--- name: vault-scanner description: "Inspect supported DeFi vaults and their reachable markets for documented configuration risks. Use when given a vault address or market identifier to review." --- # Vault scanner vaults.rip supplies operational checks for configuration risks that may not be covered by a protocol's own documentation. `/llms.txt` is the scanner entrypoint. `/SKILL.md` and `/skills.md` redirect to it. ## Job Given a chain and vault address, identify the vault's current and permitted exposures, resolve the contracts behind them, and apply every relevant check in this repository. Do not describe a vault as safe merely because no listed check produces a finding. Distinguish a condition that was checked from one that could not be resolved. ## Required input - Chain ID - Vault contract address - Optional block number when the review must describe historical rather than current state A protocol-specific market identifier may be used to inspect a market directly, but it is not enough to determine which vaults can allocate to that market. Before scanning, identify the read-only RPC URLs and explorer credentials required by the applicable checks. Inspect the current process environment and, when working from a local checkout, the available `.env` files and `.env.example`. Check variable names and whether values are present without printing, logging or otherwise exposing secret values. Use a user-supplied or official public RPC when a configured RPC URL is unavailable. Verified-source retrieval through Etherscan requires `ETHERSCAN_API_KEY`; if it is unavailable, ask for it to be supplied through the environment. Continue checks that do not depend on it and report affected checks as unresolved rather than treating missing access as a finding or a pass. ## Procedure 1. Identify the target protocol and vault implementation. 2. Find the matching protocol section below and run every check it contains against every relevant component. 3. Report unresolved contracts, unsupported adapters, missing source code, and incomplete enumeration rather than silently omitting them. 4. When more context would help explain a finding, consult the specific cases linked from that check. Cases provide supporting examples and are not additional review targets. ## Check list The generated `/llms.txt` appends each supported protocol procedure and every current check below. Read the relevant protocol section and run each listed check; links to source files are provenance, not substitutes for the instructions in this document. The same checks are available in the [human-readable check list](https://www.vaults.rip/checks/). ## Output Return a short report in this shape: ```text Target: on Checks run: Violations found: Warnings found: Checks unresolved: Findings - — : — <concise reason> ``` A violation means the check's issue condition was established. A warning means the available evidence is concerning but not conclusive. Do not count an unresolved check as passed. When useful, include the related case links already attached to a violated, warned or unresolved check as additional context. --- name: morpho-v2-vault-scanner description: "Apply vaults.rip configuration-risk checks to a Morpho Vault V2 after resolving its structure with Morpho's official documentation. Use only for Morpho Vault V2 reviews." --- # Morpho Vault V2 ## Scope This procedure supports Morpho Vault V2 only. If the target is Vault V1 or cannot be identified, return to the root skill's unsupported-target rule. Morpho maintains the protocol mechanics, contract interfaces, addresses, APIs and SDK guidance. Do not reproduce them here. ## Read Morpho Start at [Morpho's `llms.txt`](https://docs.morpho.org/llms.txt). Select the pages needed to identify the vault and retrieve its current configuration, then fetch their raw Markdown versions by appending `.md` to the documentation URL. Use [Morpho's full documentation corpus](https://docs.morpho.org/llms-full.txt) only when the targeted pages do not provide enough context. Do not copy protocol interfaces, addresses or API schemas into this skill. Do not connect Morpho's MCP server or prepare a transaction unless the user has requested or authorized that action. The public documentation is sufficient for ordinary scanning. ## Resolve the review surface Using Morpho's maintained procedure and data sources: 1. Confirm the chain and that the target address is a Morpho Vault V2. 2. Resolve every current allocation and every destination permitted by a non-zero cap, including nested vault or adapter exposure. 3. Resolve each reachable market's loan asset, collateral asset, oracle, interest-rate model and LLTV. 4. Include pending changes that would materially alter the reachable exposure when Morpho's current data sources expose them. 5. Record any adapter, market, cap or dependency that cannot be resolved. Do not silently discard an unfamiliar adapter or substitute Vault V1 behavior. If the input is only a market ID, apply the market checks but do not infer which vaults can allocate to it. ## Apply vaults.rip Morpho explains what the configuration is. vaults.rip checks what may be dangerous about it. For every applicable resolved component: - Run every check appended to this skill. In the source repository, those checks live under [`content/checks/morpho-v2/`](https://github.com/jordaniza/vaults.rip/tree/main/content/checks/morpho-v2). - Use the [smart-contract inspection skill](https://www.vaults.rip/skills/smart-contracts/SKILL.md) when a check depends on arbitrary contract behavior, control or upgradeability. - Use the [Etherscan skill](https://www.vaults.rip/skills/etherscan/SKILL.md) when verified source