01
A debt has no transfer
A position on Morpho belongs to an address and there is no function that hands it to another one. The only way a debt appears at a new address is if that address borrows.
Proved on chain: property 24
Live on Robinhood Chain
Flit
Move house, in one transaction.
You bought a hardware wallet. Or you think a seed phrase was photographed. Moving tokens is tedious — one transfer each — and moving a loan is not possible in the obvious way at all: collateral does not come out from under a debt, and a debt cannot be handed to another address. Flit moves the whole wallet in one transaction, loan included, without selling anything.
Tokens it moves
103
49 stocks, the dollar, ether and 52 vaults
Markets it reads
227
every Morpho market on the chain
Our contracts
0
Morpho's own, already live
One transaction, all or nothing
Nothing is sold, the loan stays open
The new wallet needs no gas
It must sign, so a mistyped address cannot receive
Why a loan cannot just be sent
Three rules that lock each other
None of these is a Flit rule. Each is how Morpho Blue actually behaves, and together they mean a borrower with no spare cash cannot change wallets at all.
02
Collateral will not come out
Morpho checks the position's health at the end of every withdrawal. While a dollar is still owed, the shares behind it do not move — so you cannot take them to the new wallet first.
Proved on chain: property 35, with a control
03
And the debt is repaid in dollars
Dollars you would have to find first — and if you had them spare you would not have borrowed. Selling the collateral to raise them is exactly the thing you did not want to do.
The alternative, priced: 0.93% of the book
The way out is a loan that lasts one call
Morpho Blue lends its own balance of any token for the length of a single transaction, free, on the condition that it comes back before the call ends. Flit borrows exactly your debt, repays your old position by shares so it is exact at the moment it runs, pulls the collateral out, pledges it for the new wallet, and borrows the same debt again in the new wallet's name — which the new wallet permits with a signature, and takes back with a second signature in the same transaction. Then the flash loan goes home. Your loose tokens cross under signed permits in the same call, and your ether rides along with it.
What moves
Everything the chain lets us carry
Read live from your wallet at one block: 103 tokens and every one of the 227 Morpho markets, whether or not anyone has ever used them.
| What | How it crosses | Signatures |
|---|---|---|
| Tokenized stock, dollars, wrapped ether, vault shares | transferred straight from the old wallet to the new one, under a signed permit | one each |
| Collateral with no debt against it | unpledged into the adapter and pledged again for the new wallet | none of its own |
| Collateral with a loan against it | a flash loan repays the debt, the collateral crosses, and the same debt is borrowed again in the new wallet's name | two from the new wallet |
| A lending deposit | the new wallet's deposit is made first, then the old one is withdrawn — so a market that is almost fully lent out can still be left | none of its own |
| Ether | sent with the transaction, keeping back enough to pay for it | none |
Not moved
Uniswap liquidity positions
A v3 or v4 position is an NFT, and moving one inside a bundle would mean signing a permit that names Bundler3 — a public contract — as its spender. If the bundle then reverted, that permit would sit in the open until it expired. Flit counts your positions, says so on the page, and leaves them to you.
Not moved
Anything outside the directory
Flit moves the tokens it can name from the chain: the stocks, the dollar, wrapped ether and the shares of vaults built by Morpho's own factory. A token nobody has heard of is not in that list, and Flit will not pretend to have seen it. Send those yourself.
What it costs
Gas, and nothing else
Flit charges nothing and takes nothing. The whole cost is the gas of one transaction, measured on a fork of this chain by actually sending it — not estimated.
A wallet of four stocks
$0.06
399,748 gas at the chain's current price. Four transfers done the ordinary way cost about $0.03 and take four confirmations.
A loan and its collateral
$0.08
499,918 gas: a flash loan, a repayment, a withdrawal, a pledge, a borrow and two authorisations, in one call.
The whole house
$0.17
1,099,853 gas for four tokens, a loan, bare collateral, a lending deposit and the ether — the book the suite moves in the fork test.
The other way round — selling everything, moving dollars, buying it all back — costs the round trip through the pools. Measured on 11 stocks at the block below, a $25,000 book pays a median of 0.93% to leave and come back, and the worst of them pays 3.1%. That is 1,375 times the gas Flit spends, and it is the smaller half of the argument: the loan would have been closed and re-opened at whatever rate the market offered by then.
The honest part
Not every wallet can move today
Every address that has ever held a Morpho position on this chain, read at one block and run through Flit's own planner as if it were moving to a fresh wallet. This is the result, refusals and all.
Hold something right now
813
of 1,323 addresses that ever did. 519 of them owe money against collateral.
Could move it all today
788
planned end to end with no refusal, including 499 of the wallets that owe money.
Could not
25
9 because the loan is at its limit, 7 because the market they borrowed from is lent out, 6 because the flash loan would be bigger than Morpho holds, 2 because the price feed is not answering, 1 because a deposit cannot be withdrawn right now.
The commonest refusal is not ours either: a Morpho market that is lent out to the last dollar cannot lend the new wallet the money to re-open the loan, and cannot let a depositor withdraw. Flit says which market and how much is free, before you sign anything.
The one risk
What we would want told to us
Moving a loan needs the new wallet to let Morpho's Bundler3 borrow in its name for the length of one call. Bundler3 is a public contract, so that permission is dangerous while it stands — and this is how Flit handles it.
