TL;DR
Jupiter is Solana's dominant swap router with a stack of products around it: the perps venue and its JLP pool, JupSOL, JupUSD, launchpads, DCA and limit orders, a prediction market, and the JUP token with a DAO on top. This report covers all of that except Jupiter Lend, which we publish separately.
Scope first, because the headline number is a trap. DeFiLlama's parent slug answers $1.5502B. Its fourteen children sum to $2.0968B. Neither is this report's scope, because both include Jupiter Lend at $944.93M, which already has its own page on this site. Excluding Lend and its v2 DEX, the suite covered here is $1.1452B.
The router remains the strongest structural fact and it survived checking. DeFiLlama assigns the aggregator no TVL at all, and a Solana transaction is atomic, so a route cannot leave your funds resting in the program between steps. Swapping through Jupiter risks a bad fill, not principal.
What got worse is everything behind the router, and it got worse in detail rather than in headline. I read the upgrade authorities on chain this run instead of carrying them forward, and re-derived each multisig address from its seeds rather than trusting a label. The swap program answers to a 4-of-7 Squads v3 multisig whose account holds no timelock field at all, and it shipped new code on 2026-08-05, one week before this report and ten months after its newest published audit. Perps sit under a different multisig with a real 24-hour timelock, but six of the seven swap signers are also on it. JupSOL, at $396.7M, runs on a stake-pool program that is not the canonical one and not upgradeable by Jupiter, has no audit on Jupiter's own list, and carries a single plain keypair in its staker role. And half of all JupSOL plus 42% of all JLP sit as collateral inside Jupiter Lend, which is our Lend page's reflexivity finding seen from the other side.
Checklist
Audits & contracts. Read off Jupiter's own audits index this run rather than carried. Jupiter Swap has three: Offside Labs on v6 in October 2025, Offside Labs on v6 in April 2024, and Sec3 on v3. Perps has three: Offside Labs, OtterSec and Sec3, with no dates printed on the page. Limit Order, Lock and the DAO program each have coverage. Every firm named on that page is a real auditor and every entry links to a report Jupiter publishes itself; I checked the links resolve. JupSOL has nothing listed, which is $396.7M of staked SOL with no audit on the issuer's own page. The gap that matters most is timing on the busiest program: swap v6's newest published review is October 2025, and the on-chain record shows that program upgraded on 2026-07-15 and again on 2026-08-05. The code routing most of Solana's swap flow is ten months past its last review, and it is not shipping slowly: the last twelve transactions on its program-data account all landed between 2026-05-03 and 2026-08-05. Nothing in the suite is immutable. Same page, separate note: it now carries a "Jupiter Lend AMM" section with five reports, dated Zenith 2026-04-14 to 2026-05-11, OtterSec 2026-05-19 to 2026-06-04, OtterSec Vault Integration 2026-05-08 to 2026-06-17, and two Neodyme reports covering May to June 2026 including one on operational security. That conflicts directly with our own jupiter-lend page, which states every listed audit window closed on or before 2026-03-31. One of the two needs correcting, and it is not this page.
