# Tenor Morpho Migrations audit Blackthorn · Fixed-rate lending · 22nd May 2026 A private security review of Tenor Markets (fixed-rate lending), conducted with Blackthorn and completed on 22nd May 2026 over 15 days. 0xSimao disclosed 5 findings: 5 low. ## What Tenor is Tenor is a collection of immutable contracts extending the Morpho stack, primarily Morpho Midnight, the intent-based fixed-rate lending protocol, alongside Morpho Blue, Vault V2 and Morpho's oracles. Its job is movement: getting positions into, out of and between fixed-rate markets without dismantling them by hand. ## Scope The Blackthorn review covered the migration callbacks invoked during Midnight's take(): migrations to and from Morpho Blue and Vault V2, Midnight-to-Midnight renewals and liquidation flows, alongside the MigrationRatifier enforcing the position owner's standing policies and the batch-fill router filling one position across several offers. ## Low severity findings - [MidnightSupplyVaultSharesCallback deposits into ERC4626 without a min shares slippage bound](https://0xsimao.com/findings/tenor-markets-callback-erc4626-slippage-bound) - [MidnightVaultExecutor::onLiquidate forces liquidators to provide callback data and never refunds leftover loan tokens](https://0xsimao.com/findings/tenor-markets-liquidate-callback-refunds-leftover) - [ClampLib::mulDivDownInverse reverts on `target == type(uint256).max` before the overflow guard runs](https://0xsimao.com/findings/tenor-markets-reverts-overflow-guard-runs) - [ClampLib::mulDivDownInverse contains a dead `n == 0` check](https://0xsimao.com/findings/tenor-markets-clamp-inverse-contains-dead) - [ClampLib::mulDivUpInverse overflows on large `target`, DoSing SELL offer reads](https://0xsimao.com/findings/tenor-markets-overflows-sell-offer-reads) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2026-05-22-tenor-markets.pdf)