Lending USDe Backing Assets into Kamino and Jupiter on Solana
Lending USDe Backing Assets into Kamino and Jupiter on Solana
Risk Assessment of the Proposed Isolated Instances
Prepared by: Kairos Research For: Ethena Risk Committee
1. Executive Recommendation
Kairos Research provisionally supports the listing of isolated lending instances for Ethena on both Kamino and Jupiter Lend, subject to the per-protocol blockers listed in the decision table at section 2 and the cap structure set out in section 7. Our recommendation distinguishes between the SOL-collateralized vaults, which look supportable at conservative caps once blockers are resolved, and the stable-collateralized vaults, which would benefit from running as small capped pilots before scaling to full launch caps. Throughout this report, LTV refers to the loan-to-value ratio at which a position can be opened and LLTV (liquidation loan-to-value) refers to the threshold above which a position becomes liquidatable; the gap between the two is the buffer that absorbs price movement between liquidation triggers.
Both protocols look ready to launch in parallel as soon as their respective blockers are resolved. Kamino has the more developed risk-control framework, with explicit supply, borrow, daily new-debt and daily withdrawal caps; auto-deleverage as a backstop; and an active Immunefi bug bounty with a $1.5M maximum critical payout. A dedicated Ethena Market already exists onchain with USDe and sUSDe reserves at 70% and 60% maxLTV respectively, alongside placeholder reserves for USDC, USDG, USDT, and PYUSD that are configured at zero maxLTV today. Kamino’s Main Market also runs a USDG reserve at 80% maxLTV with $30.6M of supply against $28.8M of borrow at 94.3% utilization, validating the asset at meaningful scale at the protocol level. The principal Kamino-side blocker is final confirmation of the production parameter set Kamino intends to deploy under this proposal, specifically the supply and borrow caps, the daily new-debt and daily withdrawal caps, the rate curves, the oracle aggregator configuration, and the admin authority for parameter changes on the dedicated Ethena Market. The current onchain reserve configuration on the Ethena Market is publicly inspectable on the Kamino reserve info-risk page, but the production parameter set for the launch is not yet finalized at the parameter level the committee needs to size caps against.
Jupiter Lend’s nine-month production track record materially reduces the protocol-novelty concern; the protocol has processed 19,478 lifetime liquidate-instruction calls across 78 borrow vaults, with February 2026 (6,766 calls) exceeding the October 2025 stress month in absolute throughput, and with no observed bad debt over the period. Jupiter also has a live bug-bounty program with OOOsec which can be viewed here. The bounty covers all Jupiter products, including but not limited to Jupiter Lend.
2. Decision Table
| Protocol | Vault (Collateral / Debt) | Recommendation | Blockers |
|---|---|---|---|
| Kamino | SOL / USDe | Support with conditions | Ethena Market configuration disclosure |
| Kamino | SOL / USDG | Support with conditions | Ethena Market configuration; USDG holder identification; issuer context for the supply contraction |
| Kamino | SOL / JupUSD | Support with conditions | Ethena Market configuration; JupUSD oracle path |
| Kamino | USDe / USDG | Support with conditions | Ethena Market configuration; issuer context for the USDG contraction |
| Kamino | USDe / JupUSD | Support with conditions | Ethena Market configuration; JupUSD oracle path |
| Jupiter Lend | SOL / USDe | Support with conditions | None outstanding |
| Jupiter Lend | SOL / USDG | Support with conditions | USDG holder identification; issuer context for the contraction |
| Jupiter Lend | SOL / JupUSD | Support with conditions | JupUSD oracle path |
| Jupiter Lend | USDe / USDG | Support with conditions | Issuer context for the USDG contraction |
| Jupiter Lend | USDe / JupUSD | Support with conditions | JupUSD oracle path |
3. Proposed Parameters and Production Benchmarks
The parameter set summarized below is the working reference used for the analysis in this report. The Jupiter Lend isolated instance is expected to deploy at these parameters, and Kamino’s dedicated Ethena Market is configured onchain with USDe at 70% maxLTV and sUSDe at 60% maxLTV, with the corresponding rate curves, caps, and oracle configuration publicly inspectable on the Kamino reserve info-risk page for the live reserves. The two protocols are expected to deploy under broadly similar parameters in the production launch, with any divergence between the two surfaced in the per-protocol blockers in section 2.
