Skip to main content

Security and audits

TL;DR​

  • Your USDC lives inside approved Morpho vaults, never in a Quicknode wallet.
  • The Earn contracts are audited (reports below).
  • Earn can only move funds between vaults the protocol has approved on-chain, or back to your wallet.

Audit reports​

What's covered​

The Earn contracts (QuicknodeEarn and QuicknodeEarnProxy) are audited. Coverage includes deposit, withdraw, rebalance, and bridge entry points, plus the role and permission model.

Morpho vaults are listed by Morpho and curated independently; Quicknode does not re-audit Morpho code. See morpho.org.

Earn's off-chain services are outside the smart-contract audit scope. The audit treats them as trusted operators; the contract bounds where funds can move, not every choice they make.

What Earn's services cannot do​

The Earn contract enforces these boundaries on-chain regardless of who operates the services:

  • They can only deposit into vaults on the approved set; off-list vaults are rejected on-chain.
  • Funds can only move between approved vaults, back to your wallet, or to the Earn contract as rebalance fees.
  • They cannot change the approved vault set or role assignments. Those are governed by the owner multi-sig.
  • They cannot sign on your behalf. Deposits and closes are your transactions.
  • If a service goes offline, your funds stay in your last vault position and you can close yourself. Funds mid-bridge stay claimable directly by your wallet via the emergency claim; see Cross-chain bridging.

Reporting a vulnerability​

Email security@quicknode.com. Do not file a public GitHub issue. Include a description, impact, and reproduction steps. We aim to acknowledge reports within 48 hours.

Known limitations​

  • A vulnerability in an approved Morpho vault would affect users in that vault.
  • The contracts are upgradeable by the owner multi-sig, and rebalance fee amounts are set by the executor rather than capped on-chain. A compromised owner or executor key is therefore the residual trust assumption; the audit documents it and the fee model is enforced operationally.
  • Some supported chains run a single sequencer. Sequencer downtime delays rebalances and bridges; funds remain safe in the vaults.
  • Earn's off-chain services are operated by Quicknode. If they go offline, rebalances pause but you can always close yourself.
  • Cross-chain bridges rely on Circle's CCTP v2. Times can extend if Circle's Iris is degraded.