The Disclosure Gap in Morpho Vaults
Every curator change is public onchain, but few depositors can read it. The timelock meant to protect them only works if they notice in time.
1. Common critique 1: Timelock is not an enough safeguard
A common critique goes further. Vaults were meant to save users from tracking thousands of markets, and a 1-day timelock hands that job straight back while treating the user's silence as approval.
I agree that silence during a timelock isn't consent. Most depositors couldn't interpret a cap increase or an oracle swap even if they watched the vault around the clock. Where I disagree is the claim that vaults themselves are the problem.
2. Common critique 2: Mandate Drift
Mandate drift is the biggest risk on that list. A depositor who picks a vault built on blue-chip collateral hasn't agreed to whatever the curator adds a year later. In TradFi, a change to a fund's fundamental investment policy needs a shareholder vote.
A competent risk rating provider can flag drift onchain if two conditions hold. The vault has to publish a mandate to measure against, and the rating has to update the moment a change is proposed, while depositors can still exit.
3. Common critique 3: Roles
Role separation mainly protects against compromised keys, because an allocator can only move funds within existing caps and can't add new markets.
It protects depositors only when independent parties hold the roles. When one team holds every role, the split tells you who to blame after a loss and does little else.
4. Curators as asset managers
Curators ARE asset managers, and they abstract markets away from the user the way an ETF abstracts away its holdings. Nobody buying an S&P 500 ETF monitors 500 companies.
A bad ETF issuer makes investing riskier than picking stocks yourself, and a good one diversifies away risk most people couldn't manage alone. You can diversify on your own, yet US ETFs passed $10T in assets in 2024 because most people would rather not.
5. What ETFs disclose
ETFs earned that trust through the disclosure rules around them. A US fund that wants to raise its advisory fee or change its adviser needs a shareholder vote. A fund that changes a name tied to its investment policy owes investors 60 days' notice. ETFs also publish their holdings daily.
Cuts to cost or risk take effect immediately, while increases need notice or consent. Morpho already encodes that asymmetry onchain: cap increases and other risk-increasing changes sit behind a timelock, and cap decreases don't.
6. The missing layer
What's missing is interpretation. The Morpho app shows pending changes, but as raw parameters that only a DeFi native can read.
A depositor should be able to subscribe to a vault and get a plain-language alert when any of these change:
• Oracles
• Timelock length
• Roles: owner, curator, allocators, and any abdicated functions
• Collateral whitelist
• Performance and management fees
• Vault name
• Market caps
• New adapters
• Market allocation
Each alert should state how the change moves the vault's risk and how much liquidity is free to exit before it executes, since a 7-day timelock protects nobody when the underlying markets sit at 100% utilisation.
7. Who should report
Curators can't do this reporting themselves, since they have a conflict of interest when reporting on their own vaults. Morpho benefits from vault growth, so it isn't fully neutral either.
Integrators could take the broker role that exists in TradFi, or a rating firm like Credora could, provided the curators it rates aren't paying for the ratings.
8. Steakhouse as the benchmark
@SteakhouseFi comes closest today. Its vaults carry
@CredoraNetwork risk ratings with a published methodology, and its guardian is an
@AragonProject DAO where depositors vote with their vault shares.
Changes sit behind a 7-day timelock, anyone holding around $10K of shares can propose a revocation, and the vote runs for one day. That makes it the nearest thing DeFi has to a shareholder vote. The veto still depends on depositors knowing a change is pending, so it needs the alerting layer to work.
9. What should come next
Vaults is a great technology. What they need next is notice that depositors can read and act on. That requires alerts + interpretation, not just instant event level notification. No investors would understand it.