MIP - Add granular pausing and asset deprecation

Morpho Optimizer
1

Context

Morpho Labs believes that adding granularity to governance-controlled functions like market pausing or asset depreciation, similar to the ones present in Aave and Compound, could improve the resilience of the protocol.

Proposal

The Morpho Labs team would like to give the governance more granularity over its power on the protocols.

Currently, a market can be “partially paused”, preventing any supply or borrow, or “paused”, preventing any interaction with this market. We propose partitioning these two pausing categories into 6. Governance would be able to pause supply, borrow, withdraw, and repay functions for each market, as well as pause liquidators from seizing or repaying any specific asset. Thus, governance can disable certain functions without applying inappropriate restrictions. This power would be given to the Morpho operator 3/5 multisig. (see Zodiac and Progressive Decentralization).

Also, we would like to add a native market deprecation feature, very similar to Compound’s one. When the market would be set as deprecated, all the debt on this market could be instantly liquidated, leaving the market with 0 borrowers. Only the DAO multisig and the Reality Module would have the rights to trigger these functions.

Finally, we would like to add a way for the governance to manually increase peer-to-peer deltas on a given market. This function would allow to put some liquidity back on the pool, in constant time, as there would be no need to demote anyone. It would be useful in a market deprecation process, or when the peer-to-peer matching mechanism cause problems for example. The Morpho operator would receive the access to this function.

Implementation

To be able to pause the 6 different scenarios granularly, we need 6 new storage variables. We also need one storage variable for the deprecated status. In order not to break the previous contract’s ABI, we added a new storage slot at the end of the existing ones, which contains a struct with those 7 variables.

At the moment, the two pause statuses are given by two variables per market: isPartiallyPaused pausing the supply and borrow functions, and isPaused pausing the supply, borrow, withdraw, repay and liquidate (both on the collateral and on the debt) functions. The proposed changes would mean that variables isPaused and isPartiallyPaused would no longer be used. They will be set to false, and never read nor written again by the protocol. We are calling both on-chain and off-chain integrators to give their opinion on this choice.

We also added 7 governance functions to set those 7 variables, as well as an increaseP2PDeltas function to increase the peer-to-peer delta by a given amount, on a given market.

Two external security audits by Pessimistic and Spearbit are being finalized, we will share the reports as soon as they are ready.

Next steps

After a discussion with the community, Morpho Labs would open a vote on Snapshot. If it passes, the Morpho association would upgrade both Morpho-Compound and Morpho-Aave with the new contracts implementing these new features. It would also update the Zodiac Roles module, to grant the pausing rights to the Morpho operator, as discussed in the proposal.

6 Likes
2

Would you please elaborate on how altering the peer to peer deltas causes liquidity to smoothly reenter the pool?

Strongly in favor of these more granular controls, and would suggest also the idea that certain of these functions could be assigned to Guardian addresses capable of faster emergency action. Notably, allowing a Guardian to pause supply or new borrows, but not to pause repay or withdraw, is a good compromise. In the event a Guardian acts maliciously, it can be removed by governance and the markets unpaused. In the event of a “highly profitable trading strategy” in the underlying market, pausing new supply or borrow can help to protect users.

2 Likes
3

Hello @OneTrueKirk,

The delta mechanism is a solution for keeping infinite scalability while having a O(n) matching engine. More precisely, it is used when a big user wants to withdraw (resp. repay) a position, and that the matching engine cannot promote enough suppliers (resp. borrowers) waiting on the pools or demote enough peer-to-peer matched borrowers (resp. suppliers) with a given max gas for matching. In this case, the peer-to-peer borrow (resp. supply) delta is increased: it accounts for a part of the peer-to-peer borrow (resp. supply) that is actually on the pool. The rates are updated accordingly, taking a weighted average between the theoretical peer-to-peer rate and the pool rate.

So, increasing manually the deltas to 100% allows to put some liquidity back to the pool in constant time, without having the need to demote each peer-to-peer matched suppliers and borrowers one by one.