The danger
A standing permission is an open door
Anyone at all can call Bundler3. While your new wallet authorises it, anyone can make it borrow against that wallet's collateral and keep the money. We proved that in the suite, by doing it: a stranger borrowed $50.00 against an exposed wallet through Bundler3, in one ordinary transaction.
What Flit does
Granted and revoked in the same call
You sign two Morpho authorisations on consecutive nonces — one to grant, one to revoke — and both are inside the transaction, either side of the borrow. When the block ends, the permission is gone. The suite asserts that afterwards, every time.
And the part that is still true
If the transaction reverts, its calldata is public and the grant signature could be replayed by anyone until it expires — 20 minutes after you signed. The revocation you already signed remains valid on the next nonce, so it can be sent straight after; the app checks both wallets' authorisations after any failure and offers to send it. A new wallet with nothing in it is not worth borrowing against, which is why Flit refuses a destination that already has Bundler3 authorised rather than treating it as a convenience. This is the sharpest edge in the design, and it is here rather than in a footnote.
Proof
What has actually been checked
Flit is not audited, and nothing on this page should be read as saying it is. What follows is what was run, and what it found.
45/45
Properties, on the real chain
Each one executed by an eth_call with no to on Robinhood Chain itself — real creation code on the real evaluator, costing nothing and leaving nothing behind. Every refusal has a control proving the same call goes through when the guard is not in the way.
node tools/props.mjs --props26/26
Deliberate bugs in the Solidity, caught
The model recompiled with one defect at a time, each named for the property that must notice. Six survived the first sweep; those were six holes in the properties, and the properties that close them are in the count above.
node tools/props.mjs --sabotage15/15
The planner, and a fuzz
The page's own modules planning moves and building their calldata, executed against a model of Morpho that refuses the way Morpho refuses. Includes a 120-draw fuzz over random books, with random time passing and strangers trading in between: 66 moved, 21 refused — and every refusal forced through afterwards, to check the chain refuses it too.
node tools/test-plan.mjs19/19
Deliberate bugs in the JavaScript, caught
One bug at a time in the planner or the transaction builder, each of which must be caught by the check named for it. Two are declared unobservable, with the measurement that says so.
node tools/sabotage.mjs40/40
Real moves, on a fork
Books built on a fork of this chain with the owner's own calls, then moved: the loan repaid and re-opened, the collateral re-pledged, the tokens across, the permissions revoked. Every guard has a control, and every revert is classified by its selector rather than counted as a pass.
node tools/test-move.mjs103/103
Tokens that really accept a permit
Every token Flit lists, asked on the live chain whether it accepts a permit signed with the domain the scanner found — executed, not inferred from a matching hash. Three controls must be refused, and are.
node tools/test-permits.mjs21/21
The app, clicked through
The real page in a real browser against a fork: connect, read the book, name a destination, sign every signature, send, and check both wallets afterwards.
node tools/e2e.mjsEvery one of these is a command in the repository, and every sweep carries a control that must fail. A validator that stopped validating looks exactly like a clean build.
Limits
What Flit does not do
It does not rescue a stolen wallet
If somebody else already has your key, they can send transactions too — including ahead of yours. Flit is for a wallet you still control and want to leave behind, not for a race against a thief.
It does not move what it cannot name
Uniswap liquidity positions, NFTs, tokens outside the directory and anything on another chain stay where they are. The app counts what it found and says so.
It cannot move a loan a market will not re-lend
Re-opening the loan means borrowing from the same market again. If that market has been lent out to the last dollar since you borrowed, nobody can do it — Flit says which market, and how much it has.
Questions
Straight answers
Do I have to trust a contract you wrote?
No, because there isn't one. Flit deploys nothing. The transaction your wallet signs is one call to Morpho's own Bundler3, which was live on this chain before Flit existed. What Flit contributes is the plan: which calls, in which order, for how much.
Is anything sold?
No. Not a share, not a dollar. The collateral is unpledged and pledged again; the loan is repaid and re-opened at the same size; the tokens are transferred. No pool is touched and no price is paid.
Does the new wallet need ether?
No. It signs, and the old wallet sends and pays. Flit also sends the old wallet's ether across, keeping back enough to cover the transaction itself.
What if I mistype the destination?
You cannot: the new wallet has to sign before anything is built, and a signature cannot be produced for an address you do not control. That is the whole reason the proof signature exists.
What does it cost?
Gas, and nothing else. A wallet of four stocks costs about $0.06; one with a loan in it about $0.08. Flit takes nothing and has no fee to take.
Can I move only part of it?
Yes. Every holding and every position has a switch. What Flit will not do is move collateral out from under a debt it is leaving behind, because that is a position anyone may then liquidate — the chain refuses it too.
What happens to my loan's interest rate?
Nothing: it is the same market, with the same rate curve, and the new wallet's debt is the old one to within a rounding unit. What you lose is the position's history, which Morpho does not keep anyway.
Is this audited?
No. Flit has not been audited and nothing here should be read as saying it is. What has been done is on this page, with the command to reproduce each of it, and the contracts Flit calls are Morpho's own.
Take it all with you.
Connecting a wallet reads everything it holds and plans the move. Nothing is sent until you sign, Flit holds nothing, and the new wallet needs no ether of its own.