Governance & Security

Governance

Owner (Coinshift, Steakhouse Financial, and Paxos International)

• Composition: A 3-of-5 multi-signature committee

• Responsibilities: Sets high-level vault strategies and assigns roles.

Curator (Steakhouse Financial)

• Role: Sets vault parameters such as adding or removing markets, reallocating capital, adjusting performance fees (as a percentage of borrower rates), and setting supply and borrow caps.

• Function: Ensures the vault's activities align with risk and optimization strategies. However, actions like adding a market or increasing fees are subject to a time delay (1 to 14 days).

Allocator (Steakhouse Financial & Public Allocator Contract)

• Role: Dynamically optimizes fund allocation within established parameters.

• Function: Adjusts allocations to optimize yields while managing risk.

Guardian (Coinshift Security Council, later: DAO made up of vault depositors)

• Role: Monitors and provides oversight, with the ability to veto actions within a specified timelock.

• Function: Protects user interests by overseeing vault activities and intervening when necessary.

Timelock

• Security Feature: Timelocks introduce a waiting period before significant actions are executed in Morpho Vaults.

• User Control: Steakhouse curates with a 7-day delay for changes, giving users time to review. Using Aragon DAO guardians, capital suppliers can vote to revoke curator actions. This setup keeps the vault non-custodial, ensuring users maintain control and can withdraw assets anytime.

• Risk Management: Applies to changes that could increase vault risk (e.g., high LLTV markets, supply cap adjustments).

• Transparency: Users can inspect timelock values in the "Read Contract" section of the vault for oversight.

Security

Over time, Morpho has been audited 27 times by 12 different security firms. This covers Morpho Optimizers, Front-ends, Morpho Vaults and Morpho, and makes Morpho the most audited project in the world.

Morpho Optimizers is renowned for achieving the highest score (98%) out of 300+ protocols on DeFiSafety, an independent rating agency that assesses how closely a protocol follows best practices.

A whole article was dedicated to the Morpho Security Framework here