Morpho Earn - earn safe yield on your USDC on Base

Earn yield on USDC by supplying to the Moonwell Flagship USDC vault on Morpho (Base). Use when depositing USDC, withdrawing from the vault, checking position/APY, or setting up wallet credentials for DeFi yield.

Security Scan

The skill mostly does what its description says (manage a wallet, claim rewards, swap via an on‑chain aggregator and deposit to a vault) but there are a few coherence and risk signals you should understand before installing and giving it access to any private key or automation.

Purpose & Capability

The skill's code and instructions align with the stated purpose: it reads wallet balances, claims Merkl-distributed rewards, swaps them via Odos, and deposits into the Moonwell/Morpho vault on Base. There's no request for unrelated cloud credentials or services. Minor mismatch: SKILL metadata only lists 'node' as a required binary, yet the README and setup mention optional 1Password integration (which requires the 'op' CLI) and environment-variable wallet sources.

Instruction Scope

Runtime instructions and scripts will load private keys (from a file, env var, or 1Password), write config/preferences to ~/.config/morpho-yield/, and optionally append a HEARTBEAT.md entry under ~/clawd/HEARTBEAT.md. The scripts call external HTTP APIs (Merkl, Odos, CoinGecko, and an RPC) and will assemble and submit transactions returned or suggested by those services. Executing transactions created or assembled by remote services (Odos 'assemble' endpoint) means a compromised remote service or manipulated response could cause undesired on-chain transactions — this is expected behavior for an auto‑compound script but is a noteworthy operational risk.

Install Mechanism

There is no remote installer that downloads arbitrary binaries from unknown hosts. The project is Node/TypeScript based and uses npm packages (viem, tsx etc.) from the public registry — typical for this kind of project. No unusual download URLs or extract/install steps were observed in the provided files.

Credentials

The skill does not declare required env vars in registry metadata, which is reasonable because wallet configuration is optional/interactive. However the scripts support reading a private key from an environment variable (e.g. MORPHO_PRIVATE_KEY) and 1Password integration (requires 'op' CLI) — these are not declared as required. The requested secrets (private key) are proportional to the stated functionality, but they are highly sensitive and the user must supply them. Ensure you only use a dedicated hot wallet with limited funds.

Persistence & Privilege

always is false and the skill does not request system-wide privileges. It writes its own config (~/.config/morpho-yield/) and can optionally modify ~/clawd/HEARTBEAT.md; that is reasonable for the stated monitoring integration. Important: if you enable autoCompound and allow the agent to invoke skills autonomously, the agent will be able to sign and submit transactions from the configured wallet (autonomous execution combined with wallet access increases blast radius).

What to consider before installing

This skill appears to implement the described Morpho/Moonwell automation, but it operates on real funds and relies on external services to construct and sign transactions. Before installing: - Review the code (especially scripts/config.ts, simulateAndWrite/verifyContracts, and the Odos assemble usage) to ensure they do exactly what you expect. - Use a dedicated hot wallet with only a small amount of USDC/ETH for testing — never your main wallet. - Test read-only commands first (status.ts, report.ts) before running any claim/compound operations. - If you plan to use 1Password integration, ensure the 'op' CLI is available (the skill doesn’t declare it). - Understand that the Odos assemble/quote endpoints return transaction payloads your wallet will sign — if Odos or the network between you and Odos is compromised it could return malicious tx data. Consider replacing or verifying aggregator responses locally where possible. - Verify the RPC endpoints (default is moonwell's RPC) and prefer your own trusted RPC provider. - If you want lower risk, disable autoCompound and require manual approval for claim/swap/deposit actions. If you want, I can: (1) point to the exact lines/functions to audit (simulateAndWrite, assembleOdosTransaction, verifyContracts), (2) summarize where private keys are read and stored, or (3) produce a short checklist to harden usage (file perms, environment variables, manual approval).

Morpho Earn — Earn safe yield on your USDC

Earn yield on USDC via the Moonwell Flagship USDC vault on Base (Morpho protocol).

Vault: 0xc1256Ae5FF1cf2719D4937adb3bbCCab2E00A2Ca Chain: Base (8453) Asset: USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)

Why This Vault?

The Moonwell Flagship USDC vault is one of the safest places to earn yield on Base:

• Powers Coinbase — Provides $20M+ liquidity to Coinbase's BTC/ETH borrow products
• Blue-chip collateral only — Loans backed by ETH, cbETH, wstETH, cbBTC
• Conservative LTV ratios — Healthy collateral requirements
• Isolated markets — Risk is compartmentalized
• No rehypothecation — Your USDC isn't lent recursively
• Battle-tested — Morpho's codebase is <650 lines, immutable, extensively audited
• Multi-layer governance — Moonwell DAO + Block Analitica/B.Protocol curators + Security Council

Current APY (~4.5-5%)

Component	APY	Source
Base yield	~4%	Borrower interest
Rewards	~0.5-1%	WELL + MORPHO via Merkl
Total	~4.5-5%	Sustainable, from real demand

Yields come from real borrowing demand, not unsustainable emissions. Check current APY with npx tsx status.ts.

