Skip to content
PROTOCOL RESEARCH

Jupiter risk

Solana's dominant DeFi suite (swap router, ~$730M JLP perps pool, young Fluid-based lender, JupSOL LST, launchpad, JUP token) runs a real ~$410M/yr fee engine with no exploit of its own programs on record, but upgradeable programs with only partly verified upgrade authorities, JLP's trader-counterparty tail risk (now mid-swap into Jupiter's own JupUSD), a sub-year lending arm, and 2025's governance trust breakdown hold it at caution.
CautionResearched Jul 3, 2026

Scorecard

watch: Audits & contractsLend is heavily audited (7 audits by 4 firms plus Certora and Code4rena, verified); the perps and router audit inventory was not re-verified this run, and nothing in the suite is immutable.
watch: Admin controlAll Solana programs are upgradeable; Lend's authority is a confirmed 4-of-7 multisig with a 12h timelock, but the perps/JLP (~$730M pool) and router upgrade-authority configs are unverified this run.
strong: OraclePerps execute at aggregated oracle prices (Edge by Chaos Labs primary, Chainlink and Pyth verify, 2-of-3 required, per Jupiter's docs); Lend runs Pyth, Chainlink and RedStone hops; no oracle incident found on any component.
watch: Liquidity & exitThe aggregator holds nothing; JLP (~$730M pool per DeFiLlama, ~$837M token mcap) makes holders the traders' counterparty, and a planned ~$500M USDC-to-JupUSD backing swap is underway; Lend exits ride one shared rehypothecated pool.
strong: Yield (real vs emission)About $410M in fees over the last year and $1.07B all-time (DeFiLlama); JLP earns perps fees, Lend earns borrow interest, and 50% of revenue funds JUP buybacks (~$70M in 2025); emissions are being pushed toward net zero for 2026.
watch: Holder concentrationHalf the 10B JUP supply is team-managed (20% earmarked for current team members) and team voting weight triggered the 2025 DAO revolt; only ~33% circulates; onchain top-holder and JLP depositor splits not pulled this run.
watch: Track recordNo exploit of Jupiter's own programs since 2021 and a clean May-Jul 2026 scan, but 2025 brought a hijacked X account, the LIBRA scandal next door at Meteora, a DAO vote pause over broken trust, and a retracted Lend safety claim; Lend is under a year old.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL—
30dflat
Auditsn/a
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

Jupiter is the closest thing Solana has to a DeFi operating system: the dominant swap router, a top perps venue with the ~$730M JLP pool as counterparty, a young money market built on Fluid tech, the JupSOL LST, DCA and limit orders, a launchpad, a mobile app, and the JUP token with its DAO on top. The fee engine is real, roughly $410M over the last twelve months, and no Jupiter program has been exploited. What keeps this at caution is structure, not history. Every program is upgradeable, and outside Lend we could not verify the exact upgrade-authority setup this run. JLP holders carry the same shape of tail risk as Hyperliquid's HLP. And 2025 was rough on the trust side: a hijacked X account that shilled scam tokens to Jupiter's own audience, a DAO vote pause over a "breakdown in trust", the LIBRA scandal one door over at Meteora, and a publicly retracted safety claim on Lend.

Checklist

Audits & contracts. Coverage is uneven across the suite. Jupiter Lend is the best-covered piece: 7 audits by 4 firms (OtterSec, Offside Labs, MixBytes, Zenith) plus separate Certora formal verification and a Code4rena contest, all verified on jup.ag/lend/transparency (see our jupiter-lend report). The perps and router audit inventory was not re-verified this run: refresh. Nothing in the suite is immutable.

Admin control. The crux, as with most Solana protocols. Squads' blog names Jupiter among teams using its multisig for program management, and Lend's upgrade authority is confirmed as a 4-of-7 multisig with a 12-hour timelock. The equivalent config for the perps program and JLP pool (about $730M) and for the router did not surface in anything we verified this run: refresh. Until confirmed, assume a multisig can ship new perps code, and treat the timelock window as unknown.

Freeze / seizure. No Jupiter-issued token can be frozen at the individual-holder level: the JUP and JupSOL mints carry no freeze authority at all, and the JLP and JupUSD mints do name one but in each case it is a program-derived address belonging to the perps and JupUSD programs, neither of which exposes a freeze, thaw, or blacklist instruction, so the only levers Jupiter's Squads-operated admin actually holds are protocol-wide - seven global permission flags on perps, including one that would halt JLP redemptions for everyone, all currently enabled, plus a mint/redeem pause on JupUSD - and the address-level power has never existed to be used.

