Super Operator
An overview of the Super Operator role.
The Super Operator is a compliance and security role. It is a single privileged address that can act on any holder's shares without their approval, and that always bypasses access list restrictions, regardless of the active access mode.
It exists to solve a specific problem: access control alone cannot remove a user who already holds shares. If a holder is blacklisted, fails a KYC review, is added to a sanctions list, or is removed from the whitelist, the access list stops them from making new requests but their existing position stays where it is. The Super Operator is the mechanism that lets the vault operator act on that position: it can transfer the holder's shares to another address, and it can request a redemption of those shares on the holder's behalf. Neither requires the holder's approval.
The Super Operator can transfer and redeem any holder's shares without their consent, and chooses the receiving address. Only set it when your product genuinely requires it, hold it in a robust custody setup, and disclose it to users.
Responsibilities
The Super Operator is responsible for:
Enforcing the vault's compliance policy on holders who are no longer authorized to participate
Acting on positions that access control alone cannot reach
Operating within a documented mandate agreed with the vault operator, and only in the cases that mandate covers
What the Super Operator can do
Act on held shares
Transfer a holder's shares to another address (
transferFrom), without any prior token approvalRequest a redemption of a holder's shares on their behalf (
requestRedeem)Move a position that would otherwise be frozen in place by the access list
Act on pending and settled requests
Claim settled shares for a user (
deposit,mint)Claim settled assets for a user (
redeem,withdraw)Cancel a user's pending deposit or redeem request
Bypass access control
Operate regardless of the active access mode, in whitelist and blacklist mode alike
Complete or unwind operations for users who are no longer on the access list
The Super Operator address itself is always treated as allowed
The Super Operator cannot enter the vault for someone: requesting a deposit and depositing synchronously are the only user operations it cannot perform on behalf of a holder.
Typical use cases
Removing a sanctioned or blacklisted holder from the vault's cap table
Force-exiting a holder who fails an ongoing KYC or KYB review
Responding to a legal or regulatory order affecting a specific holder
Recovering positions during a vault closure or a migration into a new Lagoon vault
Routine operations do not need the Super Operator. Claiming settled shares for users in the normal course of business is done by the Vault Curator — see Claim shares on behalf of users.
Setting, disabling and locking the role
The Super Operator address is set by the Vault Admin. A vault can run without one: setting the address to the zero address disables the role entirely, and vaults with no compliance requirement should do exactly that.
The Vault Admin can also permanently lock the Super Operator address. Once locked, the address can never be changed again. This lets an operator commit publicly and irreversibly to a fixed Super Operator, or to no Super Operator at all.
See updateSuperOperator and lockSuperOperator in the smart contract reference.
Recommended custody setup
Given its scope, the Super Operator should be held by:
A Safe multisig with a clear signer policy, ideally requiring compliance sign-off
An institutional MPC setup
A contract encoding a narrow, auditable mandate
What this means for users
Users can verify on-chain whether a vault has a Super Operator, which address holds it, and whether it has been locked or disabled. Where one is set, holders should understand that the operator can move or redeem their position without their consent, and should treat this as part of the vault's compliance terms.
Last updated