Admin control. All on-chain reads, dated this run, with every multisig identification re-derived from its program seeds rather than assumed. Swap v6 (JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4) and DCA share upgrade authority CvQZZ23qYDWF2RUpxYJ8y9K4skmuvYEEjH7fK58jtipQ, which is off the ed25519 curve and derives exactly as authority index 1 of Squads v3 multisig 7ZyDFzet6sKgZLN4D89JLfo7chu2n7nYdkFt5RCFk8Sf, threshold 4 of 7, external execute disabled, 183 transactions to date. I parsed that account in full: it holds threshold, members, a transaction index and a change index, and no timelock field. Squads v3 does not have one. The last two upgrades landed 2026-07-15 and 2026-08-05, and I opened both transactions to confirm they executed through the v3 program. Perps (PERPHjGBqRHArX4DySjwM6UJHiR3sWAatqfdBS2qQJu) is a different and better setup: authority 5myNNmEmPm3UAnJ2ggLEpnTFb9t9Gk8369wKw6n3uAKx derives as vault index 0 of Squads v4 multisig AxkJ8oH5aDu4ZRWfsujPtxdb6Vhq4gDehpoReBgrUUSm, threshold 4 of 8 with all eight members holding full initiate, vote and execute rights, a time_lock of 86400 seconds (exactly 24 hours), and no external config authority. It last shipped 2026-04-14 through Squads v4; the upgrade before it, on 2026-02-11, went through Squads v3, so the perps team migrated between February and April 2026 and the swap team has not. Now the part that undercuts having two multisigs: six of the seven swap signers are also members of the eight-member perps multisig, and both thresholds are 4, so a single group of six addresses can independently reach quorum on the router and on the perps program. I also read Lend's upgrade multisig myself purely to compute overlap, and it shares zero addresses with either, which leaves 16 distinct signers across the three sets. The deprecated aggregator v4 program is still live and still upgradeable under an unrelated 3-of-5 Squads v3 multisig, though it has not shipped code since 2023-06-14. On freeze powers: the JUP mint carries neither a mint authority nor a freeze authority, so JUP is hard capped and cannot be frozen; JupSOL has no freeze authority and its mint authority is an off-curve PDA; JLP names AVzP2GeRmqGphJsMxWoqjpUifPpCret7LqWhD8NWQK49 as both mint and freeze authority, which I confirmed is off-curve so no private key exists for it, but whether the perps program exposes a freeze instruction behind that PDA I did not re-verify this run. JupSOL is the weakest link in this dimension. Its stake pool 8VpRhuxa7sUUepdY3kQiTmX9rS5vx4WgaXiAnXq4KCtr is owned by SPMBzsVUuoHA4Jm6KunbsotaahvVikZs1JyTW6iJvbn, not the canonical SPL stake-pool program, and that program is upgradeable by an authority that matches none of Jupiter's three multisig vaults. The pool manager is a PDA, but the pool staker role, EG976hUYS3Mwf595uk9irszydggWzB3tBDobbMffyScq, is on the curve: a single keypair on a $396.7M surface. One caveat I want stated plainly rather than left to inference, because it changes how bad this is: in the canonical SPL stake-pool design the staker role manages validator delegation and cannot withdraw the pool to an arbitrary address. This program is a fork and I did not read its code, so I cannot tell you the fork grants the same limited powers. Treat it as an unverified single-key surface, not as a proven drain path.
Oracle. I did not re-verify the oracle stack at source this run, so the previous report's finding (Edge by Chaos Labs primary, Chainlink and Pyth verifying, two of three required before a price update) is carried, not confirmed: refresh. An unverified oracle sitting under a $698M perps pool does not get a green from me. What I can confirm is the absence of failure: no oracle incident, mispricing or bad-liquidation event appears in the 2026-07-03 to 2026-08-12 window on the X scan or on either of two independent news scans, and Jupiter has zero entries anywhere in DeFiLlama's 621-item hacks list.
Liquidity & exit. Three different doors with three different answers. The aggregator is the good one. DeFiLlama assigns it no TVL at all, which is what you would expect from a program that never holds a resting balance, and Solana's atomic transaction model means a multi-hop route either completes or reverts entirely. Your exposure on a swap is slippage, price impact, a failed route and whatever token you chose to buy. The JupiterZ RFQ path adds one wrinkle Jupiter's own JupiterZ documentation states plainly: market makers "review and sign transactions before execution" with "full control over which swaps to accept", which is last look. A maker can see your order and decline it. That is adverse selection and execution uncertainty, not custody. JLP is the second door and it is a different animal. Market cap is $786.7M against a pool DeFiLlama sizes at $698.4M; add the $103.0M it books as borrowed against that pool and you get $801.4M, within 1.9% of market cap, which finally explains the roughly $100M gap our July report left unreconciled. Composition today is 54.2% SOL, 18.9% USDC, 15.4% WBTC, 9.1% WETH and 2.4% JupUSD. So JLP is a majority-SOL basket carrying trader P&L on top, not a stable yield claim, and the roughly $500M USDC-to-JupUSD conversion the last report flagged as underway has not happened at scale: JupUSD is $16.6M of the pool and USDC is still $132.3M. JupUSD itself is small, $49.5M, backed 94.8% by USDtb and 5.2% USDC. The third door is JupSOL, which exits through Solana unstake mechanics or the secondary market, and half of it is currently pledged inside Jupiter Lend, meaning a JupSOL stress event and a Lend liquidation cascade would be the same event. JUP trades 91.3% below its January 2024 high, down 65.1% on the year and 15.2% over 30 days.