| Collateral | Debt | Max LTV | Liquidation LTV | Borrow Rate at 90% util | at 95% | at 99.9% | Oracle |
|---|---|---|---|---|---|---|---|
| SOL | USDe | 72% | 75% | 3.0% | 6.0% | 10.0% | SOL: Pyth / Chainlink; USDe: peg to USDT |
| SOL | USDG | 72% | 75% | 3.3% | 6.5% | 10.0% | Pyth / Chainlink |
| USDe | USDG | 90% | 93% | 3.3% | 6.5% | 10.0% | Peg to USDT |
| USDe | JupUSD | 90% | 93% | 3.3% | 6.5% | 10.0% | Peg to USDT |
| SOL | JupUSD | 72% | 75% | 3.3% | 6.5% | 10.0% | Own oracle path |
Both protocols already operate vaults at parameters more aggressive than those proposed for this instance. Jupiter Lend’s eight live WSOL-collateral vaults run at 80% LTV and 85% LLTV with a 1% liquidation penalty, with the largest of them, WSOL / USDC, supporting $161M of supplied collateral against $64M of borrow. The protocol’s eight live stable-collateral vaults run at 90% / 92% (syrupUSDC-collateral) or 89% / 91% (jlJupUSD-collateral) with a 2 percentage point buffer, with syrupUSDC / USDC ($15.7M supply) and jlJupUSD / USDC ($42.1M supply) as representative deployments. The proposed 72% / 75% for SOL collateral is therefore eight percentage points more conservative on LTV than the live SOL / USDC standard, and the proposed 90% / 93% for stable-collateral vaults is one percentage point more conservative on the buffer than the most aggressive live stable-collateral vault. Kamino’s Main Market currently runs SOL at 74% maxLTV ($259M supply), USDC at 80% ($162M), and USDG at 80% ($30.6M, 94.3% utilization, realized borrow APY 7.28%).
The interest-rate curve proposed in this instance is worth benchmarking against Kamino’s live USDG reserve before launch. Kamino’s USDG reserve is currently realizing a 7.28% borrow APY at 94.3% utilization, while the proposal sets a 3.3% rate at 90% utilization rising to 6.5% at 95% and 10% at 99.9%. The proposed curve appears to underprice the borrow demand observed today on Solana in the 90 to 95 percent utilization band, which would compress lender yield and could keep utilization pinned near the cap rather than letting the rate curve clear demand. A steeper slope through the 90 to 95 percent utilization band would be more consistent with the rates the same demand is paying on Kamino’s existing USDG reserve, and the protocol teams would be better placed than Kairos Research to translate that into a specific kink-and-slope choice.
4. Asset Risk Profiles
This section profiles the four assets in the proposed instances. USDe, SOL, and USDG serve as collateral assets, while USDe, USDG, and JupUSD serve as borrowable assets; USDe and USDG each appear on both sides depending on the vault. Pyth and Chainlink Solana feed identifiers are listed in Appendix B and mint addresses appear in Appendix A.
4.1 USDe
USDe is implemented on Solana under the legacy SPL Token program, decimals 9, with no freeze authority and no Token-2022 surface area, which makes it materially the cleanest of the three collateral assets at the mint level. The asset reaches Solana exclusively through a LayerZero OFT pathway, with no native Solana issuance program: the mint authority is owned by a per-token OFT program at 9S6fwN8gZsr3ikUH38QWPDbLzyJTYcQd5GtrEWzoS2y9, which mints USDe in response to inbound OFT messages from peer chains and burns it on outbound messages. Solana USDe supply is therefore demand-responsive through bridging rather than supply-constrained at the current 3.30M standing balance, and depositors can bridge in at the moment of deposit and bridge out at the moment of withdrawal. The OFT program is upgradeable, with upgrade authority residing at EWZCJs2JRo3tMKgDt8FGx7MccD8sKv4QEcdsY9ZhVKZA, which means that whichever party holds this key can modify the OFT program logic, including peer-chain configuration and DVN routing. The same key is also the freeze authority on the Solana sUSDe mint at Eh6XEPhSwoLv5wFApukmnaVSHQ6sAnoD9BmgmwQoN2sN, so its custody arrangement is material to both assets.
The Pyth USDe / USD feed has held within a 0.38% maximum hourly deviation over the twelve-month observation window, with a 99th-percentile absolute deviation of 0.16% and only three hours of deviation above 0.25%. Hourly behavior fits comfortably inside both the 4% SOL-collateral buffer and the 3% stable-collateral buffer.
The October 10, 2025 stress event raised the only non-trivial USDe question in the proposal, and it is a question of oracle behavior rather than asset behavior. At 1-minute resolution the Pyth global aggregate for USDe transiently printed $0.9592 (a 4.07% deviation from peg) at 21:27 UTC, coincident with the SOL low to the minute. On-Solana DEX trades from dex_solana.trades showed median USDe / USDC implied price of $1.0000 across the window, with no Solana-DEX print approaching the global Pyth low. The deviation reflects centralized exchange price action that did not propagate to on-Solana DEX flow, while the Pyth Solana receiver was being updated 100 to 280 times per minute throughout the same window and was therefore not stale. The committee’s question is consequently not whether USDe depegged on Solana, which it did not, but how each protocol’s oracle integration responds when the global Pyth aggregate diverges from on-Solana DEX flow during a sub-minute spike.
