TL;DR
Jupiter Lend is the Jupiter team's money market on Solana, built on Fluid's liquidity-layer design and reimplemented in Rust. TVL is $942.71M, up 5.3% over 90 days and 19.7% below its March 2026 peak. This run I read the chain directly rather than trusting the transparency page, and the picture moved in both directions.
Better than the last review said: the admin is not one multisig but three, and all of them are real. Code upgrades run through a 4-of-7 Squads vault with a 12-hour timelock. Risk parameters, market listing and oracle assignment run through a different Squads vault with a 6-hour timelock. A third, faster multisig holds the guardian role. None of the three authorities is a plain key, and no hot operator key sits anywhere in the auths lists. The audit record is no longer hearsay either: the official audits index lists 10 reports, and the yield is plain borrow interest with no fake headline rate anywhere in the book. The October 2025 crash, which both the previous report and this draft dismissed as a test taken while the protocol was tiny, was in fact taken at $756M of TVL, about 80% of today's size.
Worse than the last review said: more than half the collateral backing this book, 56.6%, is Jupiter's own paper. Five programs are upgradeable and none are frozen. The v2 DEX program carries a force_set_price instruction. And the timing is uncomfortable: Lend v2 went live on 2026-08-10, the program behind it first hit mainnet on 2026-06-18, and every audit window on Jupiter's own list closed on or before 2026-03-31. Caution, unchanged.
Checklist
Audits and contracts. Verified at source this run rather than carried forward. Jupiter's developer audits page lists 10 reports: OtterSec twice, Offside Labs three times, MixBytes once and Zenith once, which is exactly the "7 audits by 4 firms" the old report claimed, plus two Certora formal verifications (the second running 2026-01-07 to 2026-03-31) and the Code4rena contest. Code4rena confirms independently: 2026-02-12 to 2026-03-13, $107,000, medium findings, no confirmed highs. That is strong coverage of the core. The gap is the newest layer. The latest audit window on the list ends 2026-03-31; the DEX program was first deployed 2026-06-18 and has been upgraded five times since, most recently on launch day. No listed report names a DEX, Smart Collateral, Smart Debt or v2 component. Separately, all five programs are upgradeable with a live authority and none are frozen.
Admin control. Three tiers, each a Squads v4 multisig vault, all read on-chain. Code upgrade authority for all five programs is 4MsgBB5VPoTrUSp5XnfbViV386C1UnsTdifLBw33ZMSJ, vault index 0 of multisig J3mJ3wz6xkVUk3T8qHnuAYNxsRH3ixHsryYNZAU2vG8P: threshold 4 of 7, all 7 members hold full permissions, time_lock 43200 seconds, exactly the 12 hours the team claims, and no external config authority. Risk parameters are a different key: HqPrpa4ESBDnRHRWaiYtjv4xe93wvCS9NNZtDwR89cVa, vault index 0 of multisig 5Y93cxqp8rGtjDhxGkehewfhFdxLkrCfPDWookCGeASF, threshold 5, time_lock 21600 seconds. Read the member permissions and that tier is tighter than it looks: 10 members, but two hold initiate-only rights and cannot vote, so it is 5 of 8 voters, not 5 of 10. This same key sets collateral factors, liquidation thresholds and penalties, rate models, borrow and supply caps, creates vaults, calls update_oracle, and is also the authority on the shared Liquidity program. The third tier is the guardian, 3H8C6yYTXUcN9RRRDmcLDt3e4aZLYRRX4x2HbEjTqQAA, which the draft called a plain non-multisig key. It is not. It is off the ed25519 curve, so no private key exists for it, and it resolves to vault index 0 of a third multisig, B9fGPEBP1M4SvQgtG7egVrdL5N9zBxrFpdtZevTkhQ6o, threshold 3 of 7 with two initiate-only members, so 3 of 5 voters, and time_lock 0. It holds the guardian slot on the DEX and on the shared Liquidity layer. Zero timelock is normal for a pause tier, but it is the fastest and lowest-threshold path into this protocol and its exact powers are not publicly documented. Voting-member overlap: 3 addresses between the upgrade and parameter sets, 2 between upgrade and guardian, none between parameter and guardian. The parameter tier is busy: 40 transactions between 2026-07-28 and 2026-08-11, including rate magnifier and user borrow and supply config changes on 2026-08-07 and 2026-08-08, and a guardian update on the Liquidity layer on 2026-08-11.
Oracle. The documented design is sound and I confirmed every threshold verbatim: up to four sequential hops, with Pyth, Chainlink and Redstone as market feeds. Four things keep it off green. Stake-pool source types derive LST prices from the issuer's own on-chain pool accounting rather than a traded price. The JupLend source type prices fToken collateral off Jupiter Lend's own exchange rate, which is self-referential. JLP, the single largest collateral asset at 33.9% of the book, matches none of the seven documented source types, so the largest thing in this lender is priced by a mechanism I could not document. Only Pyth validates a confidence interval; the docs state plainly that the others do not expose one. Liquidations accept prices up to 7200 seconds stale against 600 seconds for user operations. On top of that, the v2 DEX program's instruction set includes force_set_price and update_center_price_address, both gated on the parameter authority. That is an admin price override on a fund-loss surface. It is multisig-gated and timelocked, not a hot key, but it exists.