Yield: real vs emission. The one clear green, with a trend worth saying out loud. Fees run $2.67M over 7 days, $11.76M over 30, $355.9M over the trailing year and $1.091B all time. Revenue is $958k, $3.79M and $104.9M on the same windows, $355.4M all time. None of that is token emission: the aggregator alone routed $12.66B in 30 days, 16.1% of every dollar of aggregator volume DeFiLlama tracks anywhere, and $415.6M in the last 24 hours. The business is real. It is also visibly shrinking. Our own 2026-07-03 run measured $18.0M of 30-day fees; six weeks later the same metric is $11.76M, down 35%. The trailing year fell from about $410M to $355.9M, down 13%. DeFiLlama's own methodology for every Jupiter product still models half of protocol revenue going to JUP buybacks through the Litterbox Trust, which is the best-sourced statement I can make about the policy today. What I will not repeat from the draft of this report is the inference that the roughly 130M JUP burn "executed": total supply is 6,862,431,210 with the mint authority revoked, so supply can only fall, and that is 137.57M below 7B. But the 7B baseline is carried, not verified, and the Litterbox is a buy-and-hold reserve rather than a burn address, so the arithmetic does not prove what it looked like it proved. Current buyback policy and Litterbox status after the October 2025 vote: refresh.
Holder concentration. Measured on two surfaces. On the token: JUP total supply is 6,862,431,210 with the mint authority revoked, so the supply is hard capped and cannot grow. 3.320B of that circulates, 48.4%, which leaves 3.542B (51.6%, about $613M at today's price) off market in team, treasury and DAO hands. Worth correcting our own July report here, which said 3.32B of 10B; the 10B figure is stale, CoinGecko still prints it as max supply, and the revoked mint authority makes it unreachable. On the products, the concentration is structural rather than in wallets, and this is my own arithmetic on my own denominators: our jupiter-lend page measures $199.4M of JUPSOL and $332.4M of JLP inside that lender's collateral base as of the same date, which against the $396.66M JupSOL pool and the $786.7M JLP market cap I read this run works out to 50.3% of all JupSOL and 42.3% of all JLP pledged inside Jupiter's own money market. That is $531.8M, or 46.4% of this report's entire scope, that also appears as collateral on our other Jupiter page. The two pages cannot be added. Wallet-level top-holder splits for JUP and depositor splits for JLP stay unmeasured: getTokenLargestAccounts returned HTTP 429 on four attempts in the first run and on nine more across three mints when I retried it here, refresh.
Track record. Clean where it counts, bumpy where it does not. Jupiter has zero entries in DeFiLlama's 621-item hacks list, no exploit of its own programs since the aggregator went live in 2021, and no incident in this refresh window: an X scan and two independent news scans covering 2026-07-03 to 2026-08-12 turned up no exploit, no JLP drawdown event, no JupSOL depeg, no oracle failure, no outage and no routing failure. For context on how quiet that is, DeFiLlama logged ten Solana hacks in 2026 including Drift at $295M in April, BonkDAO at $21.3M on July 6, DefiTuna at $580k on July 16, Across at $3.6M on July 17 and Allbridge Core at $1.65M on July 19, none of them Jupiter. Three of those landed inside this report's window, on Jupiter's own chain, and Jupiter was not among them. A VP of engineering departure on 2026-07-17 appeared in the earlier draft sourced to one X post; that post is not retrievable and two independent searches found no corroboration, so it is excluded rather than reported. Against the contracts record sits the 2025 comms and governance record, carried from the previous run: the February 2025 X account hijack that pushed fake tokens at Jupiter's own audience, the June 2025 suspension of all DAO voting over a stated breakdown in trust, and the October 2025 restructure. Five years without an exploit is a genuine asset. It sits next to a team that has repeatedly had to walk things back.