The live oracle integration prices the USDe leg of every vault at a USDT peg rather than reading it from a Pyth feed. The Pyth USDe / USD analysis above is therefore background context on USDe price behavior rather than a description of the live integration. Kamino’s Ethena Market has a dedicated sUSDe reserve at 60% maxLTV alongside the USDe reserve at 70% maxLTV.
A separate practical question on this asset is whether Ethena itself would seed supply on the SOL / USDe vaults. Ethena holds spot SOL on the long leg of its delta-neutral USDe backing portfolio, which gives Ethena a natural reason to supply SOL into the SOL / USDe vault and borrow USDe against it, which would effectively unlock liquidity from a long-spot position that would otherwise sit idle on the balance sheet. Ethena could also supply USDe directly into the vault as a yield-bearing deployment of USDe inventory. Either pathway would compress reliance on third-party seed liquidity for the SOL / USDe vault on Solana and would lower the practical risk that the vault opens with a thin USDe lender book during the bridge-monitored cap window. Whichever pathway is used, the relevant supply concentration concentrates on Ethena rather than disperses across third parties, which is worth noting for the concentration item in section 5 even though the originator is the same entity sponsoring the proposal.
4.2 SOL
SOL is the only volatile-asset collateral in the proposal and the asset most likely to drive cascade-style liquidation behavior under stress. The forward-realized drawdown distribution over the past twelve months is summarized in the table below, where each row reports, for every entry hour H, the worst close-to-close drop over the next N hours.
| Horizon | Min realized drawdown | p1 | p0.5 | p0.1 | Share of entries breaching 4% |
|---|---|---|---|---|---|
| 1h | -5.46% | -2.15% | -2.77% | -4.35% | 0.17% |
| 4h | -9.51% | -4.90% | -5.60% | -7.35% | 1.91% |
| 12h | -17.98% | -7.51% | -8.92% | -14.02% | 9.15% |
| 24h | -18.33% | -10.91% | -13.50% | -17.20% | 21.63% |
| 72h | -27.90% | -20.20% | -22.85% | -26.88% | 45.32% |
A position entered at 72% LTV requires approximately a 4% drop in SOL relative to entry to cross 75% LLTV. The buffer is sufficient at one-to-four-hour liquidation latency, where 0.17% to 1.91% of entries breach, and is challenged at 24-hour latency, where 21.63% of entries breach. Both protocols clear positions within the four-hour bar in their production track records, which is the relevant benchmark for buffer adequacy.
The one-year window understates tail risk relative to a longer history. Over the three-year window from May 2023 to May 2026 (26,256 entry hours), the 99th-percentile 24-hour drawdown is -13.0% versus -10.9% in the one-year window, and the worst single 24-hour drawdown was -27.2% on June 9, 2023. The October 10, 2025 stress (-22.2% peak-to-trough at 21:27 UTC) is therefore not the upper bound on plausible future stress.
SOL is the only asset in the proposed set with both Pyth and Chainlink Solana coverage, which gives the protocols a real oracle fallback if either feed degrades. Pyth pricing for SOL stayed live throughout the October 10 stress event with no observed staleness, so feed availability is not a constraint on this asset.
4.3 USDG
USDG is the third-party regulated stablecoin in the collateral and debt set, and it carries the most distinctive risk surface of the three primary stablecoins. The mint is implemented on the Solana Token-2022 program, decimals 6, with current supply of 632.3M USDG per the live getTokenSupply reading (May 7, 2026). The mint exposes eight Token-2022 extensions, of which three matter for lending integration: PermanentDelegate is active, with the authority residing at 2apBGMs...JjK, which means Paxos can move any holder’s USDG without first freezing the address (a stronger capability than the freeze-then-wipe sequence available on Ethereum); TransferFeeConfig is structurally enabled but the active rate is 0%; and TransferHook has its authority slot configured but with program_id set to None, indicating that no transfer-hook program is currently installed. Both the TransferFeeConfig and TransferHook slots can be activated unilaterally without changing the mint structure. Notably, the PausableConfig extension described in the LlamaRisk Backing Asset Review for USDG’s Ethereum implementation is not present at the Solana mint level, which means that any equivalent network-wide pause behavior on Solana would have to be effected through PermanentDelegate activity or a freeze-authority sweep, both of which are observable onchain.
