Morpho Omnimarket contracts

The Omnimarkets periphery creates Morpho markets containing Omniassets, assembles reviewed markets into Morpho Vault V2 deployments, and lets an incoming Omniasset become collateral before USDC is borrowed on Base.

These contracts are separate from the non-upgradeable Omnisea bridge and from Morpho itself:

MorphoOmnimarketFactory
MorphoOmnivaultDeployer
OmnilinkMorphoOracle        optional
OmniMorphoBorrowComposer

Live Base deployments

The factory and vault deployer are permissionless helpers. The composer owner is the Base Safe at 0xaA51…37d8.

MorphoOmnimarketFactory

The factory accepts Morpho's canonical five market parameters and installs permanent dead shares in the same transaction:

struct MorphoMarketParams {
    address loanToken;
    address collateralToken;
    address oracle;
    address irm;
    uint256 lltv;
}

function createMorphoOmnimarket(
    MorphoMarketParams calldata marketParams,
    uint256 maxSeedAssets
) external returns (bytes32 marketId, uint256 seedAssets);

Omniasset identity

At least one of loanToken or collateralToken must be a real representation registered by the configured local Omnisea contract.

The factory reads the representation's bridge and complete original identity, then resolves that identity through representationFor. A contract cannot qualify by copying Omniasset getter names while remaining absent from the Registry.

The check is role-neutral and origin-neutral. It supports Omniasset collateral, Omniasset loans, two Omniassets, and every origin identity supported by the local bridge.

Market checks

Before calling Morpho, the factory verifies that:

• both tokens, the oracle, and IRM have code;
• loan and collateral tokens differ;
• at least one token passes the registered Omniasset check;
• oracle.price() currently returns a nonzero value;
• Morpho has enabled the selected IRM and LLTV.

These are structural checks. They do not validate oracle scale, update policy, manipulation resistance, redemption assumptions, or liquidation liquidity.

Atomic dead deposit

The factory creates the market and supplies exactly 1e9 shares on behalf of 0x000000000000000000000000000000000000dEaD. The caller transfers at most maxSeedAssets; any unused loan token is returned.

If market creation, token transfer, exact share supply, or refund fails, the complete transaction reverts. The factory rejects fee-on-transfer behavior during seeding and keeps no loan-token balance after success.

MorphoOmnimarketCreated records the immutable parameters, creator, oracle, and dead deposit. The event does not make a market verified in the Omnisea app.

MorphoOmnivaultDeployer

MorphoOmnivaultDeployer atomically creates and configures one Morpho Vault V2. It is temporary owner, curator, and allocator only while deployOmnivault executes. It retains no role and no user assets after success.

The deployment configuration defines:

• the ERC-4626 deposit asset, vault name, and symbol;
• final owner, curator, allocator, sentinel, and fee recipients;
• performance and management fees;
• the Morpho adapter and per-collateral and per-market caps;
• the liquidity market, maximum rate, and timelocks;
• permanent dead vault shares;
• optional abdication of adapter-registry and critical gate selectors.

Every configured market must use the vault's deposit asset as its loan token, use the canonical Adaptive Curve IRM, expose a live nonzero oracle price, already exist on Morpho, and contain at least the factory's permanent dead shares.

The helper does not itself prove that a market came from MorphoOmnimarketFactory. Omnisea's verified product policy only publishes vaults composed from reviewed Omnimarkets; the underlying deployer remains permissionless.

OmnilinkMorphoOracle

OmnilinkMorphoOracle remains available for markets that need authenticated source-chain NAV and loan-price reads. It is ownerless and has immutable source identities, freshness bounds, decimals, price bounds, and haircut.

It derives complete Omnilink read IDs, validates typed snapshots, and returns the collateral-to-loan ratio using Morpho's 1e36 convention. A stale, mismatched, invalid, or out-of-bounds observation makes price() revert.

The live BNB Core markets do not use Omnilink. They use local Base Chainlink oracles created through Morpho's Chainlink oracle factory.

