RFP-008/012: Adopt Morpho Blue design for lending by fryorcraken · Pull Request #42 · logos-co/rfp

fryorcraken · 2026-04-10T12:18:54Z

Summary

Reframe RFP-008 and RFP-012 around Morpho Blue + Morpho Vaults V2 as the design target, adapted to LEZ. The protocol design is now Morpho-equivalent (singleton, immutable core, AdaptiveCurveIRM, Morpho liquidation incentive formula, zero-fee flash loans) rather than Aave-equivalent.

RFP-008 (Lending & Borrowing Protocol)

Architecture. Singleton program holding all markets in one state. Core is immutable and non-upgradeable; markets immutable after creation. Bounded admin scope (LLTV/IRM whitelisting, protocol fee) with explicit non-scope (cannot pause, migrate, reconfigure, seize funds).
IRM. AdaptiveCurveIRM as the launch IRM (autonomous, ~90% target utilisation, cumulative time-decay).
Liquidation. LIF = min(M, 1/(β·LLTV + (1−β))) with β = 0.3, M = 1.15, per Morpho's formula.
Flash loans. LEZ-native: tail-call with unforgeable repayment capability via LP-0015. Zero-fee, matching deployed Morpho. No CEI / reentrancy-lock framing.
Formal verification promoted from soft to hard (four invariants: no-liquidate-below-LLTV, share-value monotonicity, IRM monotonicity, solvency). Hard precondition of immutability.
Logos app architecture (U2): core module (business logic, no GUI deps) + QML+C++ GUI module loadable in Basecamp. The CLI, reference liquidator, and reference risk monitor consume the same core module — no GUI dependency.
Audit programme is a proposal deliverable. Applicants must name at least one tier-1 audit firm, include the audit budget as a line item, and publish audit reports before mainnet is recommended.
Reference liquidator and risk monitor (F15, F16): shipped as fork-and-run software for third parties; Logos doesn't commit to operate.
Bad-debt socialisation is realised on touch (lazy), matching Morpho.

RFP-012 (Curated Lending Vaults)

Morpho Vaults V2 equivalent above RFP-008 (V2 is the design target; V1 / legacy MetaMorpho is not in scope).
Sentinel role (V2 semantics): owner-appointed, mandate is risk reduction only — deallocate, instant cap decrease, revoke pending timelocked actions. Cannot introduce new risk.
Bad-debt asymmetry documented (R4): loss is realised on touch under the lazy accrual model. The supply queue / withdraw queue (F5) means an informed depositor who withdraws before next-touch repricing can exit at an inflated share price, passing a larger loss to remaining depositors. Atomic, cross-market repricing is not feasible without transaction-atomic price feeds across every allocated market. Applicants must surface this in the privacy and properties document and in the GUI risk disclosures.
Audit programme is a proposal deliverable (same shape as RFP-008; may be combined if delivered by the same team).
Curator + Allocator + Sentinel role separation, with V2-style configurable role segregation.
Vault shares as collateral in RFP-008 markets (subject to oracle availability).
Vault features delivered by extending the same core module as RFP-008; CLI and GUI extended for vaults, no separate front-end.

Scope discipline

This RFP funds software. Mainnet deployment, LLTV grid choice, admin-whitelisted IRMs on mainnet, admin authority custody, and governance design are explicitly out of scope (handled through a separate process). Per-market oracle is chosen by the market creator at creation time per F3 — not on a mainnet approval list.

Platform Dependencies (hard blockers)

On-chain clock / timestamp (lazy interest accrual is Δt-driven).
LP-0013 token authorities (the lending program is a token custodian).
LP-0015 general cross-program calls via tail calls (flash loans).
LP-0012 structured events (reference liquidator and risk monitor depend on efficient event observation).
Oracle provider for LEZ.
Liquidation CU benchmark added as a deliverable, with remediation requirement (e.g. two-phase liquidation via tail-call continuation) if liquidation exceeds the per-transaction budget.

