Tenor Architecture

The Tenor platform builds on the Morpho smart contracts stack (Morpho Midnight for fixed-rate, fixed-term markets, Morpho Blue for variable-rate, open-term markets, and Vaults V2) and extends it with modular contracts (callbacks, ratifiers, oracles, and gates) that add functionality without modifying core Morpho behavior.

Primer on Morpho Midnight

Morpho Midnight matches lenders and borrowers on signed offers that settle into fixed-rate positions with a shared maturity and set of collateral assets. Each market is isolated with a set of immutable parameters set at creation.

Midnight Markets

A market is the core building block of Morpho Midnight. It defines the terms of a fixed-rate, fixed-term position and supports one or more collateral types, each with its own oracle and liquidation parameters.

Each market is defined by a set of parameters:

• Loan token: the asset being lent and borrowed
• Collaterals: one or more collateral assets, each with its own token, oracle, LLTV, and max liquidation incentive factor
• Maturity: the timestamp at which all positions in the market expire
• Recovery close factor threshold: governs when liquidations switch from partial to full close
• Enter gate: optional gate that restricts who can take offers in the market (used for permissioned markets)
• Liquidator gate: optional gate that restricts who can liquidate unhealthy positions

The market ID is derived from these parameters and is immutable once deployed. Trading fees and tick spacing are set separately by Morpho and can change over a market's lifetime.

Midnight Offers

Lending and borrowing in Morpho Midnight works through an offer and take model:

• Offers are intents created by lenders or borrowers, specifying amount, rate, and terms
• Takes are onchain transactions that match against an offer to initiate a position

Offers come in two directions, named from the perspective of the debt instrument being traded:

• Sell offers are posted by borrowers offering to sell (issue) debt against collateral in exchange for loan tokens. A lender takes a sell offer to fund the position. The onSell callback fires on the borrower's side, letting them run logic such as supplying collateral atomically when the offer is filled.
• Buy offers are posted by lenders offering to buy a future repayment claim by providing loan tokens. A borrower takes a buy offer to draw the position. The onBuy callback fires on the lender's side.

Throughout the contracts documentation, sellerAssets and buyerAssets refer to the filled amounts on the offer being taken, as returned by the Take Router. "Seller" always means the borrower side; "buyer" always means the lender side.

When a take executes, Morpho Midnight optionally invokes a callback. The callback is a smart contract hook that can perform additional logic atomically within the same transaction.

How Tenor Extends Morpho Midnight

Tenor deploys a set of opt-in contracts on top of Morpho Midnight, each extending a specific capability without modifying core behavior. On top of Morpho Midnight Tenor uses:

• Callbacks: Stateless contracts invoked by Morpho Midnight during a take. They perform multi-step transitions (migrations, supply-collateral on take, deposit borrowed funds in a vault and add vault shares as collateral) atomically in the same transaction.
• Ratifier: A contract that holds each user's intent (renewal parameters, fee config, rate limits) and validates every take against it. Routed through the shared IntentSettler, which calls into Morpho Midnight.
• Router: TenorRouter fills a position across multiple offers in a single atomic transaction, stepping through an ordered list of takes under a fill cap, price slippage bounds, and a deadline.
• Bundler: TenorAdapter exposes Morpho Midnight, the ratifiers, and TenorRouter as multicallable actions through Morpho's Bundler3, so user-facing transactions batch into one atomic call.
• Midnight Gates: Per-market gates set as the market's enterGate or liquidatorGate. They restrict who can take offers and who can liquidate, and add timing constraints around liquidation.

Callbacks

Callbacks are stateless contracts invoked by Morpho Midnight during take(), before the take is finalized. Callbacks can be used to bundle arbitrary actions into the take transaction that execute atomically alongside settlement.

Migration Callbacks

Tenor offers a suite of six callbacks that handle migrations between fixed-rate markets (Morpho Midnight) and variable-rate instruments (Morpho Blue and Vaults V2), covering both the borrow and lend sides and all three directions (entry, exit, and same-product roll). Tenor migration callbacks also support Midnight to Midnight renewals. Borrow side migration callbacks ensure collateral is moved proportionally between the source market and target market. See the Callbacks overview for the full list.

Direction	Borrow side	Lend side
Variable → Fixed	Blue → Midnight (Read more)	Vault → Midnight (Read more)
Fixed → Fixed	Midnight → Midnight (Read more)	Midnight → Midnight (Read more)
Fixed → Variable	Midnight → Blue (Read more)	Midnight → Vault (Read more)

Standalone Callbacks

Three additional callbacks support common patterns on take:

• Supply collateral: supply collateral only when a borrow offer is taken, with pro-rata amounts for partial fills
• Supply vault shares as collateral: wrap loan tokens into ERC-4626 vault shares and supply as collateral on a take
• Withdraw vault shares on early exit: withdraw vault shares from collateral and redeem them into loan tokens to repay an early-exit buy offer

Offers can attach a callback to guarantee its execution when the offer is taken. Ratifiers can also require the inclusion of a specific callback on every offer taken on a user's behalf.

