Is Earn safe? Security and audits
How Earn is secured and how to report a vulnerability.
Quicknode Earn is non-custodial. Your vault shares sit in your own wallet, and OpenZeppelin audited the Earn contract that moves them.
Third-party risk
The Morpho vaults are listed by Morpho and each is curated by a separate team. They carry their own smart-contract risk, the risk of bad debt, and curation risk. Earn does not remove that risk, and Quicknode does not re-audit Morpho code. See Is a Morpho vault safe?.
Audit reports
What's covered
The audit covers the deposit, withdraw, rebalance, and bridge entry points of the deployed contract, plus the role and permission model.
Earn's off-chain services, which Quicknode operates, are outside the audit scope. The audit treats them as trusted operators. The contract bounds where funds can move, not every choice the services make.
What Earn's services cannot do
The contract enforces these boundaries on-chain, whoever operates the services:
- They can deposit only into vaults on the approved set. An off-list vault is rejected on-chain.
- They can move funds only between approved vaults or back to your wallet, and withhold the rebalance fee only as vault shares.
- They cannot change the approved vault set or the role assignments. The owner multisig governs those.
- They cannot sign for you. Deposits, Increase and Reduce, and closes are your own transactions.
- They cannot stop you from leaving. If a service goes offline, your funds stay in your last vault and you can close the strategy yourself, or redeem your shares directly on Morpho. See Your shares.
- They cannot hold funds mid-bridge. An exit leg in transit mints straight to your wallet. An inbound deposit leg stuck for 30 minutes is claimable by your wallet alone. See If a bridge stalls.
Revoking an approval does not strand a position either. The close flow prompts you to re-approve what it needs. See Approvals and signatures.
Known limitations
- The owner multisig can upgrade the contracts, and owner actions take effect at once. There is no timelock.
- The executor, the contract role Earn's services use to rebalance, sets each rebalance fee amount. The contract does not cap it. The fee model is enforced operationally.
- A compromised owner key or executor key is therefore the residual trust assumption. The audit documents it.
- Some supported chains run a single sequencer, the one service that orders their transactions. Sequencer downtime delays rebalances and bridges. Funds stay in the vaults.
- Bridge times get longer if Circle's Iris, the service that attests each burn, is slow.
Reporting a vulnerability
Email security@quicknode.com. Do not file a public GitHub issue. Include a description, impact, and reproduction steps. We aim to acknowledge reports within 48 hours.