Super Operator

An overview of the Super Operator role.

The Super Operator is a compliance and security role. It is a single privileged address that can act on any holder's shares without their approval, and that always bypasses access list restrictions, regardless of the active access mode.

It exists to solve a specific problem: access control alone cannot remove a user who already holds shares. If a holder is blacklisted, fails a KYC review, is added to a sanctions list, or is removed from the whitelist, the access list stops them from making new requests but their existing position stays where it is. The Super Operator is the mechanism that lets the vault operator act on that position: it can transfer the holder's shares to another address, and it can request a redemption of those shares on the holder's behalf. Neither requires the holder's approval.

The Super Operator can transfer and redeem any holder's shares without their consent, and chooses the receiving address. Only set it when your product genuinely requires it, hold it in a robust custody setup, and disclose it to users.

Responsibilities

The Super Operator is responsible for:

• Enforcing the vault's compliance policy on holders who are no longer authorized to participate

• Acting on positions that access control alone cannot reach

• Operating within a documented mandate agreed with the vault operator, and only in the cases that mandate covers

What the Super Operator can do

Act on held shares

• Transfer a holder's shares to another address (transferFrom), without any prior token approval

• Request a redemption of a holder's shares on their behalf (requestRedeem)

• Move a position that would otherwise be frozen in place by the access list

Act on pending and settled requests

• Claim settled shares for a user (deposit, mint)

• Claim settled assets for a user (redeem, withdraw)

• Cancel a user's pending deposit or redeem request

Bypass access control

• Operate regardless of the active access mode, in whitelist and blacklist mode alike

• Complete or unwind operations for users who are no longer on the access list

• The Super Operator address itself is always treated as allowed

The Super Operator cannot enter the vault for someone: requesting a deposit and depositing synchronously are the only user operations it cannot perform on behalf of a holder.

Typical use cases

• Removing a sanctioned or blacklisted holder from the vault's cap table

• Force-exiting a holder who fails an ongoing KYC or KYB review

• Responding to a legal or regulatory order affecting a specific holder

• Recovering positions during a vault closure or a migration into a new Lagoon vault

Routine operations do not need the Super Operator. Claiming settled shares for users in the normal course of business is done by the Vault Curator — see Claim shares on behalf of users.

Setting, disabling and locking the role

The Super Operator address is set by the Vault Admin. A vault can run without one: setting the address to the zero address disables the role entirely, and vaults with no compliance requirement should do exactly that.

The Vault Admin can also permanently lock the Super Operator address. Once locked, the address can never be changed again. This lets an operator commit publicly and irreversibly to a fixed Super Operator, or to no Super Operator at all.

See updateSuperOperator and lockSuperOperator in the smart contract reference.

Recommended custody setup

Given its scope, the Super Operator should be held by:

• A Safe multisig with a clear signer policy, ideally requiring compliance sign-off

• An institutional MPC setup

• A contract encoding a narrow, auditable mandate

What this means for users

Users can verify on-chain whether a vault has a Super Operator, which address holds it, and whether it has been locked or disabled. Where one is set, holders should understand that the operator can move or redeem their position without their consent, and should treat this as part of the vault's compliance terms.