USDG uses a hybrid issuance model on Solana that combines native Paxos minting with LayerZero OFT bridge minting under a single mint authority. The mint authority is itself a Token-2022 multisig with numRequiredSigners of one and numValidSigners of four, which means that any single signer can mint USDG. Two of the four signers are PDAs of the LayerZero OFT program at G1SRHec1Mig66xKJ169kmmVRy4WX81VLKCUfdExThQdo, one signer is a PDA of Paxos’s native mint controller at paxosVkYuJBKUQoZGAidRA47Qt4uidqG5fAt5kmr1nR (which is immutable, with no upgrade authority), and the remaining signer is the central Paxos admin key. The architecture is more permissive than a quorum multisig but partially mitigates the LayerZero dependency, since native Paxos issuance and redemption can continue on Solana even if the OFT path is paused. The upgrade authority on the USDG OFT program itself is an open item for issuer-team confirmation.
The historical supply trajectory shows that USDG Solana supply peaked near $1.27B on April 16, 2026 and has approximately halved in the three weeks since, with the steepest declines on April 25 to 28, 2026 and a partial stabilization in the days approaching the May 7 snapshot. The cause of the contraction is not visible onchain. Cap-setting in this report uses the current 632M supply, with re-rate triggers tied to either stabilization at $750M or further movement below $300M; issuer-team attribution for the contraction would inform the trigger weighting and is the highest-priority pre-launch item on the USDG side.
For context outside the proposal under review here, a Llamarisk review titled “USDG as USDe Backing Asset” was published to the Ethena governance forum on May 7, 2026, examining USDG as a backing asset for USDe in the opposite direction from the lending instances reviewed here. That review reports an aggregate USDG circulating supply of $1.70B as of March 30, 2026 (across all chains, with $450M on Ethereum) and notes “conservatively managed reserve structure” and multi-jurisdictional regulatory coverage as supportive factors. The review predates the April-to-May 2026 Solana-side contraction discussed above and does not address Solana-specific liquidity or holder concentration. Cross-reference: gov.ethenafoundation.com/t/usdg-as-a-usde-backing-asset/782.
It is important to note that upon further review this supply contraction appears to be specific to Solana rather than a global supply contract. The Solana specific contraction appears to be more of a liquidity shift over to OKX’s X Layer chain as you can see in the chart below.
Holder concentration on Solana is materially higher than the comparable global figure cited in the LlamaRisk review. The top 5 owner-wallets hold 67.91% of Solana USDG supply, with the three largest holding 150.0M, 110.7M, and 64.7M respectively. Cross-reference of the top 5 owner-wallets against Arkham Intelligence resolves the two largest concentrations to institutional custody infrastructure rather than individual private holders: the largest wallet 6427KSf...VpJxF is held in Fireblocks Custody with the exact 150,000,000 balance consistent with treasury or programmatic issuance, and the 2nd largest BLhb4HL...8au1J is held in Bitgo Custody with regular two-way flows against a paired Bitgo address (GKHoU...). These two wallets represent 44.5% of Solana USDG supply and are most plausibly Paxos’s own treasury custody arrangements or institutional Paxos clients holding USDG via these custody platforms. The 3rd, 4th, and 5th largest wallets are unlabeled in Arkham at the time of this review.
Onchain liquidation routing on Solana for the USDG-debt vaults runs principally through USDC. Aggregate USDG depth across twelve active pools is $31.85M as of May 2026, dominated by the Orca USDG / USDC pool at $16.06M. Jupiter aggregator quotes show that the USDG to USDC route clears $10M with under 0.2% slippage and cliffs sharply between $10M and $25M (60.9% slippage at $25M), and that the USDG to USDT direct route cliffs at $5M (31.9% slippage). The direct USDe / USDG path on Solana DEXes is thin at every relevant size, with the aggregator routing all USDe-to-USDG flow through USDC in four hops. This is not a binding constraint on the proposal, since liquidators can route through the USDC pair (the deeper Solana side) and cross-chain solvers can source incremental USDG liquidity from peer chains where deeper books exist. The practical implication is that the USDG / USDC depth on Solana is the figure that scales with the protocol-set borrow caps for USDG-debt vaults.
Both protocols have already processed USDG-debt liquidations at small scale: Kamino accumulated 86 events totaling $73K of debt repaid over the twelve-month observation window, with a maximum single event of $16K (USDG / jitoSOL), and Jupiter Lend processed 176 USDG-debt events totaling $47K during the October 10 five-day stress window, with a maximum single event of $10.4K (jupSOL / USDG). The asset is production-validated as a debt asset on both protocols, but only at the per-event sizes reflected in the existing track record.
