Cluby is a curation layer, not a lending protocol. Markets, interest, collateral and liquidations are Morpho Blue — immutable, audited many times over, and holding every deposit. What we add is the choice of markets, the oracle behind each, the caps a vault lends under, and the machinery that keeps bad positions from becoming bad debt.

Two contracts of our own touch money and neither can hold it: a liquidator that works on a flash loan, and a router that opens a leveraged position in a single transaction. Between transactions their balance is zero by construction.

Five steps, and the third is the only one that costs anything to get wrong.

1. Connect a wallet on Robinhood Chain, id 4663. Nothing on this site can move a token without a signature from you, and the connect step reads balances only.
2. Post collateral. On a market page, set the LTV slider to zero and the button becomes Post collateral. This works even when the market has no liquidity at all — collateral never touches the lending pool — so you can take your place before there is anything to borrow, owe nothing while you wait, and withdraw again whenever you like.
3. Borrow. The slider shows the health factor and the liquidation price BEFORE you sign, and it refuses to go past the safe cap by default. That cap sits 5 percentage points inside the LLTV on a stock market, 8 on a long-tail one — the gap is deliberately wider where the price moves harder.
4. Watch the health factor. Below 1.0 the position can be liquidated by anyone. The number that matters is not today's price but the liquidation price, and the position page shows it in the same units as the ticker.
5. Repay and withdraw. Repayment goes by SHARES, not by an amount, on purpose: debt accrues every second, so an amount quoted in one block is short in the next and leaves dust that keeps your collateral locked.

Everything above is a direct call to Morpho Blue. There is no Cluby contract between you and your money at any point in that list.

A market is four immutable choices — collateral, loan asset, oracle, LLTV — plus a cap the vault sets and can change. Getting the first four wrong cannot be fixed; the market has to be abandoned and a new one opened. So the listing checklist is deliberately paranoid.

The token address is proved, never looked up. Ticker symbols on this chain prove nothing: the explorer returns thirty-odd tokens for a popular ticker, and at least one fake has been found sitting on a real name. A genuine tokenized stock answers uiMultiplier() — selector 0xa60bf13d — and the impostors revert on it. Every address in our catalogue was checked that way and against the issuer's deployer.

The price source comes second. A Chainlink feed where one exists; otherwise a Uniswap v3 arithmetic-mean-tick TWAP over the token's USDG pool. A TWAP market cannot be created until the pool's observation ring is at least as long as the window in seconds — the oracle refuses to be constructed otherwise — because a window the pool cannot reach back over is not a long window, it is an oracle that stops answering.

The LLTV is a tier, not a judgement call. Treasuries 86.0%, ETH 77.0%, ordinary stocks 62.5%, long-tail 38.5%. Morpho only permits a fixed set of values, and two of the tiers we wanted — 70% for megacap TWAPs and 66.7% for shorts — are not among them, so both sit one step lower rather than one step higher. Rounding toward the conservative side is the only rounding available.

The cap is sized off measured exit depth, not off ambition. A cap is the most a liquidator would have to sell into that pool in one move; if the pool cannot absorb it without moving the price past the liquidation premium, the cap is too high whatever the collateral is worth.

The rate is set by Morpho's adaptive-curve model, not by us and not by a vote. It moves with utilisation — the share of supplied assets currently borrowed — and it moves in two ways at once.

Along the curve, instantly. Borrow more and the rate rises immediately; repay and it falls. The curve is steep near full utilisation, which is what makes the last dollar of liquidity expensive enough that somebody repays rather than the lender simply being unable to withdraw.

And the curve itself drifts. If utilisation sits above target the whole curve adapts upward over hours and days, and below target it adapts down. That is why a market can show a rate that looks high for its utilisation: it has been busy for a while.

Interest accrues continuously and is only written to storage when someone touches the market. A quiet market therefore shows totals that are behind — every number this site displays is replayed forward to now before it is shown, which is what the Lens contract is for.

The lender's rate is the borrower's rate times utilisation, less the performance fee. A market at 50% utilisation pays its lenders roughly half what its borrowers pay, because half the pool is idle.