or proxy resolution is needed. Tests are not required. A linked Foundry test may be used when it helps illustrate a check, but its result does not replace inspection of the target's deployed configuration. ## References - [Morpho documentation index](https://docs.morpho.org/llms.txt) - [Morpho full documentation corpus](https://docs.morpho.org/llms-full.txt) ## Checks The generated copy of this skill and [`/llms.txt`](https://www.vaults.rip/llms.txt) append every current Morpho V2 check below. If this source file is being read directly, use the [human-readable check list](https://www.vaults.rip/checks/#protocol-morpho-v2) or load `/llms.txt` before starting the review. ### Oracles #### Retrieve verified oracle source Check ID: morpho-v2-oracles-1 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/oracles/verified-source.md For every market the vault currently uses or is permitted to use, resolve the oracle address from the market configuration. Confirm that runtime bytecode exists at that address, retrieve verified source for the deployed contract, and follow every proxy or implementation reference before reviewing its behaviour. If the implementation source cannot be retrieved and matched to the deployed contract, report the oracle as unresolved. Do not mark source-dependent oracle checks as passed. #### Check for settable prices Check ID: morpho-v2-oracles-2 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/oracles/settable-price.md After resolving the verified implementation, trace every value used by `price()` and every externally reachable function that can change those values. Include inherited functions, role-managed configuration and setters on external dependencies; do not rely on function names alone. Report an issue when an owner, administrator or other privileged party can materially change the reported price without an independent economic price source constraining the result. Record the controlling addresses and affected markets. If access control or a dependency cannot be resolved, report the check as unresolved. Examples: - [morpho/oracles/SettableOracle.t.sol](https://github.com/jordaniza/vaults.rip/blob/main/examples/morpho/oracles/SettableOracle.t.sol) Related cases: - [Custom oracle control](https://www.vaults.rip/content/cases/morpho/1.md) #### Check oracle upgradeability Check ID: morpho-v2-oracles-3 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/oracles/upgradeability.md Inspect the oracle and every contract on its pricing path for proxy storage slots, implementation lookups, upgrade functions and unrestricted `delegatecall`. Resolve the current implementation and every address able to replace or modify it. Report an issue when a privileged party can replace pricing logic or dependencies without controls that the reviewer can justify for the vault. If the implementation or upgrade authority cannot be resolved, report the check as unresolved rather than treating the current source as permanent. #### Check fixed-price assumptions Check ID: morpho-v2-oracles-4 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/oracles/fixed-price.md Retrieve the verified oracle contract source and check for hard-coded price values. Report an issue if the price is hard-coded. If the source is unavailable, record the check as unresolved. Related cases: - [AZND: collateral and market control](https://www.vaults.rip/content/cases/morpho/2.md) #### Check Pendle PT TWAP duration Check ID: morpho-v2-oracles-5 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/oracles/twap-duration.md Where Pendle PT collateral is used, verify that the oracle TWAP follows [Pendle's current guidance](https://docs.pendle.finance/pendle-v2-dev/Oracles/HowToIntegratePtAndLpOracle), which recommends 900 seconds for most markets or 1,800 seconds. Report a materially shorter duration for review. If the duration cannot be determined, record the check as unresolved. Related cases: - [PT-reUSD: high-LLTV liquidity risk](https://www.vaults.rip/content/cases/morpho/3.md) ### Collateral #### Check collateral holder concentration Check ID: morpho-v2-collateral-1 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/collateral/holder-concentration.md For each collateral asset, use the appropriate Etherscan explorer to check the concentration of token holders. Report an issue if a majority of the tokens sit with one party. If holder data is not readily available, record it as missing. Related cases: - [AZND: collateral and market control](https://www.vaults.rip/content/cases/morpho/2.md) #### Flag shallow collateral at high LLTV Check ID: morpho-v2-collateral-2 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/collateral/liquidity.md Where new, derivative, obscure or otherwise economically shallow collateral is used in a high-LLTV market, flag the market for further review of liquidity, leverage and liquidation sensitivity. Do not use total supply alone as a proxy for economic depth. If the collateral profile or LLTV cannot be established, record the check as unresolved. Related cases: - [PT-reUSD: high-LLTV liquidity risk](https://www.vaults.rip/content/cases/morpho/3.md) ### Markets #### Check overlapping control Check ID: morpho-v2-markets-1 Source: https://github.com/jordaniza/vaults.rip/blob/main/content/checks/morpho-v2/markets/overlapping-control.md Check the addresses of: - the vault owner - the vault curator - the market deployer - the oracle owner or administrator - the collateral owner or administrator Record any roles held by the same address. If an address cannot be found, record it as missing. Related cases: - [AZND: collateral and market control](https://www.vaults.rip/content/cases/morpho/2.md)