Earn combines audited smart contracts with on-chain restrictions that limit where its services can move funds. This page explains the audit scope, the boundaries enforced by the contracts, and the remaining trust assumptions.
- Funds remain in approved vaults. Your USDC is deposited into approved Morpho vaults rather than a Quicknode wallet.
- Earn's contracts are audited. The available OpenZeppelin report is linked below.
- Movement is restricted on-chain. Earn services can move funds only between approved vaults, back to your wallet, or to the Earn contract as rebalance fees.
- Some dependencies remain outside the audit. Morpho vault code and Earn's off-chain services are not covered by the Earn smart-contract audit.
Audit reports
What's covered
The smart-contract audit covers QuicknodeEarn and QuicknodeEarnProxy. Its scope includes:
- Deposit and withdrawal entry points
- Rebalance entry points
- Bridge entry points
- Roles and permissions
Morpho vaults are listed by Morpho and curated independently. Quicknode does not re-audit Morpho's code. See morpho.org.
Earn's off-chain services also fall outside the smart-contract audit. The audit treats those services as trusted operators, while the contracts restrict the destinations to which they can move funds.
What Earn's services cannot do
The Earn contract enforces the following boundaries regardless of who operates its off-chain services:
- Approved vaults only — Deposits into vaults outside the approved set are rejected on-chain.
- Restricted fund destinations — Funds can move between approved vaults, return to your wallet, or enter the Earn contract as rebalance fees.
- Owner-controlled configuration — Earn services cannot change the approved vault set or role assignments; the owner multi-sig governs them.
- No signatures on your behalf — Your wallet submits deposit and close transactions.
If an Earn service goes offline, your funds remain in their latest vault positions and you can close the strategy yourself. Funds already moving between chains remain claimable by the owner wallet through the emergency-claim flow described in Cross-chain bridging.
Known limitations
Review these remaining risks and operational dependencies before using Earn:
- Morpho vault risk — A vulnerability in an approved Morpho vault would affect users holding shares in that vault.
- Owner and executor keys — The owner multi-sig can upgrade the contracts, while the executor sets rebalance fee amounts without an on-chain cap. The audit documents these residual trust assumptions, and the fee model is enforced operationally.
- Sequencer availability — Some supported chains use a single sequencer. Downtime can delay rebalances and bridges while funds remain in their vaults.
- Quicknode service availability — If Earn's off-chain services become unavailable, automatic rebalancing pauses, but you can still close the strategy.
- Circle availability — Cross-chain transfers depend on Circle's CCTP v2 and may take longer when Circle's Iris service is degraded.
Reporting a vulnerability
Email security@quicknode.com and do not open a public GitHub issue. Include the vulnerability description, its impact, and steps to reproduce it. Quicknode aims to acknowledge reports within 48 hours.