Roles & Capabilities
Morpho V2 refines the role structure introduced in V1, providing more precise separation of responsibilities and adding a safety-oriented new role: the Sentinel. The result mirrors how large organizations structure operational oversight, where different functions hold distinct, narrowly scoped permissions.
The Four V2 Roles
Owner
The Owner sets the Curator and Sentinels, and otherwise sits at the top of the role hierarchy. The Owner does not handle day-to-day curation or risk management.
Curator
The Curator is the risk manager and yield strategist. The Curator configures vault adapters, supply caps, gates, timelocks, and fees. Most Curator actions are timelocked: they are submitted on-chain and can be executed only after the configured waiting period has elapsed.
Allocator
The Allocator oversees vault allocations to underlying markets and vaults, serving as the operational arm that moves capital in accordance with the strategy defined by the Curator.
Sentinel
The Sentinel is a safety-oriented role designed for reactive risk mitigation. It acts as a check on the Curator and can intervene in emergencies. Multiple addresses may hold the Sentinel role on a single vault.
Suggested Key Setup
How each role is typically held depends on the vault's operational profile. The patterns below are starting points, not requirements.
Owner
A secure multisig (for example, 4-of-6) or an institutional-grade MPC wallet. A single externally-owned account is not recommended for production vaults, given the scope of Owner authority.
Curator
A multisig (for example, 2-of-4 or 3-of-5) or an MPC wallet. The Curator submits most changes through timelocks, which gives the Sentinel and depositors a window to react if a Curator key is ever compromised.
Allocator
A smart contract with automated allocation logic, a hot-key EOA operated by a bot, or a fast-response multisig. The Allocator only moves capital within already-approved adapters and caps, so its authority is structurally narrower than the Curator's.
Sentinel
A hot key for fast emergency response, a DAO governance contract, or a trusted third party. Multiple addresses can hold the Sentinel role in a single vault, enabling redundancy and faster response across time zones.
Why the Sentinel Role Matters
The Sentinel is structurally designed so that its actions can only reduce risk or halt pending changes. It can be thought of as a subtractive versus an additive role, as it cannot enable new adapters or increase exposure.
A Sentinel can:
Revoke any pending Curator-submitted action before its timelock expires
Deallocate funds from any adapter back to the vault's idle pool
Decrease absolute or relative caps for any Risk ID (instant, no timelock required)
A Sentinel cannot:
Enable or disable adapters
Increase caps
Change fees
Set gates
Modify timelocks
Add or remove allocators
This narrow capability set is what allows the Sentinel role to be delegated broadly, including to a hot key for fast emergency response, a governance contract, or a trusted third party. If a Sentinel address were ever compromised, the role's permission constraints limit possible actions to those listed above, reducing the downside relative to keys with broader authority.
Curator Capabilities in Detail
The Curator's authority spans most of the vault's configurable surface. Capabilities are grouped below by the area of the vault they affect. Most are gated by a timelock; a smaller set can be executed instantly, all of them in the direction of reducing risk or extending safety windows.
Protocol Management
[Timelocked] Enable or disable yield sources via Adapters
Risk Curation
[Timelocked] Increase absolute or relative caps for any Risk ID
[Instant] Decrease absolute or relative caps for any Risk ID
Yield & Fee Management
[Timelocked] Set the maximum rate at which vault assets can grow
[Timelocked] Set the performance fee and management fee
[Timelocked] Set the performance fee recipient and management fee recipient
Operational Management
[Timelocked] Add or remove Allocators
[Timelocked] Set Gate contracts for onchain access controls (shares gate, receive-assets gate, send-assets gate)
[Timelocked] Set the penalty for force-deallocate
Timelock Management
[Instant] Increase the duration of any timelock
[Timelocked, 3 weeks] Decrease the duration of any timelock
[Timelocked] Irreversibly disable a timelocked action (abdicate)
Note the difference between "increase timelock" (instant) and "decrease timelock" (3-week timelock): the Curator can always immediately lengthen the safety window, but shortening it requires the longer waiting period.
Role Capability Comparison
The Sentinel is an expansion of the V1 Guardian role, with the same veto power and a broader risk-off toolset.
Revoke pending Curator actions
✓
✓
Deallocate funds to idle pool
✓
Decrease caps (instant, no timelock)
✓
Last updated
Was this helpful?