Cluby is a curation layer, not a lending protocol. Markets, interest, collateral and liquidations are Morpho Blue — immutable, audited many times over, and holding every deposit. What we add is the choice of markets, the oracle behind each, the caps a vault lends under, and the machinery that keeps bad positions from becoming bad debt.

Two contracts of our own touch money and neither can hold it: a liquidator that works on a flash loan, and a router that opens a leveraged position in a single transaction. Between transactions their balance is zero by construction.

Five steps, and the third is the only one that costs anything to get wrong.

1. Connect a wallet on chain ID 4663. Nothing on this site can move a token without a signature from you, and the connect step reads balances only.
2. Post collateral. On a market page, set the LTV slider to zero and the button becomes Post collateral. This works even when the market has no liquidity at all — collateral never touches the lending pool — so you can take your place before there is anything to borrow, owe nothing while you wait, and withdraw again whenever you like.
3. Borrow. The slider shows the health factor and the liquidation price BEFORE you sign, and it refuses to go past the safe cap by default. That cap sits 5 percentage points inside the LLTV on a stock market, 8 on a long-tail one — the gap is deliberately wider where the price moves harder.
4. Watch the health factor. Below 1.0 the position can be liquidated by anyone. The number that matters is not today's price but the liquidation price, and the position page shows it in the same units as the ticker.
5. Repay and withdraw. Repayment goes by SHARES, not by an amount, on purpose: debt accrues every second, so an amount quoted in one block is short in the next and leaves dust that keeps your collateral locked.

Everything above is a direct call to Morpho Blue. There is no Cluby contract between you and your money at any point in that list.

A market is four immutable choices — collateral, loan asset, oracle, LLTV — plus a cap the vault sets and can change. Getting the first four wrong cannot be fixed; the market has to be abandoned and a new one opened. So the listing checklist is deliberately paranoid.

The token address is proved, never looked up. Ticker symbols on this chain prove nothing: the explorer returns thirty-odd tokens for a popular ticker, and at least one fake has been found sitting on a real name. A genuine tokenized stock answers uiMultiplier() — selector 0xa60bf13d — and the impostors revert on it. Every address in our catalogue was checked that way and against the issuer's deployer.

The price source comes second. A Chainlink feed where one exists; otherwise a Uniswap v3 arithmetic-mean-tick TWAP over the token's USDG pool. A TWAP market cannot be created until the pool's observation ring is at least as long as the window in seconds — the oracle refuses to be constructed otherwise — because a window the pool cannot reach back over is not a long window, it is an oracle that stops answering.

The LLTV is a tier, not a judgement call. Treasuries 86.0%, ETH 77.0%, ordinary stocks 62.5%, long-tail 38.5%. Morpho only permits a fixed set of values, and two of the tiers we wanted — 70% for megacap TWAPs and 66.7% for shorts — are not among them, so both sit one step lower rather than one step higher. Rounding toward the conservative side is the only rounding available.

The cap is sized off measured exit depth, not off ambition. A cap is the most a liquidator would have to sell into that pool in one move; if the pool cannot absorb it without moving the price past the liquidation premium, the cap is too high whatever the collateral is worth.

The rate is set by Morpho's adaptive-curve model, not by us and not by a vote. It moves with utilisation — the share of supplied assets currently borrowed — and it moves in two ways at once.

Along the curve, instantly. Borrow more and the rate rises immediately; repay and it falls. The curve is steep near full utilisation, which is what makes the last dollar of liquidity expensive enough that somebody repays rather than the lender simply being unable to withdraw.

And the curve itself drifts. If utilisation sits above target the whole curve adapts upward over hours and days, and below target it adapts down. That is why a market can show a rate that looks high for its utilisation: it has been busy for a while.

Interest accrues continuously and is only written to storage when someone touches the market. A quiet market therefore shows totals that are behind — every number this site displays is replayed forward to now before it is shown, which is what the Lens contract is for.

The lender's rate is the borrower's rate times utilisation, less the performance fee. A market at 50% utilisation pays its lenders roughly half what its borrowers pay, because half the pool is idle.

A vault is an ERC-4626 that spreads one asset across several markets under caps. You deposit USDG, you get shares, the shares appreciate. You are not picking markets; the curator is, and the caps are the whole of that decision.

A cap can only be raised slowly. Raising one is submitted, then waits out the vault's timelock — 24 hours — before it can be accepted. Lowering a cap is immediate, because the safe direction should never be the slow one.

