Researcher Finds High-Severity Rounding Flaw in Tenor Labs' Morpho Midnight Migration Logic

A security researcher participating in a bug bounty for Tenor Labs, a non-custodial protocol extending Morpho Midnight, identified a high-severity rounding vulnerability in its migration callbacks. The flaw stems from a rounding-down calculation that can transfer zero collateral when a tiny debt amount is repaid, leaving new debt unbacked. An attacker could exploit this by making a minimal fill on a migration offer, pushing a borrower's loan-to-value ratio to infinity and enabling liquidation of their existing collateral. The researcher published a Foundry proof of concept demonstrating the math behind the exploit.