4.4 JupUSD
JupUSD is a Solana-native stablecoin issued by Jupiter and operated on Ethena’s Stablecoin-as-a-Service infrastructure. The official transparency page at jupusd.money/transparency discloses the following architecture, and Kairos Research independently verified each component via Solana RPC. Reserves are held in two USDC custodian wallets operated by Porto on Solana (B3q4P4XSmycvoHLaiEjchsGDafFPhKokvHvNRuW29N1y and 7i6ELgCKhZewDPg4P91w9FYpWKrSx7ptiNrUCrBarHff, holding approximately $4.3M of USDC combined at the time of inspection) plus an Ethereum-side USDtb position custodied by Porto through Anchorage Digital. The published reserve composition target is approximately 90% USDtb and 10% USDC, with the USDC tranche providing immediate redemption liquidity through a Meteora pool. Day-to-day reserve operations are managed by Ethena. USDe is planned as a secondary backing asset at a later date.
The mint is JuprjznTrTSp2UFa3ZBUFgwdAmtZCq4MQCwysN55USD, runs on the legacy SPL Token program, decimals 6, and has both freeze authority and mint authority assigned to CkzLnD9r4d4ZZofsgNVo2VNunxDmte5YJ4vfAgMfBZNA. That account is a program-derived address rather than a wallet or multisig: it is controlled by the JupUSD MintRedeem Program at JUPUSDecMzAVgztLe6eGhwUBj1Pn3j9WAXwmtHmfbRr, an upgradeable BPF program whose upgrade authority sits at 31wgH9Czzd3qgquTGxVxtxJuzBd8Fm4xEo8rPX7CNfhM. Whoever holds that upgrade-authority key effectively controls JupUSD issuance and freeze, since they can replace the program logic that the mint and freeze authorities defer to. JupUSD therefore carries an issuance and freeze surface that USDe does not, but the surface is mediated by code rather than a directly-callable key, and the operative custody question becomes the custody arrangement on the upgrade authority. The JupUSD codebase underwent three independent security audits (Offside Labs, Guardian Audits, Pashov Audit Group) prior to deployment.
JupUSD’s risk profile differs from both USDe and USDG along several dimensions that matter for this proposal. The collateral is short-duration U.S. Treasuries via USDtb. The asset shares an issuer-infrastructure dependency with USDe given the Stablecoin-as-a-Service relationship, which means that the proposed USDe / JupUSD vault is not fully diversified across issuers and that a single point of failure in Ethena’s operational stack would affect both legs simultaneously; backing-correlation risk on this pair is therefore asymmetric rather than symmetric. JupUSD has verified Chainlink Solana coverage at account ALqc1QM6...kT4X9 (decimals 6). A Pyth JupUSD feed is published by the Pyth Network but the specific feed identifier and on-Solana update cadence have not been independently verified in this review and are flagged as a pre-launch confirmation item; with that confirmation, JupUSD would be the only stablecoin in the borrowable set with dual-feed Solana redundancy unavailable to USDe or USDG. JupUSD is Solana-native and therefore carries no cross-chain bridge dependency, in contrast to both USDe and USDG, which depend on LayerZero OFT pathways for Solana inflows and outflows. The asset is deeply embedded in Jupiter Lend itself, with $63M-plus of active borrows across nine vaults including JLP / JupUSD ($30.4M supply, $22.5M borrow) and PST / JupUSD ($24.1M supply, $20.2M borrow), which gives Jupiter Lend operational confidence in routing JupUSD liquidations on its own venue but says nothing about external Solana DEX depth or cross-venue routing performance, which has not been independently quantified in this review.
Two items on JupUSD remain open and warrant issuer-team confirmation before launch. The first is the JupUSD pricing leg for the proposed USDe / JupUSD vault: the USDe leg is pegged to USDT under the simplified oracle, but the JupUSD leg has not been explicitly specified, and confirmation is required on whether it is sourced from Pyth, from the Chainlink Solana JUPUSD feed, or from a USDtb redemption-rate source, including the staleness threshold for whichever source is used. The second is the custody arrangement on the MintRedeem Program upgrade authority at 31wgH9Czzd3qgquTGxVxtxJuzBd8Fm4xEo8rPX7CNfhM, since that key controls the program that holds JupUSD’s mint and freeze authority PDAs.
5. Cross-Asset Stress Behavior
The October 10, 2025 stress is the most informative real-world data point for evaluating the proposed instances under correlated stress. The relevant snapshot at 1-minute resolution shows SOL falling from $220.05 at the open of the stress hours to $171.22 at 21:27 UTC (a 22.2% peak-to-trough decline) and recovering to $196.70 at the close of the day; the Pyth global USDe aggregate dipped to $0.9592 at the same minute as the SOL low; and the Pyth global USDG aggregate touched $0.9767 at 22:12 UTC. The realistic stress scenario for this proposal is therefore correlated, with every collateral-asset price moving the wrong way for a borrower simultaneously, even where on-Solana DEX flow holds tighter than the global Pyth print.