Appendix

appendix/lending-platform.md removed (Logos-specific content moved inline per CLAUDE.md rule).
appendix/lending-ecosystem.md: ecosystem survey across Ethereum / Solana / BTCFi / long-tail chains; Morpho Blue deep dive; Morpho Vaults V2 deep dive (V2-only, no V1 content).

Action items / open decisions before merge

Decide where the off-chain indexer scope lands. Morpho ships a Messari-schema subgraph + GraphQL API + SDK with framework hooks alongside the contracts. Not required for protocol correctness, but load-bearing for curated vault allocators (RFP-012), frontends rendering market history, and third-party integrators. Three placement options on the table: (a) bundle into RFP-008 (single team ships program + indexer), (b) bundle into RFP-012 as a hard dependency the vault team owns, (c) fund as a separate RFP. Tracking issue: [RFP] Off-chain indexer + GraphQL API for LEZ programs ecosystem#137. The [OPEN] block in RFP-008 must be resolved into one of the three options before merge.
Human review of the Morpho-equivalence pass and Sentinel V2 rewrite.
Resolve TODO: items in Resources sections (LEE official doc, oracle integration guide, SPEL framework docs) — pending upstream documentation.

Verified facts (sources in research-lending vault)

Morpho Blue ~600 LOC (MorphoLabs on X).
Full Morpho stack $11.78B TVL, ~$4B active loans (2026-05, Phemex / DefiLlama).
LIF formula and Sentinel V2 role definition verified against Morpho docs (docs.morpho.org).
Zero-fee flash loans verified against deployed Morpho.sol source.

Known follow-ups (not blocking review)

Appendix TVL refresh: most non-Morpho TVL figures should be re-based against current DefiLlama readings.
Appendix coverage gaps for explicit Morpho-equivalence claims (zero-fee flash loans, LIF constants, lazy accrual, supply/withdraw queues, on-touch bad debt) — RFPs are correct; appendix needs short paragraphs to make reviewers' cross-checking easier.
LEZ private-tx-per-block citation — pending public LEE documentation.

🤖 Generated with Claude Code

Fix logos-co/ecosystem#102

Rewrite RFP-008 from Aave-style shared pools to Morpho Blue isolated markets. Extract shared privacy architecture and platform dependencies into appendix/lending-platform.md. Update RFP-012 from Aave v3 features to MetaMorpho curated vaults. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- fix broken relative links in appendix (./RFPs -> ../RFPs) - rename RFP-012 file to match its title (curated-lending-vaults) - update LP-0015/LP-0012 URLs from main to master branch - remove on-chain clock blocker (resolved in logos-execution-zone) - source the Solana compute-budget figures and mark liquidation CU cost as [BENCHMARK NEEDED] - add Supportability item for the privacy and anonymisation properties document, aligning both RFPs with the template - rewrite promotional and rule-of-three passages in the Overview and Why This Matters sections Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Apply the equivalence bundle: singleton + immutable core + bounded admin scope, AdaptiveCurveIRM as launch IRM, formal verification promoted to hard, LEZ-native flash loans (tail-call + unforgeable repayment capability) replacing EVM reentrancy framing, reference liquidator and risk monitor reframed as fork-and-run software. Scope clarified: this RFP funds software, mainnet deployment / LLTV grid / oracle approval / admin governance are out of scope. Platform deps: add on-chain clock and LP-0013 as hard blockers, promote LP-0012 (events) from soft to hard, add a liquidation CU benchmark deliverable. Open question on the off-chain indexer captured inline with pointer to logos-co/ecosystem#137. Replace appendix/lending-platform.md with appendix/lending-ecosystem.md (ecosystem survey only; Logos-specific content stays inline per CLAUDE.md). Minor edits to RFP-012 carry over from prior session. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- RFP-012 F10: rename Guardian to Sentinel and adopt Morpho Vaults V2 semantics (deallocate, instant cap decrease, revoke pending). Owner (not curator) appoints. Reference docs.morpho.org/morpho-vaults/concepts/roles. - RFP-012 R4: make bad-debt accounting "on touch" explicit and document the queue-order withdrawal asymmetry (informed depositors can exit before next-touch repricing). Add disclosure requirement. - RFP-008 F8: cite the Morpho liquidation incentive formula LIF = min(M, 1/(beta*LLTV + (1-beta))) with beta=0.3, M=1.15. - RFP-008 F14: flash loans are zero-fee per the deployed Morpho.sol; drop the admin-configurable fee. - RFP-008 P2: replace fixed "20 markets" floor with benchmark-driven target; Morpho runs 200+ markets on Ethereum. - RFP-008 Privacy U4: document SDK enforcement of single-use ephemeral accounts (LEZ keypair-derivation makes fresh-history trivial; preventing reuse is SDK state). - RFP-008 TVL figures aligned with appendix (Morpho Blue core ~$4.9B, full stack $11.78B); RFP-012 [DATA NEEDED] resolved with the same numbers plus Coinbase/Steakhouse multi-billion AUM. - Appendix V1/V2 roles row corrected: V2 is Sentinel, not "Same". - [SOURCE NEEDED] on LEZ private-tx-per-block reframed as pending upstream doc rather than a citation we owe. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