Quick Start

cd ~/clawd/skills/morpho-yield/scripts
npm install
npx tsx setup.ts

The setup wizard will:

1. Configure your wallet (private key file, env var, or 1Password)
2. Ask your notification preferences (daily/weekly reports)
3. Set compound threshold and auto-compound preference
4. Add monitoring to HEARTBEAT.md automatically

Commands

Interactive Setup

npx tsx setup.ts

Guides you through wallet configuration and preferences.

Check Position & APY

npx tsx status.ts

Returns: current deposit, vault shares, APY, wallet balances.

Generate Report

# Telegram/Discord format (default)
npx tsx report.ts

# JSON format (for automation)
npx tsx report.ts --json

# Plain text
npx tsx report.ts --plain

Beautiful formatted report showing position, rewards, and estimated earnings.

Deposit USDC

npx tsx deposit.ts <amount>
# Example: deposit 100 USDC
npx tsx deposit.ts 100

Deposits USDC into the Moonwell vault. Requires sufficient USDC balance and gas (ETH on Base).

Withdraw

# Withdraw specific amount of USDC
npx tsx withdraw.ts <amount>

# Withdraw all (redeem all shares)
npx tsx withdraw.ts all

Check Rewards

npx tsx rewards.ts

Returns: claimable MORPHO, WELL, and other reward tokens from Merkl.

Claim Rewards

npx tsx rewards.ts claim

Claims all pending rewards from Merkl distributor to your wallet.

Auto-Compound

npx tsx compound.ts

All-in-one command that:

1. Claims any pending rewards from Merkl
2. Swaps reward tokens (MORPHO, WELL) to USDC via Odos aggregator
3. Deposits the USDC back into the vault

Heartbeat Integration

After setup, your agent monitors the position based on deposit size:

Deposit Size	Compound Check	Rationale
$10,000+	Daily	Large positions accumulate meaningful rewards quickly
$1,000-$10,000	Every 3 days	Balance between gas costs and reward accumulation
$100-$1,000	Weekly	Small rewards need time to exceed gas costs
<$100	Bi-weekly	Minimal positions, compound only when worthwhile

The agent will:

• Check reward balances at the appropriate frequency
• Compound when rewards exceed your threshold (default: $0.50)
• Send position reports (daily/weekly based on preference)
• Alert you if gas is running low

Configuration

Config location: ~/.config/morpho-yield/config.json

{
  "wallet": {
    "source": "file",
    "path": "~/.clawd/vault/morpho.key"
  },
  "rpc": "https://rpc.moonwell.fi/main/evm/8453"
}

Preferences: ~/.config/morpho-yield/preferences.json

{
  "reportFrequency": "weekly",
  "compoundThreshold": 0.50,
  "autoCompound": true
}

Security

⚠️ This skill manages real funds. Review carefully:

• Private keys loaded at runtime from your chosen source
• Keys never logged or written to disk by scripts
• All transactions simulated before execution
• Contract addresses verified on each run
• Scripts show transaction preview before sending

Recommended Setup

1. Dedicated wallet — Create a hot wallet just for this skill
2. Limited funds — Only deposit what you're comfortable having in a hot wallet
3. Secure key storage — Use encrypted file or 1Password
4. Monitor activity — Periodically check wallet transactions
5. Keep gas funded — Maintain small ETH balance on Base for transactions

Rewards

The vault earns rewards beyond base APY via Merkl:

• WELL — Moonwell governance token incentives
• MORPHO — Morpho protocol incentives

Rewards update approximately every 8 hours. The compound.ts script handles:

1. Claiming rewards from Merkl distributor
2. Swapping tokens to USDC via Odos aggregator
3. Depositing USDC back into the vault

Error Handling

Error	Cause	Fix
Insufficient USDC	Not enough USDC in wallet	Bridge/transfer more USDC to Base
Insufficient gas	Not enough ETH for tx	Add ETH to wallet on Base
Wallet not configured	Missing config	Run npx tsx setup.ts
RPC error	Network issues	Check RPC URL or try again
Swap reverted	Gas underestimate	Script auto-adds 50% buffer

Dependencies

Scripts require Node.js 18+. Install deps before first run:

cd scripts && npm install

Packages used:

• viem — Ethereum interaction
• tsx — TypeScript execution