Each proposed vault would have behaved as follows under the actual conditions: the SOL / USDe and SOL / USDG vaults at 72% / 75% would have liquidated SOL collateral aggressively during 19:00 to 22:00 UTC, with individual liquidation sizes at the order of $148K (the Jupiter Lend October 10 maximum) fitting comfortably inside the available USDG / USDC depth on Solana DEXes; the USDe / USDG vault at 90% / 93%, had it existed, would have come under simultaneous pressure on both legs, and whether the protocol would have liquidated depends entirely on the oracle aggregation logic that remains the principal pre-launch open item; and the USDe / JupUSD vault would have come under pressure on the USDe collateral leg with the JupUSD liability partially insulated by its independent USDtb backing.
The production behavior of both protocols during the stress is strong production evidence that the SOL-collateral engines clear positions within the relevant buffer window, with the strongest part of that evidence coming from Jupiter Lend’s stress-day cohort given the modest absolute volume on Kamino on the same day. Jupiter Lend processed 900 liquidations totaling $2.87M of debt repaid across the five-day window of October 8 to 12, with nine unique liquidators capturing $77.6K of aggregate liquidator profit (2.7% on volume) and a maximum single event of $148,421. The 21:00 UTC stress hour alone cleared $966K across 101 events, demonstrating that the engine can process more than a hundred liquidations within a single hour against a SOL drawdown still in flight. The Zenith H1 audit finding (denial-of-service if a transaction loads more than 64 Solana accounts) has not produced observable failures across nine months of production, including the February 2026 6,766-call month that exceeded October 10 in absolute throughput.
Kamino’s October 10 behavior was modest by comparison, with approximately thirty liquidations across the day and a maximum single event of $11.5K (USDC / jupSOL at 18:07 UTC), reflecting the lower TVL exposure to volatile-collateral / stable-debt vaults at the time. Across the full twelve-month observation window, Kamino has processed 2,132 lifetime liquidations totaling $1.27M of debt repaid, with a maximum single event of $218K (USDC / jitoSOL, June 2025) and no observed bad debt.
Liquidator concentration is the underweighted operational risk identified by this stress observation. Only nine unique liquidators participated in the Jupiter Lend October 10 stress, and only twenty-nine wallets have been observed across the full nine-month protocol lifetime. Kamino has been served by thirteen wallets over the twelve-month window. A simultaneous outage of the top three liquidators on either protocol during a future stress event remains a tail risk that warrants an explicit protocol-side contingency procedure.
For SOL-collateralized positions at the proposed parameters, the production data therefore provides direct evidence that the engines clear positions within the 4-hour latency bound implied by the buffer. For stable-collateralized positions at the proposed parameters, the binding constraint shifts from engine speed to onchain swap depth, with the USDG / USDC route on Solana clearing $10M cleanly before cliffing.
6. Protocol-Level Assessment
Kamino is the more mature of the two protocols, with 3.5 years of production operation, $1.43B of Solana TVL, and a documented risk-control framework that includes explicit supply, borrow, daily new-debt, and daily withdrawal caps; an E-Mode configuration system; and an auto-deleverage backstop activatable through governance. Kamino runs an active Immunefi listing with a $1.5M maximum critical payout and uses the Scope oracle aggregator with redundant providers, oracle cranks, and dedicated liquidator infrastructure. The dedicated Ethena Market exists onchain at the parameters indicated above, with USDe and sUSDe reserves carrying live maxLTV settings and the corresponding rate-curve, cap, and oracle configuration publicly inspectable on each reserve’s Kamino info-risk page. The Kamino-side blocker is final confirmation of the production parameter set the protocol team intends to deploy under this proposal once the dedicated market loads with deposits, including the liquidation threshold, supply caps, borrow caps, E-Mode configuration, Scope oracle source mix, and admin authority for parameter changes on the dedicated market.
Jupiter Lend operates a Squads multisig with a 12-hour timelock on the upgrade authority. The timelock was initially set to one hour at deployment in November 2025 and extended to 12 hours within a week. The protocol’s source code is closed, although the public Code4rena competitive audit during February 12 to March 13, 2026 exposed the full ~15,195 nSLOC codebase to participating security researchers. Parameters are admin-set rather than permissionless, and the protocol is covered by Jupiter’s live OOOsec bug bounty (ooosec.com/programs/jupiter), which applies across all Jupiter products including Jupiter Lend. The protocol’s production track record (78 borrow vaults, $621M of active borrows, 19,478 lifetime liquidations, peak month 6,766 calls) materially reduces the protocol-novelty concern.
