Testnet — play money on a daily-reset fork of Base. Nothing here is real.
Documentation
Morpho Midnight is a fixed-rate lending order book: a lender buys credit units that will be worth 1 USDC each at maturity. In the meantime, those units have no exit market. Plumb is that market: an ERC-4626 vault that permanently holds the book's bid. A lender in a hurry sells their units to the vault below par; the discount they concede is the yield of the vault's depositors.
The loop
Deposited USDC sits on Morpho Blue as long as no seller shows up. When a lender hits the bid, Midnight settles everything in the same transaction: the vault pulls exactly what it needs from Blue, pays the seller, and books the lot at its purchase price. At maturity each unit settles at 1 USDC — the gap with the purchase price flows into the share price.
The price
The bid price follows from an annualised rate: the further the maturity, the deeper the discount, so that carrying the lot to the end returns the same rate. That rate is not a fixed number — it rises with the collateral's risk, with how full the book already is, and never falls below what idle capital already earns on Blue. A lot bought at 0.985 sixty days from maturity converges mechanically to 1.00 — there is no market bet, only time passing and the borrower's credit risk.
The guardrail
Before every settlement, Midnight asks the vault whether the offer is acceptable — field by field, against a policy written into the contract: price floor from the QuoteModule, book cap, maturity window, epoch budget. No signature is involved. The off-chain bot only broadcasts what the contract builds; a compromised bot key cannot quote anything the policy would not have quoted, and cannot move any funds.
The fees
Deposits, withdrawals and the Morpho Blue yield carry no fee. The vault charges a single performance fee — 15% today, hard-capped at 20% in the contract — minted as shares only when the share price sets a new all-time high; below that high-water mark, nothing accrues until the previous peak is regained. Separately, when a loan repays early, the windfall unlocks into the share price linearly over 7 days instead of at once — so a large deposit timed just before a settlement cannot capture a gain that belongs to earlier depositors.
The limits
Book cap. The share of net assets tied up in unmatured credit is capped — 60% at deployment. The rest stays in the liquid sleeve, mobilisable for withdrawals.
Deposit cap. An absolute ceiling on the vault's total assets, low until the external audit is done. Deposits above it are refused at the door; it bounds the blast radius of any bug.
Rate band and tenor. The policy never quotes below an annualised 5% or above 30%, never further than 90 days from maturity, and never below what idle capital already earns on Blue plus a margin.
Per-take, per-market. A single purchase is capped in size, the book holds at most 8 markets at once, and per-maturity concentration caps keep any single market from dominating it.
The keys
The owner — a multisig. Sets parameters, caps and fees, appoints the operator, and is the only key that can unpause. It cannot skim the book: fees only mint against a new share-price high.
The operator — the bot key. Opens budget epochs, shifts the idle sleeve between the vault and Blue, and can pause or kill. It sets no price and cannot send funds anywhere but the vault itself.
Anyone. Marking a market and settling at maturity are permissionless: both can only tell the truth, so there is no key to trust.
The brakes. pause closes the entrance and stops quoting but leaves withdrawals open — deliberately. kill goes further: it exhausts the epoch's budget and pulls every live offer in one transaction.
The architecture
Everything that touches money lives on Base, in two contracts. The off-chain service — indexer, quoter, settlement, alerts — holds nothing: it watches the chain, recomputes the book on its own side, and alerts on the slightest drift. The front end only reads the API and talks to the contracts from your browser.
VALUATION_DRIFT alert. The gestures that engage funds never travel through the VM.The addresses
Everything that touches money is these two contracts, plus the operator key that quotes them. Parameters, caps and fees sit behind a multisig — deliberately not listed here.
The risks
Credit, first. The vault carries loans to maturity. A borrower default hits the book, discount or not — buying below par is a cushion, not an insurance. Per-maturity concentration caps exist so that no single market can dominate the book.
Liquidity, next. Withdrawals draw on the liquid sleeve (idle USDC + Morpho Blue). The share engaged in the book is only mobilisable as maturities roll off: a withdrawal larger than the sleeve waits.
The contract, always. The contracts are tested against a fork of the real protocol and reviewed internally, but the external audit is still ahead. Caps stay low until it is done.
The yield, finally. It depends on sellers showing up. Without sellers, the vault returns the Morpho Blue rate, no more. No figure shown here is a promise.
The rest reads off the chain: the book, the live bids and the alerts are public.