A guardian can veto during that window. The point of a timelock is that somebody independent can act inside it; without a guardian the only address that can revoke a pending change is the one that submitted it, which makes the delay a formality rather than a control.

A vault cannot invent a market. It can only allocate into markets that already exist on Morpho, and every one of them is visible on the market list with its own oracle, LLTV and cap.

The performance fee is 10% of interest earned, currently waived — 0% for the first 90 days. It is charged on yield, never on principal.

A deposit can be withdrawn as long as it is not lent out. When a market is fully used the rate climbs, which pulls in supply and pushes borrowers to repay — but until that works, part of your deposit is genuinely unavailable.

That is why every vault card shows withdrawable now next to total assets. It is the number to trust; the other one is what you own, not what you can take out this minute.

Each market carries a liquidation LTV fixed at creation: 86% for T-bills, 77% for ETH, 62.5% for megacaps and index ETFs, and 38.5% for anything long-tail or priced by TWAP.

The dangerous moment for a stock market is Monday's open, not the weekend itself. Nothing trades while the feed is still, so the LTV has to survive the gap when it moves again. Caps do the rest of the work: total exposure starts at $147.3K and only rises against measured exit depth.

Stocks and ETFs are priced by Chainlink through Morpho's own oracle factory, so there is no oracle code of ours in the path. Those feeds run 24/5: they hold their last print from Friday close to Monday open, roughly 65 hours, which is normal and not a fault to alarm on.

Long-tail tickers with no feed are priced by a Uniswap v3 TWAP over a 30–60 minute window, on a pool whose observation cardinality we raise first. Where both exist, the collateral takes the lower of the two — a borrower should never be flattered by the more generous source.

A short market inverts the usual pair: you post USDG as collateral and borrow the stock itself, then sell it. If the stock falls you buy it back cheaper and keep the difference. The debt is denominated in shares, so it grows when the stock rises — which is exactly the exposure a short is supposed to have.

The oracle is the long market's oracle turned upside down: one over the price, on the same 1e36 scale Morpho expects. That inversion is exact to the last digit — the token decimals cancel identically — and the one raw unit it rounds off goes to the protocol rather than to the borrower.

Shorts run at 62.5% rather than the 66.7% the risk model asked for, because 66.7% is not one of the values Morpho permits. That means 160% coverage instead of 150% — more conservative than intended, not less.

The practical limit on a short is not the LLTV but the borrow side: you can only short what somebody has supplied. A short market with no stock supplied has nothing to lend you, however much collateral you post.

Above the liquidation LTV, anyone may repay part of a debt and seize collateral at a bonus set by Morpho's formula — around 12.7% at the 62.5% tier. Our keeper does this on a flash loan and sells the collateral through the deepest route it can simulate, so the position closes near the market rather than into it.

Before that, there is a softer option. A borrower can authorise pre-liquidation: a partial unwind between 57.5% and 62.5% at a 2–4% penalty instead of the full incentive. It turns a Monday gap into a trimmed position rather than a closed one.

A hard liquidation takes a fixed premium out of the collateral the moment health falls below 1.0. Pre-liquidation is a softer path that starts earlier and takes less: it opens 5 percentage points before the LLTV, closes a growing share of the position as health deteriorates — from 20% up to 100% — at a premium that climbs from 2% to 4%.

It is opt-in per position and it does not replace liquidation; it gives a position a chance to be trimmed gently before the blunt instrument applies. A borrower who never opts in is treated exactly as before.

A liquidation that nobody performs is bad debt for the lenders. Morpho makes liquidation permissionless so anyone can do it, and on an established chain that is enough — searchers compete for the premium. On a new chain there may be nobody watching, so we run a keeper.

It reads every watched borrower's health directly from the chain on a loop, sizes the liquidation from the market's own oracle and premium, simulates it, and only then signs. A liquidation that would revert never leaves the machine, and a sale below the oracle floor is refused by the contract itself even if the keeper asked for it.

It is not the only liquidator and must not be. If it is offline, broken, or out of gas, the market still clears through anyone else who wants the premium. The failure mode is a slower liquidation, not an impossible one.

It reads an indexer for convenience but never depends on it: the chain scan runs every pass regardless, because an indexer that is behind answers cheerfully with a short list and a keeper that trusted it would report nothing to do.

Leverage in one transaction: flash-loan the loan asset, swap it into collateral, supply, borrow, repay the flash loan. The health factor and the liquidation price are computed before you sign, and the swap reverts if the pool has moved far enough from the oracle that the position would open at a bad price.

