Midnight is collateralized credit built as isolated, immutable, permissionlessly-created markets with a fixed maturity. Each market specifies a loan token, a maturity date, and a set of accepted collaterals with their parameters. Lending and borrowing are expressed as the trading of fungible units whose payoff is that of a zero-coupon obligation: one credit unit redeems for one loan token at maturity; one debt unit is the obligation to repay one.
Two design choices drive everything downstream:
Fixed rate, fixed maturity: unlike pool-based protocols, the rate is not utilization-based, but it is whatever price units trade at, locked until settlement.
Liquidity is sourced at settlement, not locked up front: makers quote offers without committing capital. It is only pulled when an offer is taken.
Within a market, positions are accounted in units. Buying units increases your credit (you are a lender); selling units increases your debt (you are a borrower). For any traded price P ∈ (0,1], the simple rate over the remaining term is:
r = 1/P −1
A credit unit, simulated from the WETH/USDC path. It starts below par (here P₀ = 0.981, an ~8%/yr fixed rate) and increases to 1.0 at maturity. Here, the lender’s return is fixed, capped at par even when ETH rallies (no collateral upside). Notably, even a large orderly decline leaves the lender whole: liquidation keeps pace, the borrower takes the loss, the unit still redeems at par. Only a disorderly jump that outruns liquidation realizes bad debt and slashes the unit below par.
Trades are maker–taker. A maker publishes an executable offer without locking capital. A taker (any router, off-chain) selects offers and submits them. The contract settles atomically against the referenced market, minting/burning the corresponding credit and debt units. Makers can attach a callback so the capital backing an offer is sourced only at execution which lets a lender keep funds productive elsewhere until their offer is hit.
Everything below is chosen at market creation and immutable. A WETH/USDC market is fully specified by:
Loan token: the asset borrowed and settled at maturity (USDC). It is the numéraire in which all credit and debt are accounted.
Collateral set: which assets back the loan (WETH), from 1 to 128 of them. Each collateral carries its own LLTV, cursor, and oracle.
LLTV (per collateral): the liquidation loan-to-value constrained to 9 fixed tiers (0.385 → 1.0, inherited from Morpho Blue).
Liquidation cursor γ (per collateral): one of {0.25, 0.50}. It fixes the maximum liquidation incentive maxLif = 1 / (1 − γ(1 − LLTV)), the discount a liquidator earns on seized collateral.
Oracle (per collateral): the price feed. Midnight trusts it completely: no staleness check, no bounds, no circuit breaker.
Maturity: the settlement date (up to 100 years out). Sets the term, and therefore how far the collateral can travel before redemption.
rcfThreshold: a dust floor in the loan token. Below it, the recovery-close-factor cap is switched off so tiny, gas-uneconomical positions can be fully liquidated rather than left as residue.
Gates (enter / liquidator, optional) access control: the enter gate can block increasing credit or debt; the liquidator gate restricts who may liquidate (and thus who can realize bad debt). They can be used to build KYC’d or whitelisted markets on top of the same primitive.
Things that cannot be set: the tick spacing (rate granularity) and the fees (settlement + continuous) are protocol-role controlled.
Of these, three move lender risk directly: LLTV, maturity, and γ*.
*oracle setup is not considered in this study
Expected loss is negligible for a wide range of LLTVs, then hits a cliff. Each step up the ladder near the top costs disproportionately more tail risk. There is no free capital efficiency at the top.
A longer term means more cumulative variance before settlement, so the safe LLTV falls as maturity grows. A 30-day market can be run far riskier than a 180-day one for the same risk budget.
γ ∈ {0.25, 0.50} sets maxLif. Higher γ gives liquidators more slippage budget (faster liquidation, helpful at thin buffers) but a higher penalty to liquidated borrowers.
Bad debt in Midnight is socialized. When a borrower’s debt cannnot be covered by their collateral, the shortfall is written down proportionally across that market’s lenders via a lossFactor. So a lender’s loss is the bad debt.
Price jumps: a position is healthy while maxDebt = Σ collateralᵢ · priceᵢ · LLTVᵢ ≥ debt. A price drop can blow through that line in a single move, before anyone can act.
Liquidation lag: liquidators source repayment capital just-in-time. Settlement is atomic, so if that fails the liquidation simply reverts, which does not cause a loss to the protocol directly. But the unhealthy position stays open and bad debt grows. Liquidation is only as fast as a profitable liquidation can execute.
Congestion: when ETH crashes, many positions become liquidatable at once and all compete for the same finite ETH/USDC liquidity. The crash and the liquidity crunch create a reflexive spiral.
Figure 4: reflexive spiral
Re-implemented Midnight’s exact liquidation arithmetic, health, the liquidation incentive factor LIF_max = 1/(1 − γ(1 − LLTV)), the recovery-close-factor cap, lossFactor socialization, fee accrual. The price input is taken from Chainlink ETH/USD on-chain feed (~130,000 updates, 2020–2026), forward-filled onto a 5-minute grid so the price the protocol sees is held flat between oracle updates. Oracle staleness is taken from the data. Two views are run: a historical replay of ~280 real 30/90/180-day oracle windows, and a de-drifted block-bootstrap of real 5-minute returns (neutral drift). Liquidity shrinkage is modeled as in “Reassessing Liquidity: Beyond Order Book Depth (CME, 2025)”. Populated markets with rational liquidators, where heterogeneous borrowers share one oracle, one socialization pool, and one congestible liquidity pool. Liquidations compete for a per-step capacity derived from the profit function above. Bad debt is realized through the exact core.
A safe configuration still has to attract lenders. Converting expected loss into the annualized premium lenders need just to break even:
required premium = Expected Loss × (365/maturity days) + continuous fee
For 90-day WETH/USDC at 86% LLTV that is ≈ 60 bps. The market only functions if the clearing fixed rate exceeds the lender’s opportunity cost plus this premium. A parameter set can be solvent yet non-viable.
WETH/USDC, 90-day. Flat, then a cliff. LLTV ≥ 98% is catastrophic as a single jump blows through a ~2% buffer with near-zero incentive to liquidate. (LLTV = 100% has maxLif = 1: zero liquidation incentive pre-maturity.)
Expected lender loss by LLTV × maturity (γ=0.50). Important to match the highest LLTV the loss budget allows.
Max safe LLTV falls with maturity. At a 0.5%-expected-loss budget: 91.5% at 30d → 86% at 90d.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.