version: "1.0.1" name: aster-deposit-fund description: Deposit funds to Aster from a wallet; private key from env. Use when the user wants to deposit to Aster or fund an Aster account.

Aster Deposit Fund

Env

Supported chains

User confirmation

MANDATORY — Before executing ANY deposit transaction, the agent MUST:

1. Display a clear summary to the user:

• Chain and chainId
• Asset symbol and contract address (for ERC20)
• Amount (human-readable AND raw wei/units)
• Deposit (treasury) address
• Broker ID (if non-default)
• Estimated gas cost

1. Ask for explicit textual confirmation (e.g. "Type 'confirm' to proceed" or "yes/no").
2. Do NOT assume consent from a prior message, implicit agreement, or context.
3. Do NOT batch multiple deposits without individual confirmation for each.
4. If the user cancels or does not confirm, abort immediately with no on-chain action.

Failure to confirm is a critical safety violation in an autonomous agent context.

Flow

1. Deposit address — Hardcoded per chain in scripts/common.mjs (SEC-01). Same address for native and ERC20 on that chain.
2. Balance check — Verify the wallet has sufficient balance for the deposit amount + gas BEFORE submitting any transaction (SEC-06).
3. User confirmation — See above. Always confirm before executing.
4. On-chain send — From wallet (key from env), sign with appropriate RPC for chain:

• Native: treasury.depositNative(broker) with value = amount (wei).
• ERC20: token.approve(treasury, amount) then treasury.deposit(token, amount, broker). Token metadata (contract + decimals) is provided explicitly (no API lookup).
• All transactions use an explicit gas limit (SEC-09) and wait for multiple confirmations per chain (SEC-10).

Security

• Private key only from env; never log, echo, or pass via CLI args.
• Key is validated (0x + 64 hex chars) and removed from process.env after account derivation (SEC-02).
• Error output is sanitized to prevent accidental key leakage in logs (SEC-02).
• Deposit address is checked against a hardcoded whitelist to prevent oracle attacks (SEC-01).
• Public RPCs emit a warning; use private RPCs (Alchemy, Infura) in production (SEC-04).
• balance.mjs never loads the private key; it uses the public address only (SEC-07).

Broker ID

The --broker parameter (default: 1) identifies the Aster broker account that the deposit is attributed to. Broker 1 is the primary/default Aster broker. Only change this if you know the target broker ID. An incorrect broker ID may result in funds being inaccessible from the expected account (SEC-11).

Scripts (viem)

Optional: scripts/ — Bun + viem. Install: cd skills/aster-deposit-fund/scripts && bun install.

See .env.example in the repo root for all env vars.

Payload shapes: reference.md.