The combined picture supports a concurrent deployment in which both protocols launch as soon as their respective blockers are resolved. Jupiter Lend’s nine-month production track record and the throughput observed in February 2026 mitigate the protocol-novelty concern that would otherwise argue for sequencing, and the residual asymmetry between the two protocols (Kamino’s more explicit cap and circuit-breaker primitives, Jupiter Lend’s higher liquidator-throughput track record) is monitored continuously rather than through a launch delay. The Kamino-side critical path is disclosure of the production parameter set for the dedicated Ethena Market; Jupiter Lend has no equivalent launch blocker outstanding.
7. Recommended Launch Conditions and Caps
Supply and borrow caps are left to the protocol teams to set within their existing risk-control frameworks. The relevant onchain reference points are USDG / USDC depth on Solana DEXes (clears $10M cleanly and cliffs sharply above that) and per-event liquidation maxima observed over the twelve-month window ($148K Jupiter Lend, $218K Kamino). Solana USDe supply is not a binding cap constraint, since the LayerZero OFT pathway documented in section 4.1 lets depositors bridge in on demand; the bridge-pause contingency is monitored separately under section 8.
| Vault | Max LTV | Liquidation LTV | Initial Supply Cap |
|---|---|---|---|
| SOL / USDe | 72% | 75% | TBD |
| SOL / USDG | 72% | 75% | TBD |
| SOL / JupUSD | 72% | 75% | TBD |
| USDe / USDG | 90% | 93% | TBD |
| USDe / JupUSD | 90% | 93% | TBD |
Each protocol launches as soon as its own blockers are resolved. A cap re-evaluation at T+30 days from each protocol’s own go-live, run independently, picks up observed liquidation performance, USDG supply trajectory, USDe Solana issuance growth, and routing-depth growth.
Upward re-rate trigger (all three required): USDG Solana supply at or above $750M for seven consecutive days; aggregate USDG / USDC plus USDG / USDT Solana DEX depth above $50M; no bad-debt event in the prior 30 days. Downward re-rate or pause trigger (any one): USDG Solana supply below $300M; any top-twelve USDG DEX pool dropping out by liquidity; any bad-debt event; Pyth global aggregate diverging from on-Solana DEX flow by more than 200 bps for more than 60 seconds; pause or operational degradation on the LayerZero OFT pathway for either USDe or USDG.
8. Monitoring Framework (Optional)
Post-launch monitoring should run continuously across the items in the table below. Alert thresholds are calibrated to either the cap structure in section 7 or to the diligence items that have not been resolved at launch.
| Item | Cadence | Alert Condition |
|---|---|---|
| USDG Solana total supply | Daily | More than 5% net outflow in a single day |
| USDe Solana standing balance and OFT inflow / outflow | Daily | Net outflow exceeds protocol-held USDe collateral by 10% in any 24-hour window |
| LayerZero OFT health on the USDe and USDG pathways | Real-time | Any pause, DVN failure, or unusual delivery latency on the relevant peer-chain paths |
Upgrade-authority key activity (EWZCJs2J...VKZA for USDe OFT and sUSDe freeze) |
Real-time | Any signed transaction from this key |
| Top 5 USDG owner-wallet movements | Real-time | Any net transfer above 5M USDG |
| Pyth USDe / USDG global aggregate vs on-Solana DEX trade-implied price | Hourly | Divergence above 50 basis points |
| Liquidation event log on each protocol | Per-event | Time from threshold breach to execution above 30 minutes; bad debt of any size |
| Liquidator concentration | Per stress day | Fewer than three liquidators participating |
| Vault utilization | Hourly | Above 90% |
| Paxos administrative actions on USDG Solana mint | Real-time | Any TransferHook installation, TransferFee activation, or PermanentDelegate movement on protocol-controlled accounts; mint by any of the four multisig signers in unusual size; freeze of any address holding more than 1M USDG |
| Jupiter Lend multisig transactions | Per transaction | Any parameter change or upgrade |
The monitoring framework should be operational from the first protocol’s go-live and should produce a weekly committee summary covering the prior week’s alerts, any cap utilization above 50%, and any movement on the pre-launch blockers for either protocol.