… fix Appendix: - Drop V1 MetaMorpho content entirely. The vault deep-dive now describes Morpho Vaults V2 only: V2 spec table (no V1/V2 comparison), V2 role semantics (Owner / Curator / Allocator / Sentinel), and a V2-Sentinel threat-model write-up. Removed the V1-Guardian section with B.Protocol oSnap and Steakhouse Aragon-DAO patterns (those are V1-only). Renamed "MetaMorpho" references to "Morpho Vaults V2" where current. - Fix Babylon docs URL: docs.babylonchain.io is NXDOMAIN; replace with the current docs.babylonlabs.io domain. RFPs: - RFP-008 and RFP-012 Supportability: add an Audit Programme hard requirement. The proposal must name at least one tier-1 audit firm, include the audit budget as a proposal line item, and include the timeline. Audit reports must be published before any mainnet recommendation. Removed the prior "audits are out of scope" line from RFP-008 Out-of-Scope; that framing no longer applies. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

fryorcraken · 2026-05-22T12:36:35Z

+4. The reference liquidator (F15) and reference risk monitor (F16)
+   are implemented as Logos modules with headless CLIs/daemons,
+   suitable for third parties to fork and run independently.
+5. The mini-app supports creating markets, supplying, borrowing,


Suggested change

5. The mini-app supports creating markets, supplying, borrowing,

5. The Logos app (loadable in Basecamp) supports creating markets, supplying, borrowing,

Actually, just call it "GUI".

But define somehwhere as a hard that Logos app, aka a QML+C++ UI Module for GUI, and a core module with the business logic, must be delivered. the core module would also be used by the "headless" mode. ensure code is composabile.

Done in 7335e4c.

Renamed mini-app → GUI throughout RFP-008 and RFP-012. Added new Usability U2 to RFP-008 defining the Logos app architecture: core module (business logic, no GUI deps) + QML+C++ GUI module that consumes it, both built and shipped independently. The CLI, reference liquidator, and reference risk monitor all consume the same core module — composability is explicit. RFP-012 U1 updated to reference the core-module extension point so the second RFP plugs in cleanly.

fryorcraken · 2026-05-22T12:40:39Z

-   cannot be liquidated, (b) receipt token supply equals total
-   supplied assets plus accrued interest, (c) interest rate output is
-   monotonically increasing with utilisation.
+1. Multi-oracle redundancy: at least two independent oracle providers


I thought one oracle was defined per market, clarify

Clarified in 6c7059b.

You're right: oracle is per-market, chosen by the market creator at market-creation time (F3, permissionless), not gated by the admin. There's no "approved oracles list" on mainnet. Removed that out-of-scope bullet and replaced with an explicit note that the IRM (which IS admin-whitelisted per F11) is the only mainnet-approval choice in scope-out; oracle choice is per-creator. Also updated the Overview paragraph to match.