Ratifiers

A user can attach a migration callback to a single offer, but this requires the user to sign a new offer with the desired callback and parameters every time their position matures and needs to be rolled. The ratifier layer removes that requirement: a user stores their renewal preferences once, and the ratifier enforces onchain that any offer taken on their behalf matches those rules (specific callbacks, rate bounds, durations, fee config, and rate limits). Ratifiers are routed through the shared IntentSettler, which mediates both keeper-driven takes (take()) and maker-side ratification (isRatified()) gated by a single per-user authorization map.

• Tenor Migration Intent Ratifier stores each user's migration preferences and validates every take across the six supported callbacks (same-protocol renewals and cross-protocol migrations on both the borrow and lend side). The same contract covers two primary use cases: auto-renewal of borrow positions (Midnight ↔ Midnight, Blue ↔ Midnight) and lend-side market making, where a lender expresses a full round-trip policy: sit in a Vault, automatically enter a Midnight fixed-rate position to lend at least X%, exit early when the prevailing rate falls to Y% (below the entry rate), and return to the Vault. The lender quotes a fixed lending rate continuously while idle capital earns the variable rate.

Router

TenorRouter fills a position across multiple offers atomically. Each call takes an ordered list of actions: either direct Midnight takes for users running their own batches, or renewal takes on behalf of users with pre-committed intent parameters for trustless keeper automation. The batch enforces a fill cap along a chosen dimension (buyer assets, seller assets, or units), slippage bounds on price, and a deadline. Individual actions can be marked as revertible so a single failure no-ops instead of aborting the rest of the batch.

Bundler

TenorAdapter makes Morpho Midnight, the ratifiers, and TenorRouter operations available as multicallable actions via Bundler3, Morpho's generic multicall contract. User-facing transactions (supply collateral, take offer, approve tokens) are batched into a single atomic transaction through the adapter.

Gates

Gates are per-market contracts that Morpho Midnight calls on specific actions: the enterGate is checked when an offer is taken, and the liquidatorGate is checked when a liquidation is attempted. They let a market restrict participation or constrain the conditions under which a position can be liquidated, without changing core Morpho behavior. A market sets its gates at deployment and the choice is immutable.

• DelayedLiquidationGate: Gives borrowers a grace period before a liquidation can be triggered, so a position that first becomes unhealthy is not liquidated immediately. Set as the market's liquidatorGate, which makes the DelayedLiquidationGate the sole liquidator on the market, so liquidations only execute through the gate once the grace period has elapsed. Typically used on OTC and P2P offers where counterparties want a window to top up collateral before being liquidated.
• Midnight Allowlist Gate: Restricts who can lend, borrow, and liquidate on a Morpho Midnight market. Used for permissioned markets with a restricted set of participants, such as bilateral or OTC agreements between known counterparties.

Vault V2

Vaults V2 are ERC-4626 compliant vaults with role-based access control and gates, allowing allocation into different underlying markets, such as Morpho Blue variable-rate markets.

Vault V2 Gate

Tenor developed a simple Vault V2 Allowlist Gate: a gate contract that enforces a list of addresses authorized to hold vault shares. Any transfer or mint to a non-whitelisted address reverts, so the deployer of a vault can constrain who can ever end up holding shares without changing the vault's other behavior.

The gate's allowlist can be updated by its owner. To make the gate (and therefore the vault's whitelist) immutable, the owner can abdicate the gate and renounce ownership of the allowlist. After that, the allowlist is frozen and no address can be added or removed.

One use of the gate is to deploy a private vault (restricting shares to a defined set of depositors) while retaining Vault V2's role-based access control for risk decisions and allocations. This allows a vault to allocate across both open-term (variable-rate) and fixed-term markets under operator-defined policies, with deposits limited to the allowlisted participants.

Vault V2 as Collateral

Vault V2 shares can be used as collateral on Morpho Midnight markets via the supply vault shares and withdraw vault shares callbacks. A user can keep their lend exposure on a variable-rate market (open term) while borrowing against the same position at a fixed rate and term on Midnight.

For Tenor markets, only immutable, unmanaged vaults are used. Each vault allocates 100% of deposits to a single Morpho Blue market whose parameters (loan token, collateral token, LLTV, oracle, IRM) mirror the Midnight market where the shares are used as collateral.

When a Vault V2 is used as collateral, its allowlist gate whitelists only Morpho Midnight and the vault-shares callbacks. Outside of an active take, shares cannot land on any other address. The gate confines the vault to its collateral role and prevents the shares from being transferred or held by third parties.

Because all share movement is constrained to flow through Midnight and the callbacks, integrators interacting with the position (for example, to liquidate it) cannot move shares directly. Tenor exposes MidnightVaultExecutor, a periphery contract that bundles the required steps (withdraw collateral, redeem vault shares, settle on Midnight) into a single call so liquidators and other actors can operate against vault-collateralized positions without composing the sequence themselves.

Tenor Oracles

Tenor builds Morpho-compatible oracles that wrap existing price feeds with additional logic such as sanity checks, cross-feed validation, or circuit breakers, so markets can use a hardened price source without changing how the oracle integrates with Morpho. Markets that don't need this extra check can use any other oracle that implements the Morpho oracle interface.

Oracle with Validation

Oracle with Validation sits in front of a primary Chainlink-compatible feed and a secondary feed, and reverts if the two deviate beyond a configured threshold. This is useful for markets that want a circuit breaker on stale or manipulated prices.