Oracle. Better than most. Perps positions execute at aggregated oracle prices: Edge by Chaos Labs is primary, with Chainlink and Pyth verifying Edge and acting as fallbacks (two of three must agree or no price update happens), per Jupiter's support docs; Chainlink Data Streams were added in May 2025 for sub-second updates. Blockworks' post-Hyperliquid analysis concluded the JLP design resists the spot-pump manipulation that hit HLP because trades settle against external oracle prices, not an internal book. Lend runs Pyth, Chainlink and RedStone hops. No oracle incident found on any component.

Liquidity & exit. Depends which door you came in. The aggregator custodies nothing; worst case is a bad route. JLP is redeemable against a pool DeFiLlama sizes at about $730M (the JLP token's market cap is ~$837M), and you are the counterparty: when traders win big, the pool eats it. On June 30, 2026 Jupiter added its own JupUSD stablecoin as the pool's sixth custody asset and plans to convert roughly $500M of the pool's USDC into JupUSD. JupUSD launched in January 2026 with Ethena; about 90% of its reserves sit in USDtb (backed by BlackRock tokenized funds) with a 10% USDC buffer at Anchorage. That ties pool backing to Jupiter's own issuance and adds an Ethena dependency. Lend exits ride one shared rehypothecated pool. JupSOL exits depend on Solana unstake mechanics and secondary liquidity; its stack was not re-verified this run. JUP itself trades 88% below its ATH.

Yield: real vs emission. The strongest dimension. DeFiLlama shows about $667k in fees per day, $18M over 30 days, $410M over the last year, and $1.07B all-time across ten sub-products. JLP yield comes from perps fees, Lend yield from borrow interest, and 50% of protocol revenue funds JUP buybacks through the Litterbox Trust, roughly $70M spent in 2025. The policy is in flux: a live proposal would lift the buyback share to 70%, while the CTO has publicly floated ending buybacks altogether, and governance is weighing net-zero JUP emissions for the rest of 2026. Either way, the underlying cash flow is real, not emissions.

Holder concentration. Half of the 10B JUP supply is team-managed, with 20% earmarked for current team members, and team voting weight is exactly what blew up the DAO in mid-2025. About 3.32B of 10B circulates. Onchain top-holder and JLP depositor concentration were not pulled this run: refresh.

Track record. Two-sided. The contracts side is clean: aggregator live since 2021, perps since early 2024, no exploit of Jupiter's own programs found through 2026-07-03, and an X scan covering May to July 2026 turned up no incidents, depegs, or outages. When Drift was drained of roughly $285M in April 2026, the attacker held about $155M of JLP (roughly 41M tokens) and swapped loot to USDC through Jupiter's aggregator, but the vulnerability was Drift's, not Jupiter's (we rate Drift avoid separately). The comms and governance side is bumpier. On February 6, 2025 Jupiter's X account was hijacked to shill fake $MEOW and $DCOIN tokens; buyers lost money ($460k+ traced to the attacker) though no Jupiter programs or funds were touched. Meteora's co-founder resigned over LIBRA in February 2025 and Jupiter's co-founder commissioned a Fenwick & West investigation whose public outcome we could not confirm (refresh). The DAO paused all voting in June 2025 citing a breakdown in trust, then restructured in October 2025 with a ~130M JUP burn and unstaking cut from 30 days to 7; voting is active again in 2026. Lend's COO retracted an isolated-vaults safety claim in December 2025. The 2024-2025 acquisition spree (Moonshot, Drip, SolanaFM and others) drew ecosystem-dominance concerns in dated coverage; deal details were not re-verified this run.

Worst case

The expensive scenarios sit in perps and lending, not the router. For JLP: a one-sided trader win, an Edge oracle failure that the Chainlink and Pyth checks miss, or a stress event mid-way through the USDC-to-JupUSD backing swap (which layers in Ethena and USDtb) marks the pool down, and JLP holders absorb it with no insurance backstop. For Lend: the shared-pool contagion path laid out in our jupiter-lend report. For everything: a compromised upgrade authority ships malicious code, and Drift showed in April 2026 what a compromised Solana admin path costs. On Lend you have a confirmed 12-hour timelock window to exit; on perps we could not confirm what window, if any, you get. Position sizing and watching upgrade queues are the mitigations.

