feat(morpho): v0.2.2 — confirm gate + APY anomaly warnings#155
Open
skylavis-sky wants to merge 1 commit intookx:mainfrom
Open
feat(morpho): v0.2.2 — confirm gate + APY anomaly warnings#155skylavis-sky wants to merge 1 commit intookx:mainfrom
skylavis-sky wants to merge 1 commit intookx:mainfrom
Conversation
Add --confirm safety gate to all write operations (supply, withdraw, borrow, repay, supply-collateral, withdraw-collateral, claim-rewards): calling without --confirm prints a preview JSON with resolved params and pending transactions, then exits safely. --confirm is required to broadcast. Prevents accidental on-chain execution. Add APY anomaly warnings to markets and vaults: entries with supply/borrow APY above 500% emit a "warning" field flagging likely expired Pendle PT positions, so agents don't recommend these based on inflated APY data. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
Contributor
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
morpho positions |
View your Morpho Blue positions and MetaMorpho vault balances with health factors |
morpho markets [--asset TOKEN] |
List Morpho Blue markets with supply/borrow APYs and utilization rates |
morpho vaults [--asset TOKEN] |
Browse MetaMorpho vaults with APYs and curator information |
morpho supply --vault ADDR --asset TOKEN --amount N [--confirm] |
Deposit assets to a MetaMorpho vault to earn yield |
morpho withdraw --vault ADDR --asset TOKEN --amount N [--confirm] |
Withdraw from MetaMorpho vault (use --all for full withdrawal) |
morpho borrow --market-id HEX --amount N [--confirm] |
Borrow from a Morpho Blue market |
morpho repay --market-id HEX --amount N [--confirm] |
Repay Morpho Blue debt (use --all for dust-free full repayment) |
morpho supply-collateral --market-id HEX --amount N [--confirm] |
Add collateral to a Morpho Blue market |
morpho withdraw-collateral --market-id HEX --amount N [--confirm] |
Remove collateral from Morpho Blue market |
morpho claim-rewards [--confirm] |
Claim Merkl rewards |
Global flags: --chain 1|8453 (Ethereum/Base), --dry-run, --from ADDRESS
Triggers
Activate this skill when users mention supplying/depositing to Morpho vaults, borrowing from Morpho Blue markets, checking Morpho positions or health factors, viewing Morpho interest rates, repaying Morpho loans, managing collateral, claiming Morpho rewards, or browsing MetaMorpho vaults. Also triggered by phrases like "earn yield on morpho", "morpho lending", or "metamorpho".
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall morpho binary (auto-injected)
if ! command -v morpho >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_i686) TARGET="i686-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
linux_armv7l) TARGET="armv7-unknown-linux-gnueabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/morpho@0.2.2/morpho-${TARGET}${EXT}" -o ~/.local/bin/morpho${EXT}
chmod +x ~/.local/bin/morpho${EXT}
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/morpho"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"morpho","version":"0.2.2"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"morpho","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
Contributor
📋 Phase 3: AI Code Review Report — Score: 82/100
1. Plugin Overview
Summary: This plugin provides an AI agent skill for interacting with the Morpho lending protocol (Morpho Blue markets and MetaMorpho vaults). It supports supply, withdraw, borrow, repay, collateral management, reward claiming, and read-only queries for positions/markets/vaults on Ethereum Mainnet and Base chains. Write operations are executed via Target Users: DeFi users who want to supply, borrow, and earn yield on the Morpho protocol through an AI agent interface. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin can execute on-chain write operations including ERC-20 token approvals, vault deposits/withdrawals, borrowing/repaying, collateral management, and reward claiming on Ethereum and Base. It reads market data from Morpho's GraphQL API and token metadata from public RPC nodes. All write operations go through 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all write operations are routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations use 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No toxic flows detected. Prompt Injection Scan
Result: ✅ Clean Dangerous Operations Check
Result: Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskThe medium risk rating is due to the nature of DeFi write operations (supply, borrow, repay) and the use of 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies:
No suspicious, unmaintained, or vulnerable dependencies identified. All dependencies are from well-known Rust ecosystem packages. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — the SKILL.md accurately describes:
Verdict: ✅ Source Safe7. Code ReviewQuality Score: 82/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-structured DeFi lending plugin with strong safety patterns (confirm gate, exact approvals, data trust boundary, APY warnings), using onchainos for all on-chain writes. Medium risk due to inherent DeFi financial operations and Merge recommendation: Caveats to note:
Generated by Claude AI via Anthropic API — review the full report before approving. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plugin Submission
Plugin name: morpho
Version: 0.2.2
Type: update
Checklist
plugin-store lintpasses locally with no errorsokx-,official-,plugin-store-)nameanddescriptionWhat does this plugin do?
Morpho is a permissionless lending protocol with $5B+ TVL. This plugin allows agents to supply/withdraw from MetaMorpho vaults, borrow/repay from Morpho Blue markets, supply/withdraw collateral, and claim Merkl rewards on Ethereum Mainnet and Base.
This update adds two safety improvements:
--confirmgate for all write operations — all write commands now require--confirmto broadcast. Without it, the binary resolves parameters, builds calldata, and prints a preview JSON (operation, asset, amount, pending transactions) then exits safely. Prevents accidental on-chain execution.APY anomaly warnings —
morpho marketsandmorpho vaultsnow emit a"warning"field on entries where APY exceeds 500%. This surfaces expired Pendle PT positions (which inflate APY to thousands of percent post-maturity) so agents don't mislead users with these figures.Which onchainos commands does it use?
onchainos wallet status— check wallet connectiononchainos wallet contract-call --chain <id> --to <addr> --input-data <hex>— ERC-20 approvals (with--force) and main protocol writes (without--force)Security Considerations
--force(broadcast immediately as prerequisite steps)--confirmgate ensures agents must explicitly pass--confirmto broadcast; omitting it always exits safely after previewTesting
cargo build --release— clean build, no warningsmorpho marketstested against Ethereum mainnet API — warning field present on anomalous APY entries, absent on normal entriesmorpho vaultstested similarly