MIP - Morpho, Lenses & Vaults upgrades

Morpho Optimizer
,
1

Morpho & Lenses Upgrades

Following Spearbit’s recommendation, Morpho Labs proposes to upgrade both Morpho and Lens contracts to:

  • Make contracts more maintainable and resilient.
  • Prevent the deprecation of a market if it hasn’t been paused earlier.
  • Deprecate pool rewards on Morpho-AaveV2 since no rewards are planned on Aave V2, and Aave V3 is to be deployed on mainnet. The unnecessary logic is removed and thus saves gas.
  • Update Lenses to reflect changes and fix specific getters (getNextUserSupplyRatePerYear and getNextUserBorrowRatePerYear).
  • Remove the useless function setAssetAsCollateral in Morpho-AaveV2.
  • Eliminate cumbersome code duplication by implementing shared interest rates logic between Morpho’s InterestRatesManager contract and Lens.

Vaults Upgrade

The Morpho Labs team proposes to upgrade the vaults to:

  • Make vaults more gas efficient. Some variables will be set to immutable to avoid reading the storage at each interaction with a vault.
  • Make the redistribution of rewards more secure and maintainable. After this upgrade, the DAO would no longer need to specify the amount and the recipient to transfer $MORPHO rewards from a vault to the vault rewards distributor. The recipient of the rewards will be set, at construction time, to the vault rewards distributor. All $MORPHO tokens held in a vault can be then transferred to the rewards distributor through a public function transferRewards to the recipient. The DAO’s multisig can still trigger the function, but any EOA can also trigger it to accelerate the process.

Security

As always, security is a principal concern for the Morpho Labs team. Below are the measures that have been or will be taken:

  • The PR of the Morpho contracts will be reviewed by Spearbit.
  • The PR of the vaults’ upgrade will be reviewed by Pessimistic.
  • Production tests have been run to test both upgrades.
  • Our CI tool has been run to check any storage clashes introduced by upgrades.
  • For the upgrade process, the upgrade checklist will be followed.

Delay

The upgrade will only happen once the audits have been performed and a delay modifier is added to the DAO multisig. This delay adds 24 hours between the moment a tx is submitted to the DAO multisig and the moment it can be executed.

Upgrade Process for Morpho and Lens

  • Deploy implementation contracts with an EOA.
  • Upgrade contracts with the DAO multisig and set the correct new contracts to Morpho’s storage.

Upgrade Process for Vaults

  • Deploy the SupplyVault implementations for Morpho-Aave and Morpho-Compound (2 contracts to deploy).
  • Upgrade all vaults proxy to point to the correct implementation.
3 Likes
2

Morpho Labs received the reports from Pessimistic for the vaults and Spearbit for the Morpho protocol (see below). Morpho Labs will now propose the cote on snapshot :slight_smile:

Morpho Vaults Security Analysis by Pessimistic.pdf (272.8 KB)
morpho-v1.pdf (257.6 KB)

3 Likes
3

Hi everyone!

The payloads to upgrade the vaults have been recently submitted to the DelayModifier (0x68d11129a514c45716e55b9771813f117c4c2fa5):

  • Upgrade of the Aave vaults
  • Upgrade of the Compound vaults

The 2 upgrades were batched in this transaction.

You can find detailed information about these transactions on this Notion page.

Anyone can execute the upgrade on the DelayModifier (unless revoked by the DAO) by calling executeNextTx with the right parameters in 24 hours.

2 Likes
4

Hi everyone!

The payloads to upgrade the contracts and the lenses have been recently submitted to the DelayModifier (0x68d11129a514c45716e55b9771813f117c4c2fa5):

  • Upgrade of the Morpho-Aave contracts
  • Upgrade of the Morpho-Compound contracts
  • Revoke some of the accessible functions of the Operator

The 2 upgrades were batched in this transaction .

You can find detailed information about these transactions on this Notion page .

Anyone can execute the upgrade on the DelayModifier (unless revoked by the DAO) by calling executeNextTx with the right parameters in 24 hours.

1 Like
5

The upgrades have been successfully accomplished!

New addresses for Morpho-AaveV2:

New addresses for Morpho-CompoundV2:

The Immunefi bug bounty will be shortly updated accordingly.

1 Like