Why the vault standard must be reinvented for institutions to go from pilot to production

On 24 September, Morpho co-founder Paul Frambot proposed two classes of onchain vault: non-custodial ones, where code bounds the curator, and discretionary ones, where depositors rely on the manager's judgment. Aave founder Stani Kulechov answered within the hour. The argument is over one object: the mandate a depositor agreed to, and who can change it. Institutions need a layer on top of Morpho's markets that answers it, with execution they can price, verify and read and fewer fees in the path. A Priime vault adds that layer.

Mandate drift is the open risk

Frambot's test is the exit: if depositors can opt out within a reasonable time without relying on the curator, the vault is non-custodial. Kulechov points at what happens before anyone leaves, “implicit approvals that simply changes the whole allocation mandate”, while “users don’t even have the proper tools to monitor these changes”.

That is where trust gets expensive. Tokenization put the asset on a shared ledger. The allocation decision stayed on a private server, and the cost of trust moved with it. Depositors, their risk committees and their auditors pay that cost in diligence, one team at a time. Each of them checks the same mandate.

Frambot writes that the next phase is “about defining the standards that will let institutions and regulators embrace them at scale”. Morpho vaults fixed who may act. The next layer reinforces the mandate and makes it verifiable by every stakeholder.

Priime vaults run the mandate as code

A Priime vault starts from a mandate its builder specifies: goals and limits for size, horizon and concentration. The vault enforces those limits and derives every other parameter from measured data, with its basis shown. An override still goes through. It shows its price.

The Trustless Execution Network validates every action against that mandate. Each operator runs a Priime Processor, the node software of the network, and a quorum of them re-runs the vault's declared computation from pinned inputs. A result settles only when the re-execution agrees and the outcome satisfies the rules written onchain. Outside the mandate, no operator signs.

Every move is priced against holding before it runs. The vault states in plain words what the move costs at its own size, from measured quotes, what it should add and when it pays back. With no basis, it says “not priced” and holds.

After settlement, each estimate sits beside its result, and each settlement names its program and block. Executed and refused plans are onchain events that anyone can read directly.

Changes to the mandate, the verifier and the fee wait behind a timelock and arrive as notices in plain words. Before a change applies, depositors read what changed, how it moves risk and how much liquidity is free to exit.

Reporting is written for the sign-off. A risk committee reads decisions, costs and results against a benchmark it chose, and an auditor checks the same record straight from the chain.

Diligence on a curator's firm becomes a reading of its mandate.

Seven needs stand between pilot and production

Each one is a layer the vault standard already makes possible. Together they move a vault from pilot to production, and a Priime vault adds them as one layer.

Notice a depositor can act on. A timelock gives time to object, but only to depositors who see and read the change. Registered funds disclose material changes to their investors, and some changes need advance notice. Announced changes let depositors act before they apply, and give committees the notice they already expect.

A mandate that holds. Each change clears its timelock alone, so a mandate drifts one approved change at a time. Institutions invest under a written policy and test every position against it. With the limits onchain and every call checked against them, mandate compliance is easier to show, and depositors check the limits once.

Separation across parties. Owner, curator, allocator and Sentinel are separate permissions, and one team often holds them all. Auditors call the principle segregation of duties. It needs independent hands: one party decides, another verifies, a third holds the assets. When a quorum signs each result, a curator of any size shows that independence.

Parameters in words. A new oracle, cap or adapter is public the moment it is proposed, yet every institutional depositor pays an engineer to read it. Securities regulators expect key risks disclosed in plain English. A Priime vault states every action in plain words before it runs, which gets depositors and their committees through diligence faster and at lower cost.

Pricing before the move. An allocator moves liquidity on judgment and learns the cost afterwards. Here every reallocation carries its price before it runs: cost at size, gain and payback, against holding.

A neutral record. The curator reports on the curator, and a rating paid for by the vault it rates carries the same stake. Under the SEC Marketing Rule, an adviser that presents performance must be able to substantiate it and keep books and records. A record the execution writes itself, onchain, is easier to substantiate. Curators build a track record on it and compete on results, whatever their brand, while depositors cut the time and cost of due diligence.

A receipt. A share price shows the sum and hides the parts, while compliance signs off trade by trade and keeps the audit trail of each one. A receipt puts each estimate beside its result. The trail is then complete at settlement.

Four more requirements follow from the same design. Trust in most vaults rests on a firm's name and months of diligence, and a Priime vault moves it to the quorum, which re-runs every decision before it settles. Most vaults also report their own asset value. Here the quorum re-derives it from pinned, public inputs.

The share checks the same eligibility registry as its assets, so the holder rules those assets carry reach the share too. Exit terms usually live in documents outside the vault. A Priime vault publishes its requests, gates and notice periods as rules.

Stacked fees also block production

Every layer between the strategy and the capital takes a cut, and the institution pays for all of them. As @defi_made_here puts it, “DeFi was supposed to cut out the middleman”, yet a vault can end up “stacking as many as five layers of fees”. Integrators charge for placement and LP deals pay for liquidity. Curators charge onchain, and sometimes again offchain as consulting to asset issuers. Middleware is free for now.

The margin has moved from the fee into the flow. 1kx draws the line: an exchange lets an investor buy and hold, while DeFi lets them use the asset. Today that use is negotiated one whitelist and one curator at a time.

Distribution deals made sense when distribution was scarce. A vault that is a contract composes wherever contracts do.

Priime removes the layers between the strategy and the capital. A strategist composes a vault from verified modules on the Priime Build canvas, prices it at size and launches it on the Trustless Execution Network. Going to market then costs only the time and money of the work itself.

Independent strategists run their own vaults and are paid for the strategy alone, so value goes to whoever does the work. Foundation treasury managers and structuring desks launch directly, with the controls their committees require.

Priime takes one fee: 20% of a vault's growth after costs, taken only above its previous high, and no other. It is paid only when depositors earn.

Two moats sit under the vault

The platform decides what is worth doing, and the network proves it was done as written.

Priime Build prices every lane at size from measured quotes and replays it on each market's own history. The capital router moves only when a move is priced to pay back its cost. Dated data makes that hard to copy: rates and trade costs at a ladder of sizes, recorded every day, with every priced decision scored against what the market did next. Each day adds to that record.

The Trustless Execution Network makes offchain computation as checkable as a contract. Verifiable execution lives in the runtime, the operator set and the settlement contract at once, so a vault cannot bolt it on later. No single key or machine is trusted.

Priime sits beneath distribution, beside compliance and data. The issuer issues the asset, a policy layer says who may transact, an oracle prices it and an accounting layer books it. Priime proves what the manager did with it.

An incumbent can own issuance or a venue, and its own decisions still need someone else to verify them. Priime's own vaults run on the same terms every other vault gets.

Morpho's markets carry the flow

Morpho's vault standard already puts control in code. Vault V2 gives four roles their own permissions: the owner, the curator, the allocator and the Sentinel. Caps are a second control, bounding exposure per market and per adapter. A change that raises risk waits behind a timelock the Sentinel can cancel, and in-kind redemptions keep a way out when liquidity is tight. Midnight adds fixed terms, and the vault absorbs that complexity for depositors.

Priime extends that standard. A Priime vault composes Morpho markets and works inside the limits a Morpho curator sets, so the markets, the caps, the timelocks and the curator standard all come from Morpho. A curator on Morpho can build its vault on Priime and add a mandate every stakeholder can verify, with each decision re-run before it settles. Priime adds the execution an institution needs to move from pilot to production.

Capital that can read each decision leaves pilot for Morpho's markets.