Behaviour is scored off chain from what the indexer already sees: how long positions stay healthy, whether they are topped up before trouble, how often they get liquidated. A good score buys a better rebate — never a higher LTV, because the LTV is what protects the lenders.

Season One counts size multiplied by time: a hundred dollars supplied for ten days and a thousand for one day are worth the same. They accrue while you do nothing, and they are counted off chain by the indexer.

There is no promised conversion rate, and that is deliberate. A season that names a price before there are earnings to pay it is making a promise out of money the protocol does not have yet.

A coin launched here is minted by Pons, not by us. Pons owns the token, the bonding curve and the tax; what this protocol owns is one decision — where that tax goes. The launcher picks a rate up to Pons's 10% cap, Pons charges its own 1% pair fee on top, and the rate is fixed at launch and changeable by nobody afterwards, including us.

The tax divides four ways. The largest share is supplied into one Cluby market as a lender and left there. Some buys the coin back on its own curve and burns it. Some goes to whoever launched it, and the rest funds the protocol. The exact shares are constants in the launchpad contract, and every page that quotes them reads them from that contract rather than keeping a copy — a page and a contract that each hold their own version of a number will eventually disagree, and this pair already did once.

The lent share is a one-way door. The launchpad's only withdrawal computes what may leave as the position minus the principal, so a keeper asking for more gets a revert rather than a smaller loan. No owner function reaches the principal at all. What the position earns is taken out and spent buying the coin, and the coins bought are destroyed — measured as the balance the wallet actually holds afterwards, not as whatever the purchase claimed to return.

The buy-back is deliberately not part of the split. Splitting is permissionless so the treasury never waits on a keeper, and a trade on a bonding curve with no slippage bound, callable by a stranger, is a sandwich waiting to happen. The burn share accrues instead, and a keeper spends it under a bound it computes.

What can go wrong

• A coin is not the stock it is named after. It owns no shares and tracks no price. It lends into one market, and what it earns is what that market's borrowers pay — nothing, if nobody borrows.
• The curve can be sold into. Pons owns the price. Burning shrinks the supply; it does not put a floor under it.
• A supply position can sit idle. Morpho pays lenders out of borrower interest and utilisation moves. A quiet market is a coin that stops burning.
• A coin here is not a Cluby market. Nothing about launching one makes it collateral, and a market against it would be a separate decision made against measured depth, like every other market.

An app that routes volume here appends its address as twenty bytes at the end of the call. Solidity ignores bytes past the arguments it expects, so it costs only calldata gas and changes nothing about how the transaction runs — no contract of ours sits in the path of your users' deposits to collect a statistic.

A suffix is a claim, not a proof: anyone can append any address to their own transaction. What is paid is settled against the registered list.

Morpho lends any asset it holds for the length of one transaction at zero fee. Call flashLoan(token, assets, data) on 0x9D53d5E3bd5E8d4Cbfa6DB1ca238AEA02E651010 and repay inside onMorphoFlashLoan. There is nothing to ask us for and no allowance to grant.

The site has no private data path. Every number on it comes from three public read endpoints, and they are the same ones you can use — not a subset, not a mirror, the identical call. If a figure here is wrong, the API is wrong the same way, which is the only version of a public API worth having.

Conventions. Money is a NUMBER in whole units, already scaled — totalSupplyUsd: 1250.5 means $1,250.50, not wei. Rates and ratios are fractions, so 0.0625 is 6.25%. Addresses are checksummed. A field that could not be read is null rather than zero, because a missing number and a zero are different facts and confusing them is how a dashboard lies. Every response carries updatedAt as a millisecond timestamp.

Caching. Responses are revalidated every 30 seconds. There is no key, no rate limit and no CORS restriction; if you need it more often than that, read the chain directly — the addresses are below and the SDK does exactly that.

Stability. Fields will be ADDED without warning. Nothing currently there will be removed or change meaning without a versioned path appearing first. Read defensively anyway: treat an unknown field as harmless and never index a response by position.

The SDK and MCP. The package the site runs on is the same code these endpoints call — market ids, the share and asset arithmetic Morpho uses, health factors and liquidation prices, and transaction builders. It is exposed over MCP as well, so an agent can read a position and build a transaction without driving a browser. Anything the site can compute, it can compute, because there is only one implementation of each of those things.

One fee, on one thing: 10% of the INTEREST a vault earns. Nothing is charged on a deposit, a withdrawal, a borrow, a repayment or a liquidation, and there is no flash-loan fee. If the vault earns nothing, we are paid nothing.

