Key Properties
- Non-custodial — Depositor funds live in the vault contract, never in institution-controlled wallets
- ERC-4626 compatible — Standard deposit/withdraw interface with async ERC-7540 extensions for cross-chain and illiquid positions
- Merkle-verified execution — Keepers can only call hooks that match leaves in the onchain Merkle tree
- Automated operations — Workers handle any actions, from deposits, redemptions, reward claims, swaps, and transaction management
- Oracle-secured PPS — Price-per-share is computed by validators, signed as EIP-712 typed data, and accepted onchain only after two-thirds weighted consensus
How SuperVaults Work
Depositor Requests
A depositor submits a deposit or redemption request onchain via the ERC-7540 interface.
Keeper Workers Execute
Seven automated workers process requests: allocating deposits to configured yield sources, fulfilling redemptions, claiming rewards, and executing swaps.
Institution Manages Strategy
The institution sets allocation priorities, defines automated rebalancing rules, configures Merkle authorization for keeper operations, and monitors vault health.
Security Model
SuperVaults enforce safety at every layer:- Double-Merkle hook allowlisting and blacklisting at both global and strategy levels ensures vaults can only perform pre-approved actions like depositing, redeeming, swapping, and bridging. Hook-root updates are proposal based, with the aggregator hook-root timelock defaulting to 15 minutes, and keepers still cannot execute anything outside approved leaves.
- Clear role separation across Managers, Validators, and Guardians. Managers operate through pre-approved hooks, validators attest price-per-share, and guardians retain emergency intervention powers such as pause controls.
- Validator-signed price-per-share (PPS) with quorum, signature, staleness, and deviation checks enforced onchain.
- Timelocked sensitive parameters such as fee changes, PPS expiration threshold updates, active PPS oracle changes after first set, and some governance actions, while other operational controls remain immediate.
- Automated emergency controls provide pause functionality, banned leaves, and emergency withdrawal paths using authorized hooks.
Efficiency
SuperVaults are engineered for scale:- Native ERC-7540 compliance enables efficient flows for low-cost deposits and async withdrawals as well as onchain composability.
- Cross-chain deposits via the SuperBundler support 8+ networks with a single signature.
- Modular hook engine allows SuperVaults to access any yield source. Strategies can evolve as markets do, without redeployments or protocol upgrades.
Transparency
Depositors do not have to trust; they can verify:- A live transparency dashboard surfaces allocations, caps, validator signatures, and performance in real time.
- PPS can be recomputed by anyone, onchain or offchain, with circuit breakers that pause abnormal behavior automatically.
- All underlying protocols can continuously be monitored for exploit vectors and governance risk, and quickly allocated out of if needed.
Architecture
Vault Triads
Each SuperVault deployment consists of three onchain contracts managed through the SuperVaultAggregator (factory, registry, PPS oracle forwarding, upkeep accounting, and governor-level constraints):| Contract | Purpose |
|---|---|
| SuperVault | ERC-7540 vault that holds depositor assets and issues share tokens. Entry-point for synchronous deposits and asynchronous redeems. |
| SuperVaultStrategy | Execution engine that manages hook authorization via dual Merkle roots, tracks PPS high water mark, queues/fulfills redemption requests, and enforces fee policies. |
| Escrow | Holds user shares during pending redemptions (allowing cancellation) and assets during fulfillment claims. |
Governance & Coordination
| Component | Role |
|---|---|
| $UP Token | Protocol token used for governance via sUP, funds SuperVault upkeep for PPS update writes, and gains validator-bonding utility in later phases. |
| SuperGovernor | Central registry and access control hub. Manages role-based permissions, selected timelocked parameter updates, and emergency intervention powers. |
| SuperBank | Protocol treasury that handles protocol fees and executes governance-approved hook operations. |
PPS Validation
| Component | Role |
|---|---|
| ECDSAPPSOracle | Validates price-per-share updates using ECDSA signatures and forwards validated updates to the Aggregator. |
| Validator Network | Validators monitor PPS updates and submit attestations, with consensus, signature, and quorum checks enforced before updates are accepted. |
Supported Yield Sources
| Type | Description | Example |
|---|---|---|
erc4626 | Standard ERC-4626 vaults | Morpho, Aave wrappers, Euler |
pendle_pt | Pendle Principal Tokens | Fixed-rate yield via PT purchase |
Live Deployments
SuperVaults are live on Ethereum and Base with flagship vaults for USDC, WETH, and WBTC. See Deployment Addresses for the full contract list.Next Steps
Transaction Lifecycle
End-to-end flow from deposit request to yield accrual.
Economics
Fee structure, $UP upkeep, and protocol revenue.
For Institutions
Full technical guide for institutions curating vaults.