…ame mini-app to GUI Per PR #42 review: define the user-facing deliverable as two composable modules. A core module holds all business logic (transaction construction, state querying, SDK-level operations) with no GUI dependency; a QML+C++ GUI module consumes the core module and is loadable in the Logos app (Basecamp). The CLI, reference liquidator, and reference risk monitor all consume the same core module. No business logic in the GUI that is not also accessible through the core module. Renamed "mini-app" to "GUI" throughout RFP-008 and RFP-012. Updated RFP-012 Usability U1 to reference the core-module extension point. Updated F3 cross-ref to track renumbered Usability items. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

fryorcraken · 2026-05-22T12:41:13Z


-Advanced lending features — deferred to [RFP-012](./RFP-012-advanced-lending-features.md):
+This RFP funds **software**. The mainnet deployment of that software,
+and the governance around it, is handled by Logos through a separate


Suggested change

and the governance around it, is handled by Logos through a separate

and the governance around it, is handled through a separate

Not by Logos.

Done in 6c7059b. Dropped "by Logos" — now reads "handled through a separate process" without naming the handler.

- The oracle is chosen per-market by the market creator at creation time (F3), not gated by the admin authority. Removed the misleading "choice of approved oracle programs on mainnet" out-of-scope item; IRMs (which are admin-whitelisted per F11) remain out-of-scope. Updated Overview to match. - Drop "by Logos" framing: scope-out items are handled "through a separate process", not by a named party. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

fryorcraken · 2026-05-22T12:42:36Z

+  multi-collateral exposure by holding positions across multiple
+  markets, optionally via curated vaults (RFP-012).
+
+### Open Questions


be sure this is a clear action items/TODO in teh PR description

Done. Lifted the indexer placement decision out of the "open questions for reviewers" section into a new top-level Action items / open decisions before merge section in the PR description, framed as an explicit TODO checkbox. The three placement options (RFP-008 / RFP-012 / separate RFP) are spelled out, with logos-co/ecosystem#137 as the tracking issue. The [OPEN] block in RFP-008 itself stays in place so future readers of the RFP see the same context.

fryorcraken force-pushed the rfp/lending-morpho branch from dcf0549 to c8dec22 Compare April 10, 2026 12:30

fryorcraken force-pushed the rfp/lending-morpho branch from c8dec22 to 5ffa9ff Compare April 28, 2026 10:35

fryorcraken and others added 2 commits May 18, 2026 21:44

fryorcraken force-pushed the rfp/lending-morpho branch from 5ffa9ff to 4461610 Compare May 18, 2026 11:46

fryorcraken and others added 3 commits May 22, 2026 22:15

fryorcraken commented May 22, 2026

View reviewed changes

fryorcraken marked this pull request as ready for review May 22, 2026 12:50

mart1n-xyz mentioned this pull request May 22, 2026

rfp: cross-chain DEX and synthetic-XMR design bundle (decision drafts) + 2 lambda prizes #57

Draft

mart1n-xyz self-requested a review May 26, 2026 13:28

mart1n-xyz approved these changes May 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RFP-008/012: Adopt Morpho Blue design for lending#42

RFP-008/012: Adopt Morpho Blue design for lending#42
fryorcraken wants to merge 7 commits into
masterfrom
rfp/lending-morpho

fryorcraken commented Apr 10, 2026 •

edited

Loading

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

fryorcraken May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	5. The mini-app supports creating markets, supplying, borrowing,
	5. The Logos app (loadable in Basecamp) supports creating markets, supplying, borrowing,

	and the governance around it, is handled by Logos through a separate
	and the governance around it, is handled through a separate

Conversation

fryorcraken commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

RFP-008 (Lending & Borrowing Protocol)

RFP-012 (Curated Lending Vaults)

Scope discipline

Platform Dependencies (hard blockers)

Appendix

Action items / open decisions before merge

Verified facts (sources in research-lending vault)

Known follow-ups (not blocking review)

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fryorcraken commented Apr 10, 2026 •

edited

Loading