You can find more about it in the Delta Mechanism section of the documentation.

To make sure that we are on the same page, the Morpho protocol already has a second 3/5 operator/emergency multisig (named Morpho operator), which is able to pause or unpause a given market, enable or disable the peer-to-peer matching engine of a given market, and update non-critical parameters such as the matching engine parameters or the p2pIndexCursor. More details about it are available in the Zodiac and Progressive Decentralization section of the documentation.

The Morpho operator would receive the rights to update the new granular pausing statuses, and increase peer-to-peer deltas, in addition to what it already has.

Are you suggesting to have one other governance entity, with even less power ?

1 Like
4

I am actually thinking

  1. Pausing repay/withdraw is a lot of power even for a 3/5 multisig, though it would be fine for the early period. Would rather see only pausing of supply and borrow in hands of a more lightweight multisig.

  2. Unlike pausing repay and withdraw, pausing supply and borrow does not prevent any users from accessing their funds, and thus can be entrusted to a lightweight multisig or even a set of EoAs.

For example, in the Volt Protocol system, certain EoAs (or in the future an account with above a minimum amount of VOLT) can trigger removal of PCV from a venue like Compound, but they can’t put funds back in, which would require governance (currently the full multisig, later token governance) to act. Along these lines, pause supply/borrow could be assigned to the most nimble multisig that the Morpho DAO decides to have operating, or even to an EoA, but pausing repay or withdraw should have larger barriers.

3 Likes
5

hope to see that and i am member wish that proposal will go

6

Below you’ll found the draft report from Spearbit on the next upgrade:

morpho-draft.pdf (219.1 KB)

A few notes on it:

  • No critical issues have been found, thus the upgrade is maintained.
  • The 2 high risks issues are already known and have a very low likelihood to happen.
  • Other medium/low/informational issues are currently being tackled or acknowledged by the Morpho Labs’s team. This will be presented to the community in an other upgrade in January/February which will be reviewed by Spearbit as well, as part of the retainer program.

A new report will be published to update the current one.

Do not hesitate if you have any question.

1 Like
7

I agree with OneTrueKirk that pausing supply & withdraw is a hella lot of power to give to only 3 signers. The Zodiac reality high consensus module would be more appropriate for such a drastic action.

Also, for visibility purpose, I suggest moving the thread to the governance subforum rather than the uncategorized subforum.

1 Like
8

Votes are open until Dec 9 !

9

I voted for the current proposal, but would be nice to continue the discussion about removing authority over pausing repay and withdraw from the multisig in a future proposal.

10

Hello @OneTrueKirk @Fromage, thank you for your thoughts on the subject.

While we (Morpho Labs) agree that pausing withdraw and repay is considerable power, and that it should be used with caution, we feel it is best for the users and the project as a whole that the Morpho operator retain this power at this stage of the project.

Note that the people in this Morpho operator 3/5 multisig are also part of the biggest 5/9 multisig, and are the ones that know the protocol inside and out.

Note also that in any case, governance has the power to revoke this right, when it thinks that the time is right.

1 Like
11

Can you elaborate on the use cases you see for pausing withdraw and repay? In my view, the most obvious is to mark down bad debt in a market fairly. I agree that it’s a useful mechanism and we at Volt have a similar power in our own project at the current stage using the 3-of-5 Governor Multisig. However, we do not wish to retain this power longer than absolutely needed, and I’d be keen to compare notes.

We need an explicit mechanism for marking down bad debt (missing from Compound and making it vulnerable to bank runs). A system might look like: the 3/5 Multisig or anyone who burns some amount of $MORPHO tokens can trigger an emergency state where withdraw and deposit etc are paused. A global settlement and markdown of underwater positions can then proceed, after which withdraws automatically reopen.

1 Like
12

For your information, the upgrade has been successfully conducted.

Here are the relevant smart contract addresses:

Morpho-Compound

Morpho-AaveV2

1 Like