Worst case
The router is not where you lose money, and that is worth being precise about: the worst swap outcome is a bad fill or a token you should not have bought. The expensive scenarios live behind it. On perps, a one-sided trader win or a price failure the two-of-three oracle check does not catch marks the JLP pool down, and holders absorb it with no backstop; JLP being 54.2% SOL means a sharp SOL drawdown hits the same holders through a second channel at the same moment. On admin, a compromised swap-v6 multisig is the sharpest edge in the suite: four signatures from a seven-member set with no timelock in the account, over the program most of Solana's swap flow passes through, and no window in which anyone could see it coming and move. The perps side at least gives you 24 hours. This is not a hypothetical shape on this chain. The Drift compromise in April 2026, the largest Solana loss of the year at $295M, was reported as a social-engineering attack on multisig approvals rather than a code flaw, which is exactly the path a signer-set overlap widens. The path nobody has priced is the loop between our two Jupiter pages. Half of all JupSOL and 42% of all JLP are pledged inside Jupiter Lend at LTVs our Lend page measures as high as 0.94. A drawdown in JLP or a JupSOL discount forces liquidations in Lend, those liquidations sell JLP and JupSOL, and both assets are thin outside Jupiter's own venues. That is one issuer standing on both sides of the trade. Position sizing across the whole suite, not per product, is the mitigation.
Bottom line
Caution, unchanged. The aggregator is close to as safe as a DeFi surface gets, and I would route through it without hesitation: it holds nothing, the transaction is atomic, and the fee business under it is the largest of its kind that DeFiLlama tracks. But the thing you swap through and the things you hold are not the same risk. The swap program itself has no timelock, ships code roughly every two weeks while its newest audit is ten months old, and shares six of seven signers with the multisig that controls a $698M perps pool. JupSOL is $396.7M with no audit on Jupiter's list, running on a program Jupiter cannot upgrade, with one plain key in its staker seat whose powers under that fork nobody outside the team has verified. JLP pays you for being the traders' counterparty in a basket that is more than half SOL. And nearly half this report's scope is simultaneously collateral on our own Jupiter Lend page, which means the suite is more concentrated in itself than either page shows alone. Use it by surface, size the holdings rather than the router, and treat Jupiter as one exposure rather than five.
Data appendix
- TVL, scope resolved.
api.llama.fi/tvl/jupiterreturns $1,550,195,060, which is the parent aggregateparent#jupiter(Solana only, with $904.09M booked as borrowed and excluded). Its fourteen children sum to $2,096,812,968. The $546,617,908 difference between the two is not published anywhere and I could not reconcile it: refresh. This report's scope is $1,145,237,704 (~$1.1452B), the fourteen children minusjupiter-lend($944,927,800) andjupiter-lend-dex($6,647,464), both of which belong to our separate jupiter-lend page. Included:jupiter-perpetual-exchange$697,995,550 (the per-protocol endpoint read minutes later gave $698,374,259),jupiter-staked-sol$396,655,967,jupusd$49,514,831,jupiter-offerbook$674,148,jupiter-prediction$397,207, and seven children DeFiLlama assigns no TVL value to at all:jupiter-aggregator,ape-jupiter,jupiter-dca,jupiter-studio,jupiter-limit,jupiterz,jupiter-gacha. Excluded:jupiter-lend,jupiter-lend-dex, and the orphan slugjupiter-swap($10.54, no parent, not a child ofparent#jupiter). On our board's empty TVL cell: it was the right call when nobody had resolved the scope, and it is the wrong call now. $1.5502B would double-count Lend against our own Lend page and $2.0968B would double-count it worse, but $1.1452B is an honest figure for a row named "Jupiter (suite)" and should replace the dash, with the scope stated. One caveat survives even then: $531.8M of that $1.1452B is simultaneously collateral on the Lend page, so the two rows still must not be summed. - Fees and revenue: fees $247.6k/24h (partial day), $2.67M/7d, $11.76M/30d, $355.9M/1y, $1,090.7M all time. Revenue $133.2k/24h, $958.2k/7d, $3.79M/30d, $104.9M/1y, $355.4M all time. Our 2026-07-03 run measured $18.0M/30d and about $410M/1y, so 30-day fees are down 35% and trailing-year fees down 13% in six weeks (DeFiLlama fees API, both runs).