OmniMorphoBorrowComposer

The Base composer is a generic financial lzCompose receiver with immutable dependencies:

constructor(
    address endpoint,
    address router,
    address morpho,
    address loanToken,
    address initialFeeRecipient,
    uint16 initialFeeBps,
    address initialOwner
)

Its loan token is permanently Base USDC. One composer can accept any arriving collateral representation and any existing Morpho market whose collateral token equals that representation and whose loan token equals the immutable USDC address.

The contract does not whitelist only Omnisea-verified markets. The public web interface supplies only the two reviewed BNB Core configurations.

Borrow request

Each composed payload binds:

• request version and deadline;
• authorization mode;
• all five immutable Morpho market parameters;
• exact USDC borrow amount;
• the maximum success fee accepted by the borrower;
• a caller-selected maximum LTV below the market LLTV;
• USDC receiver and refund recipient;
• optional signed Morpho authorization and revocation.

The authenticated source sender becomes onBehalf for both supplyCollateral and borrow. The composer never owns the resulting Morpho position.

Authorization modes

PreAuthorized requires the borrower to have already authorized the composer in Morpho.

Temporary consumes two sequential EIP-712 authorizations: enable the composer, then revoke it. Supply, borrow, maximum-LTV enforcement, and revocation execute within one isolated self-call. Any failure rolls all Morpho effects back before the refund path runs.

If the enable signature was permissionlessly submitted before composition, the composer recognizes the consumed nonce and still requires the matching revocation to be next.

Success and failure

On success, Morpho holds the collateral and debt in the borrower's position and sends the exact requested USDC to the composer. The composer deducts its current success fee and sends the remainder to usdcReceiver. The initial fee is 5 bps, it is charged only after success, and the immutable maximum is 20 bps.

Each request includes maxFeeBps. If the configured fee rises above the amount accepted before the message reaches Base, execution rolls back and the collateral follows the normal refund path. If the fee decreases, the lower fee is used. MorphoBorrowSucceeded reports both the gross borrow and the fee and receiver amounts.

On a malformed request, expired deadline, missing market, failed authorization, failed supply or borrow, oracle failure, maximum-LTV breach, or insufficient execution gas, the composer attempts to transfer the exact arriving Omniasset to refundRecipient on Base.

If that token transfer fails, it records a PendingRefund by GUID with one beneficiary, token, and amount. Liabilities are tracked both per beneficiary and in aggregate:

mapping(address beneficiary => mapping(address token => uint256 amount))
    public pendingRefundLiability;

mapping(address token => uint256 amount)
    public totalPendingRefundLiability;

Only the recorded beneficiary can call:

function claimPendingRefund(bytes32 guid, address recipient) external;

The beneficiary may choose a different destination recipient. Duplicate GUIDs cannot execute twice.

Owner recovery

The owner can update the success fee within the immutable 20 bps ceiling and change its nonzero recipient. It can recover an accidental ERC-20 balance only above totalPendingRefundLiability[token]; it cannot withdraw any amount reserved for a pending user refund. Native value is not used by this composer and can be recovered by the owner.

Live BNB Core configuration

The BNB Core Omnivault is at 0x909EE8E52f1ceE405cF973F5c854b32BB976ca50. Its Morpho adapter is 0x9548…7Ba2. It charges a 10% performance fee, no management fee, and is owned and curated by the Base Safe.

Deployment tooling

The reusable bundle script reads config/omnimarkets/bnb-core-base.json, validates every dependency and assumption, deploys missing infrastructure, creates the two oracles and markets, creates and hardens the vault, verifies final state, and writes one resumable artifact:

DRY_RUN=true npm run deploy:omnimarket-bundle:base
npm run deploy:omnimarket-bundle:base

The borrow composer is deployed separately with CREATE3:

DRY_RUN=true npm run deploy:morpho-borrow-composer:base
npm run deploy:morpho-borrow-composer:base

Read Deployments for transaction-linked addresses and Borrow USDC cross-chain for the complete flow.