Appendix A. Asset Identifiers
| Asset | Solana Mint | Token Program |
|---|---|---|
| USDe | DEkqHyPN7GMRJ5cArtQFAWefqbZb33Hyf6s5iCwjEonT |
Legacy SPL Token |
| sUSDe | Eh6XEPhSwoLv5wFApukmnaVSHQ6sAnoD9BmgmwQoN2sN |
Legacy SPL Token |
| SOL (wrapped) | So11111111111111111111111111111111111111112 |
Legacy SPL Token |
| USDG | 2u1tszSeqZ3qBWF3uNGPFc8TzMk2tdiwknnRMWGWjGWH |
Token-2022 |
| JupUSD | JuprjznTrTSp2UFa3ZBUFgwdAmtZCq4MQCwysN55USD |
Legacy SPL Token |
| USDC | EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v |
Legacy SPL Token |
| USDT | Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB |
Legacy SPL Token |
Bridge and Mint-Authority Programs (verified via Solana RPC, May 2026)
| Component | Address | Status |
|---|---|---|
| USDe OFT program (Ethena per-token deployment) | 9S6fwN8gZsr3ikUH38QWPDbLzyJTYcQd5GtrEWzoS2y9 |
Upgradeable; upgrade authority EWZCJs2JRo3tMKgDt8FGx7MccD8sKv4QEcdsY9ZhVKZA |
| USDe Solana mint authority (PDA of OFT program above) | 4x3oQtX4MhjTKGBeXDZbtTSLZ9cUWo5waN2UChAuthtS |
OFT-program-controlled |
| USDG OFT program (Paxos per-token deployment) | G1SRHec1Mig66xKJ169kmmVRy4WX81VLKCUfdExThQdo |
Upgrade authority to confirm with the issuer team |
| USDG native mint controller (Paxos) | paxosVkYuJBKUQoZGAidRA47Qt4uidqG5fAt5kmr1nR |
Immutable (no upgrade authority) |
| USDG mint authority (Token-2022 1-of-4 multisig) | 3YJL8sesK3ooPpJddypvFUhCvnvaQ1oF8This4J3bhxR |
Signers: Paxos admin key, two OFT-program PDAs, one native-controller PDA |
| USDG PermanentDelegate / freeze / fee / hook authority | 2apBGMsS6ti9RyF5TwQTDswXBWskiJP2LD4cUEDqYJjk |
Single Paxos admin key |
| sUSDe Solana freeze authority | EWZCJs2JRo3tMKgDt8FGx7MccD8sKv4QEcdsY9ZhVKZA |
Same key as USDe OFT upgrade authority |
| JupUSD MintRedeem Program | JUPUSDecMzAVgztLe6eGhwUBj1Pn3j9WAXwmtHmfbRr |
Upgradeable; upgrade authority 31wgH9Czzd3qgquTGxVxtxJuzBd8Fm4xEo8rPX7CNfhM |
| JupUSD mint and freeze authority (PDA of MintRedeem Program) | CkzLnD9r4d4ZZofsgNVo2VNunxDmte5YJ4vfAgMfBZNA |
Program-derived, no separate account state |
| Porto Custodian Wallet 1 (JupUSD reserves, USDC) | B3q4P4XSmycvoHLaiEjchsGDafFPhKokvHvNRuW29N1y |
Disclosed on the official JupUSD transparency page |
| Porto Custodian Wallet 2 (JupUSD reserves, USDC) | 7i6ELgCKhZewDPg4P91w9FYpWKrSx7ptiNrUCrBarHff |
Disclosed on the official JupUSD transparency page |
Appendix B. Oracle Feed Identifiers
Pyth feed identifiers (verified via Hermes /v2/price_feeds, May 2026):
| Pair | Hex Feed ID |
|---|---|
| SOL / USD | ef0d8b6fda2ceba41da15d4095d1da392a0d2f8ed0c6c7bc0f4cfac8c280b56d |
| USDe / USD | 6ec879b1e9963de5ee97e9c8710b742d6228252a5e2ca12d4ae81d7fe5ee8c5d |
| sUSDe / USD | ca3ba9a619a4b3755c10ac7d5e760275aa95e9823d38a84fedd416856cdba37c |
| USDG / USD | daa58c6a3ce7d4b9c46c32a6e646012c17c4a2b24c08dd8c5e476118b855a7da |
Chainlink Solana feed accounts (verified via reference-data-directory, May 2026):
| Pair | Account | Decimals |
|---|---|---|
| SOL / USD | B4vR6BW4WpLh1mFs6LL6iqL4nydbmE5Uzaz2LLsoAXqk |
8 |
| BTC / USD | 4NSNfkSgEdAtD8AKyyiu7QsavyR3GSXLXecwDEFbZCZ3 |
8 |
| JUPUSD / USD | ALqc1QM6WcyQBjF6Pxew6tMq32Qo7tRSJpaErcnTpGcz |
6 |
USDe and USDG have no Chainlink Solana coverage as of May 2026, which leaves Pyth as the sole onchain oracle option for those assets and informs the staleness and confidence-interval policy that the protocol teams should specify before stable-collateral vault launch. A Pyth JupUSD feed is published by the Pyth Network but the specific feed identifier and on-Solana update cadence have not been independently verified in this review and are flagged as a pre-launch confirmation item.