- Volume: Jupiter Aggregator $12.66B/30d and $415.6M/24h, 16.1% of the $78.58B of 30-day volume DeFiLlama tracks across 158 aggregators (DeFiLlama aggregators overview).
- Audits (developers.jup.ag, read this run): Swap: Offside Labs v6 Oct 2025, Offside Labs v6 Apr 2024, Sec3 v3. Perps: Offside Labs, OtterSec, Sec3, no dates on the page. Limit Order: Offside Labs v2. Lock: OtterSec, Sec3. DAO: Offside Labs. JupSOL: none listed. All report links resolve (the reports are served from Jupiter's docs repo). The engagement dates and finding counts inside the OtterSec perps report could not be extracted from the PDF and are refresh; the earlier draft's "2023-10-03 to 2023-11-15, 9 findings, 2 high" is not supported by anything I could open and has been removed. Same page lists "Jupiter Lend AMM" with 5 reports: Zenith 2026-04-14 to 2026-05-11, OtterSec 2026-05-19 to 2026-06-04, OtterSec Vault Integration 2026-05-08 to 2026-06-17, Neodyme May to June 2026, Neodyme Operational Security May to June 2026. This conflicts with our jupiter-lend page's "every listed audit window closed on or before 2026-03-31"; flagged there, not resolved here.
- Admin / governance (Solana mainnet, this run, every PDA re-derived from seeds): Swap v6
JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4and DCADCA265Vj8a9CEuX1eb1LWRnDT7uK6q1xMipnNyatn23Mshare upgrade authorityCvQZZ23qYDWF2RUpxYJ8y9K4skmuvYEEjH7fK58jtipQ, which re-derives exactly as authority index 1 of Squads v3 multisig7ZyDFzet6sKgZLN4D89JLfo7chu2n7nYdkFt5RCFk8Sf, threshold 4 of 7,allow_external_executefalse, tx index 183, change index 139, no timelock field in the account (the 320 trailing bytes are room for ten more member slots). Swap v6 last deployed slot 437349164 = 2026-08-05 08:57 UTC, prior 2026-07-15, both confirmed executed through the Squads v3 program; the last twelve transactions on its ProgramData account span 2026-05-03 to 2026-08-05. PerpsPERPHjGBqRHArX4DySjwM6UJHiR3sWAatqfdBS2qQJuupgrade authority5myNNmEmPm3UAnJ2ggLEpnTFb9t9Gk8369wKw6n3uAKxre-derives as vault index 0 of Squads v4 multisigAxkJ8oH5aDu4ZRWfsujPtxdb6Vhq4gDehpoReBgrUUSm, threshold 4 of 8, all 8 members permission mask 7 (initiate + vote + execute),time_lock86400s = 24h,config_authority= system program, tx index 20; last deployed slot 413092478 = 2026-04-14 via Squads v4, prior 2026-02-11 via Squads v3. Legacy aggregator v4JUP4Fb2cqiRUcaTHdrPC8h2gNsA2ETXiPDD33WcGuJBstill upgradeable under authority index 1 of Squads v3 multisigB72ncxxGKu9woWT2s8UT2HwYdWoYdXLa3xosEVgmc1Sx, 3 of 5, member set fully disjoint from the v6 one, last deployed 2023-06-14. Signer overlap: 6 shared between swap v6 (7 members) and perps (8 members), the odd one out beingDg5NLa5JuwfRMkuwZEguD9RpVrcQD3536GxogUv7pLNV; 0 shared between either and Lend's 7-member upgrade set; 16 distinct addresses across all three. All three upgrade authorities are off the ed25519 curve (no private keys) and every program checked has a live authority, none frozen. JupSOL stake pool8VpRhuxa7sUUepdY3kQiTmX9rS5vx4WgaXiAnXq4KCtris owned bySPMBzsVUuoHA4Jm6KunbsotaahvVikZs1JyTW6iJvbn, not the canonical SPL stake-pool programSPoo1Ku8WFXoNDMHPsrGSTSG1Y47rzgn41SLUNakuHy; that program is upgradeable by47SND7bGKvNXrqfP1bjsLCbwTgZhFBzAgmZ42QSkRScz(off-curve, matches none of Jupiter's three vaults) and last deployed 2025-10-07. Pool manager8JS6XsMPo2u3EyeeY3p2jvzHEhdUtCKgarHpJ3PAonyvis off-curve; pool stakerEG976hUYS3Mwf595uk9irszydggWzB3tBDobbMffyScqis on-curve, a single keypair. Operator identity behind that program and the staker's exact powers under this fork: refresh. DAO history (paused June 2025, restructured October 2025) carried from the previous run, not re-verified. - Mints (this run): JUP
JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN, supply 6,862,431,209.5, mint authority none, freeze authority none. JupSOLjupSoLaHXQiZZTSfEWMTRRgpnyFm8f6sZdosWBjx93v, supply 4,306,042.5, freeze authority none, mint authorityEMjuABxELpYWYEwjkKmQKBNCwdaFAy4QYAs6W9bDQDNw(off-curve PDA). JLP27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4, supply 214,529,202, mint and freeze authority bothAVzP2GeRmqGphJsMxWoqjpUifPpCret7LqWhD8NWQK49, off-curve; whether the perps program exposes a freeze instruction behind it: refresh. - JUP token: $0.173027, mcap $574.5M, FDV $1.187B, circulating 3,320,312,968 (48.4% of the 6.862B on-chain supply), ATH $2.00 on 2024-01-31, down 91.3%, down 15.2% over 30d and 65.1% over 1y (CoinGecko, this run). CoinGecko still lists max supply 10B; the revoked mint authority makes that unreachable and our own July report repeated it.
- JLP: $3.67, mcap $786.7M, CoinGecko supply 214,588,342 against 214,529,202 on chain, +1.5% over 30d, down 28.0% over 1y (CoinGecko). Pool composition 2026-08-12: SOL $378.6M (54.2%), USDC $132.3M (18.9%), WBTC $107.5M (15.4%), WETH $63.3M (9.1%), JUPUSD $16.6M (2.4%), USDT $0.1M (DeFiLlama token breakdown). Perps TVL $698.4M plus $103.0M booked borrowed = $801.4M, within 1.9% of JLP market cap, which reconciles the gap the July report left open. JupUSD standalone $49.5M, 94.8% USDTB / 5.2% USDC.
- Holder concentration: JUP non-circulating 3,542,118,241 (51.6%, about $613M). Suite-level reflexivity, my arithmetic on our Lend page's measured collateral: $199.4M JUPSOL = 50.3% of the $396.66M JupSOL pool; $332.4M JLP = 42.3% of JLP market cap (47.6% of perps TVL); combined $531.8M = 46.4% of this report's $1.1452B scope. Wallet-level top-holder and JLP depositor splits:
getTokenLargestAccountsreturned HTTP 429 on four attempts in the first run and nine more here across JUP, JLP and JupSOL, refresh. - Recent-news scan: no exploit, JLP loss, JupSOL depeg, oracle failure, routing failure, outage or governance blowup found 2026-07-03 to 2026-08-12 (X search plus two independent news searches). Zero Jupiter entries in DeFiLlama's 621-item hacks list. Same list logs ten Solana hacks in 2026: Drift $295M (2026-04-01), Step Finance $40M (2026-01-31), BonkDAO $21.3M (2026-07-06), Across $3.6M (2026-07-17), Allbridge Core $1.65M (2026-07-19), DefiTuna Lending $580k (2026-07-16), Meteora DAMM V2 $1.5M (2026-01-17), Raydium AMM $1.34M (2026-06-10), GoonFi $254k (2026-03-28), Hyperliquid Malaysia (2026-08-06). The reported 2026-07-17 VP of engineering departure could not be retrieved from its single X source and was not corroborated by two independent searches; it is excluded. Current buyback policy and Litterbox Trust status after the October 2025 vote: refresh. DeFiLlama's per-product methodology still models 50% of protocol revenue funding JUP buybacks from 2025-02-17 onward.
- Housekeeping: the file on disk carries
verdict: cautiondated 2026-07-03, notsolid. If any board or index shows solid for this slug, that is the thing to fix.
Maintained monthly. Methodology: DeFi Research Instruction v2.