A vault is an ERC-4626 that spreads one asset across several markets under caps. You deposit USDG, you get shares, the shares appreciate. You are not picking markets; the curator is, and the caps are the whole of that decision.

A cap can only be raised slowly. Raising one is submitted, then waits out the vault's timelock — 24 hours — before it can be accepted. Lowering a cap is immediate, because the safe direction should never be the slow one.

A guardian can veto during that window. The point of a timelock is that somebody independent can act inside it; without a guardian the only address that can revoke a pending change is the one that submitted it, which makes the delay a formality rather than a control.

A vault cannot invent a market. It can only allocate into markets that already exist on Morpho, and every one of them is visible on the market list with its own oracle, LLTV and cap.

The performance fee is 10% of interest earned, currently waived — 0% for the first 90 days. It is charged on yield, never on principal.

A deposit can be withdrawn as long as it is not lent out. When a market is fully used the rate climbs, which pulls in supply and pushes borrowers to repay — but until that works, part of your deposit is genuinely unavailable.

That is why every vault card shows withdrawable now next to total assets. It is the number to trust; the other one is what you own, not what you can take out this minute.

Each market carries a liquidation LTV fixed at creation: 86% for T-bills, 77% for ETH, 62.5% for megacaps and index ETFs, and 38.5% for anything long-tail or priced by TWAP.

The dangerous moment for a stock market is Monday's open, not the weekend itself. Nothing trades while the feed is still, so the LTV has to survive the gap when it moves again. Caps do the rest of the work: total exposure starts at $34.0K and only rises against measured exit depth.

Stocks and ETFs are priced by Chainlink through Morpho's own oracle factory, so there is no oracle code of ours in the path. Those feeds run 24/5: they hold their last print from Friday close to Monday open, roughly 65 hours, which is normal and not a fault to alarm on.

Long-tail tickers with no feed are priced by a Uniswap v3 TWAP over a 30–60 minute window, on a pool whose observation cardinality we raise first. Where both exist, the collateral takes the lower of the two — a borrower should never be flattered by the more generous source.

A short market inverts the usual pair: you post USDG as collateral and borrow the stock itself, then sell it. If the stock falls you buy it back cheaper and keep the difference. The debt is denominated in shares, so it grows when the stock rises — which is exactly the exposure a short is supposed to have.

The oracle is the long market's oracle turned upside down: one over the price, on the same 1e36 scale Morpho expects. That inversion is exact to the last digit — the token decimals cancel identically — and the one raw unit it rounds off goes to the protocol rather than to the borrower.

Shorts run at 62.5% rather than the 66.7% the risk model asked for, because 66.7% is not one of the values Morpho permits. That means 160% coverage instead of 150% — more conservative than intended, not less.

The practical limit on a short is not the LLTV but the borrow side: you can only short what somebody has supplied. A short market with no stock supplied has nothing to lend you, however much collateral you post.

Above the liquidation LTV, anyone may repay part of a debt and seize collateral at a bonus set by Morpho's formula — around 12.7% at the 62.5% tier. Our keeper does this on a flash loan and sells the collateral through the deepest route it can simulate, so the position closes near the market rather than into it.

Before that, there is a softer option. A borrower can authorise pre-liquidation: a partial unwind between 57.5% and 62.5% at a 2–4% penalty instead of the full incentive. It turns a Monday gap into a trimmed position rather than a closed one.

A hard liquidation takes a fixed premium out of the collateral the moment health falls below 1.0. Pre-liquidation is a softer path that starts earlier and takes less: it opens 5 percentage points before the LLTV, closes a growing share of the position as health deteriorates — from 20% up to 100% — at a premium that climbs from 2% to 4%.

It is opt-in per position and it does not replace liquidation; it gives a position a chance to be trimmed gently before the blunt instrument applies. A borrower who never opts in is treated exactly as before.

A liquidation that nobody performs is bad debt for the lenders. Morpho makes liquidation permissionless so anyone can do it, and on an established chain that is enough — searchers compete for the premium. On a new chain there may be nobody watching, so we run a keeper.

It reads every watched borrower's health directly from the chain on a loop, sizes the liquidation from the market's own oracle and premium, simulates it, and only then signs. A liquidation that would revert never leaves the machine, and a sale below the oracle floor is refused by the contract itself even if the keeper asked for it.