Bottom line

Caution. Jupiter is one of the strongest fee businesses on Solana, with multi-oracle hygiene and no exploit of its own contracts across five years of shipping. But the suite runs on upgradeable programs with only partially verified controls, JLP income is payment for being the traders' counterparty in a pool mid-way through a swap into Jupiter's own stablecoin, Lend is under a year old, and the team's 2025 record (a hijacked X account, governance trust breakdown, LIBRA adjacency, retracted safety claims) shows communication running ahead of disclosure more than once. Use it by surface: route through the aggregator freely, and size JLP and Lend like the counterparty and shared-pool bets they actually are.

Data appendix

  • TVL: ~$1.63B (DeFiLlama parent slug jupiter, live this run). Perps (JLP pool): ~$730M TVL (DeFiLlama child protocol, live); JLP token mcap ~$837M at $3.70 (CoinGecko, live); the ~$100M gap between the two is unreconciled, check at refresh. Jupiter Lend ~$892M supplied as of our 2026-07-01 jupiter-lend report. Sub-products under the parent per the fees API: Aggregator, Perpetual Exchange, Ape, Staked SOL (JupSOL), DCA, Studio, Lend, Prediction, Limit, Offerbook.
  • Fees: $667k/24h, $3.8M/7d, $18.0M/30d, $409.5M/1y, $1.07B all-time (DeFiLlama fees API, this run).
  • JUP token: $0.241, mcap ~$800M, FDV ~$1.65B, 3.32B circulating of 10B max, ATH $2.00 (Jan 2024), down 88% (CoinGecko, this run). Tokenomics: 50% community, 50% team-managed, of which 20% of total supply goes to current team members with 2-year cliff (Blockworks, Decrypt).
  • Audits: Lend: 7 audits by 4 firms plus Certora plus Code4rena (verified 2026-07-01, jupiter-lend report, jup.ag/lend/transparency). Perps, router, JupSOL inventory: refresh.
  • Admin/governance: Solana programs upgradeable. Lend authority: 4-of-7 multisig plus 12h timelock (transparency page). Jupiter named as a Squads multisig user alongside Raydium, Marginfi, Kamino (Squads blog, verified). Perps/JLP and router upgrade-authority configs: refresh. DAO: all votes paused June 2025 over "breakdown in trust", return slated for 2026 (CoinDesk, The Defiant); "fresh start" restructure announced October 2025, ~130M JUP burn executed and unstaking cut from 30d to 7d (SolanaFloor, KuCoin); voting active again in 2026 (X scan). Litterbox Trust receives 50% of protocol revenue for buybacks, ~$70M spent in 2025 (AMBCrypto); live proposal to lift to 70% (discuss.jup.ag) while the CTO has floated ending buybacks; net-zero 2026 emissions plan under discussion (SolanaFloor).
  • Oracle: Perps: Edge by Chaos Labs primary (launched from stealth with Jupiter, Sept 2024), Chainlink and Pyth verify and fall back, two of three required (support.jup.ag price-oracles article); Chainlink Data Streams added May 2025. Lend: Pyth, Chainlink, RedStone hops (Jupiter dev docs). JupUSD received a RedStone feed late June 2026.
  • Holder concentration: onchain top-holder split and JLP depositor concentration: refresh.
  • Recent-news scan: no exploit, JLP depeg, bad debt, or outage found May 1 to Jul 3, 2026 (X search). Drift exploited for ~$285M on April 1, 2026 (Elliptic says $286M); attacker held 41M JLP ($155M) and swapped stolen assets to USDC via Jupiter's aggregator without breaching Jupiter programs (Elliptic, MEXC, The Block; our Drift report: avoid). JupUSD added as the sixth JLP custody asset June 30, 2026 ahead of a planned ~$500M USDC conversion (official Jupiter X post, Crypto Briefing); JupUSD launched Jan 2026 with Ethena, ~90% USDtb reserves (The Block). Feb 6, 2025: Jupiter X account hijacked, fake $MEOW/$DCOIN promoted, $460k+ taken from buyers, no program breach (The Block, CryptoTimes). LIBRA and Meteora: Ben Chow resigned February 2025; Fenwick & West investigation outcome unconfirmed: refresh. Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols