/morpho-midnight-midnight-parameter-bundles-constructor) - [`proof.length` can be used instead of`height` in `EcrecoverRatifier.isRatified`](https://0xsimao.com/findings/morpho-midnight-proof-ecrecover-ratifier-ratified) ## Informational findings - [`testReturnJumps` asserts the wrong ratio direction](https://0xsimao.com/findings/morpho-midnight-test-jumps-asserts-direction) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2026-04-06-morpho-midnight.pdf)