It is 0% for the first 90 days of a vault. A curator with no track record charging a full fee is asking to be paid for a service nobody has watched work yet.

Of what is collected, 75% goes to stakers and 25% to the treasury — audits, oracle coverage, keeper gas, and the first liquidity that makes a new market usable. Borrowers get 10% of the interest they paid back through a weekly epoch, and a builder who referred the volume gets 50% of the fee on it.

What Morpho charges is separate and currently zero on these markets. If its governance ever turns its own fee on, it comes out of the same interest, and this page will say so rather than quietly absorbing it.

A new market is empty, and both sides are waiting for the other. Three things exist so that waiting is not dead time.

Collateral needs no liquidity. supplyCollateral does not touch the lending pool, so a borrower can be in position before there is anything to borrow, owe nothing while they wait, and take it back whenever they like. When a lender arrives, borrowing is one transaction with no approval and no queue.

The demand is visible. Earn shows the value of collateral posted by accounts carrying no debt — people who have already paid gas to stand in the market. That is a better signal to a lender than a TVL number, because it cost something.

The exit is not locked. Earn leads with what is withdrawable this second against what is supplied, read off the vault. There is no lock, no notice period and no epoch; only utilisation can hold a withdrawal, and the rate climbs steeply as the pool empties, which is what pulls borrowers into repaying.

Every system has failure modes. These are ours, and what each one costs.

The keeper stops. Liquidations get slower, not impossible: Morpho's liquidation is open to anyone and the premium is the incentive. The keeper exists because a new chain may have nobody watching yet, not because it is the only path.

A feed goes stale. Stock feeds legitimately go quiet over a weekend, so the staleness limit is five days for a stock and one for crypto. Past that the market page marks the price stale and the watchdog alerts. A feed that stops entirely makes its market unborrowable rather than mispriced — reverting is the safe answer and it is the one Morpho gives.

A pool moves away from the oracle. The liquidator refuses to sell more than a set distance below the oracle price, so a pushed pool reverts the liquidation instead of handing the difference to whoever pushed it. The cost is a liquidation that waits; the alternative is one that pays an attacker.

The site or the indexer goes down. Neither holds anything. Every position can be managed by calling Morpho directly, and the addresses are listed below so that is a real option rather than a slogan.

We disappear. The markets stay. They are immutable, the collateral is in Morpho, liquidation is permissionless, and withdrawal needs nobody's permission. The worst case is that nobody curates any more — no new markets, no cap changes — not that anything is trapped.

What holds the money is not ours. Deposits, collateral, debt and liquidation all live in Morpho Blue, which is immutable and has been audited many times over. Our contracts are periphery: they hold nothing between transactions, and every path ends with the balance swept out. That is not a claim, it is the property that lets them be small enough to read.

What we can do. Choose which markets a vault lends into and the cap on each, set the performance fee up to the ceiling the vault was deployed with, and publish credit scores that change what a borrower is REBATED. None of those can move a deposit, and none of them can change what a borrower is allowed to borrow.

What nobody can do. Change a market's LLTV, oracle or interest model — they are fixed at creation. Pause withdrawals. Reach into a position. There is no upgrade path to these contracts because there is no proxy.

Review. The money path — the liquidator, the leverage router, the reader and the three oracles — has been through an adversarial review in which every finding had to be proved with a failing test or a precise mechanism, and every finding then had to survive an attempt to refute it. Fourteen defects were found and fixed; five claimed defects were refuted and are recorded as such. The report and what was done about each item are in the repository rather than summarised here, including the items still open.

Known open. Three long-tail markets are priced by TWAPs whose pools carry fewer observation slots than their window needs. All three are capped at zero with nothing supplied or borrowed, and the oracle now refuses to be constructed against a ring that short — but the existing three were created before that check, and growing their rings is a bill that has not been paid yet.

Everything below is on chain ID 4663. Click through and check.

The Lens, liquidator and router have each been replaced more than once. They are abandoned rather than upgraded when they change, precisely because none of them holds anything — replacing one costs a deployment and nothing else, and there is no proxy for anyone to seize.

Who holds my collateral? Morpho Blue. Cluby cannot move it.

What does Cluby earn? A 10% performance fee on interest, waived for the first 90 days of a vault. Borrowers get 10% of the interest they paid back through a weekly epoch.

Can a market be changed? No. LLTV, oracle and assets are fixed at creation. A better parameter means a new market, not an edit.

What is not built yet? Whatever the market pages mark as awaiting creation, plus staking and rebate contracts, which deploy after the first fee cycle.