It is not the only liquidator and must not be. If it is offline, broken, or out of gas, the market still clears through anyone else who wants the premium. The failure mode is a slower liquidation, not an impossible one.

It reads an indexer for convenience but never depends on it: the chain scan runs every pass regardless, because an indexer that is behind answers cheerfully with a short list and a keeper that trusted it would report nothing to do.

Leverage in one transaction: flash-loan the loan asset, swap it into collateral, supply, borrow, repay the flash loan. The health factor and the liquidation price are computed before you sign, and the swap reverts if the pool has moved far enough from the oracle that the position would open at a bad price.

Behaviour is scored off chain from what the indexer already sees: how long positions stay healthy, whether they are topped up before trouble, how often they get liquidated. A good score buys a better rebate — never a higher LTV, because the LTV is what protects the lenders.

Season One counts size multiplied by time: a hundred dollars supplied for ten days and a thousand for one day are worth the same. They accrue while you do nothing, and they are counted off chain by the indexer.

There is no promised conversion rate, and that is deliberate. A season that names a price before there are earnings to pay it is making a promise out of money the protocol does not have yet.

An app that routes volume here appends its address as twenty bytes at the end of the call. Solidity ignores bytes past the arguments it expects, so it costs only calldata gas and changes nothing about how the transaction runs — no contract of ours sits in the path of your users' deposits to collect a statistic.

A suffix is a claim, not a proof: anyone can append any address to their own transaction. What is paid is settled against the registered list.

Morpho lends any asset it holds for the length of one transaction at zero fee. Call flashLoan(token, assets, data) on 0x9D53d5E3bd5E8d4Cbfa6DB1ca238AEA02E651010 and repay inside onMorphoFlashLoan. There is nothing to ask us for and no allowance to grant.

The SDK that the site runs on is published as a package and exposed over MCP, so an agent can read markets and positions and build a transaction without driving a browser. Public endpoints: /api/markets, /api/vaults, /api/stats.

What holds the money is not ours. Deposits, collateral, debt and liquidation all live in Morpho Blue, which is immutable and has been audited many times over. Our contracts are periphery: they hold nothing between transactions, and every path ends with the balance swept out. That is not a claim, it is the property that lets them be small enough to read.

What we can do. Choose which markets a vault lends into and the cap on each, set the performance fee up to the ceiling the vault was deployed with, and publish credit scores that change what a borrower is REBATED. None of those can move a deposit, and none of them can change what a borrower is allowed to borrow.

What nobody can do. Change a market's LLTV, oracle or interest model — they are fixed at creation. Pause withdrawals. Reach into a position. There is no upgrade path to these contracts because there is no proxy.

Review. The money path — the liquidator, the leverage router, the reader and the three oracles — has been through an adversarial review in which every finding had to be proved with a failing test or a precise mechanism, and every finding then had to survive an attempt to refute it. Fourteen defects were found and fixed; five claimed defects were refuted and are recorded as such. The report and what was done about each item are in the repository rather than summarised here, including the items still open.

Known open. Three long-tail markets are priced by TWAPs whose pools carry fewer observation slots than their window needs. All three are capped at zero with nothing supplied or borrowed, and the oracle now refuses to be constructed against a ring that short — but the existing three were created before that check, and growing their rings is a bill that has not been paid yet.

Everything below is on Robinhood Chain, id 4663. Click through and check.

The Lens, liquidator and router have each been replaced more than once. They are abandoned rather than upgraded when they change, precisely because none of them holds anything — replacing one costs a deployment and nothing else, and there is no proxy for anyone to seize.

Who holds my collateral? Morpho Blue. Cluby cannot move it.

What does Cluby earn? A 10% performance fee on interest, waived for the first 90 days of a vault. Borrowers get 10% of the interest they paid back through a weekly epoch.

Can a market be changed? No. LLTV, oracle and assets are fixed at creation. A better parameter means a new market, not an edit.

What is not built yet? Whatever the market pages mark as awaiting creation, plus staking and rebate contracts, which deploy after the first fee cycle.