Liquidity and exit. Read the two layers separately, because blending them hides the shape. The supply side is 7 pools holding $550.29M, and it is overwhelmingly stable: USDC alone is $437.00M, 79.4% of it, with the rest almost all other stablecoins. The borrow side is 73 vault markets holding $979.08M of collateral against $609.30M drawn, 62.2% utilization, which matches our own board to within a rounding drift. DeFiLlama's headline protocol TVL is $942.71M and its 80 pool rows sum to $920.07M. Those are different measures and I cite each by name. The structural point is confirmed by wiring, not commentary: VaultAdmin and DexAdmin both record liquidity_program as the same single Liquidity program. Each vault is isolated in its parameters, one collateral against one debt asset with its own LTV and caps. It is not isolated in its funds. LTVs run from 0.50 up to 0.94, with 0.94 on JupSOL/WSOL, INF/WSOL and JitoSOL/WSOL and 0.92 on dfdvSOL/WSOL, which is thin margin on assets priced off issuer state.
Yield: real versus emission. The cleanest dimension. I looked specifically for the near-empty or fully-utilized pool printing a fake headline rate, because that pattern burned us on another protocol recently. It is not here. Across 80 pool rows the top APY is 5.37% on JUPUSD, made of 4.37% base plus 0.99% reward, and the $437.00M USDC pool pays 4.39%, 3.70% base plus 0.69% reward. Nothing anywhere prints above 8%. Two rates do sit above USDC on small pools, EURC at 4.93% on $4.74M and USDG at 4.91% on $3.20M, but both are pure base rates within 0.6 percentage points of the largest pool, which is the opposite of the pattern that signals trouble. The yield is borrow interest, with rewards a small minority of the headline.
Holder concentration. The previous review left this unmeasured and the draft measured it against the wrong denominator. Measured properly, against the $979.08M of collateral that actually backs the loan book: JLP $332.4M (33.9%), JUPSOL $199.4M (20.4%), JLJUPUSD $19.3M (2.0%) and JUP $3.0M (0.3%), summing to $554.1M, or 56.6%. More than half of what secures this book is paper the same issuer prints. That is a reflexivity problem, not a diversification one: stress in JLP or the Jupiter LSTs arrives at the lender and at its collateral in the same move, and it arrives at LTVs up to 0.94. The 30.3% figure in the draft came from summing net pool TVL across both layers, which nets out borrowed amounts and dilutes the collateral picture with the USDC supply side. Wallet-level depositor and borrower concentration is still unmeasured and stays refresh. Also present, and small, is about $9.9M of tokenized equities across SPYX, QQQX, NVDAX and TSLAX, which carry market-hours and issuer-redemption behavior ordinary crypto collateral does not.
Track record. DeFiLlama first listed the protocol on 2025-08-19 at $7.52M, so call it a year. Clean signals: zero matches for Jupiter in DeFiLlama's 621-entry hacks list, and an independent X scan across 2026-06-01 to 2026-08-12 surfaced no exploit, bad debt, oracle failure, paused market, withdrawal problem or emergency action. The stress-test story needed correcting in the protocol's favor. The previous report credited a crash it dated to October 2026, a month that has not happened, and the draft corrected the date but kept the dismissal, calling it a test taken when the protocol was "roughly a month old and small". The TVL series says otherwise: on 2025-10-10 Jupiter Lend held $756.0M, about 80% of today's $942.71M. It fell 10.3% to $678.3M on 2025-10-11 and was back above the pre-crash level within four days. That is a real drawdown at close to real size, and it is better evidence than either report gave it credit for. What keeps this yellow is different: whether the book took bad debt in that event is still unverified, and the v2 layer that went live two days ago has no track record whatsoever.
Worst case
A correlated drawdown hits Jupiter's own stack at once. JLP marks down as perp LPs take losses, JUPSOL and the other LSTs are valued off stake-pool accounting rather than a market that is actively repricing them, and 56.6% of the collateral base moves together at LTVs reaching 0.94, while the shared liquidity layer, not a set of ring-fenced vaults, absorbs whatever the liquidation engine fails to clear. Suppliers to the common pool eat the residue, and that supply side is 79.4% USDC held by people who thought they were lending stablecoins. The v2 layer widens this rather than narrowing it. Smart Collateral and Smart Debt are opt-in, which limits the blast radius to users who choose them, but for those users a collateral position now also carries DEX pool exposure. CoinDesk's own account of the design is blunt about the asymmetry: borrowers are protected if an asset in the pool breaks, while on the collateral side "a supplier carries the loss on both assets if either breaks". That runs on code deployed 2026-06-18 and last changed on launch day, outside every audit window Jupiter lists. The admin path is the second route. The parameter multisig, 5 of 8 voters with a 6-hour delay, can reassign a vault's oracle or call force_set_price on the DEX. That is a smaller signer bar and a shorter window than the 4-of-7 and 12 hours guarding the code itself, and it reaches the number your position is valued against. The guardian multisig, 3 of 5 voters with no delay at all, can act within a block, and its exact powers are undocumented. No insurance fund or backstop was confirmed, so position sizing and watching the timelock queues are the mitigations.
Bottom line
Caution, same as the July call, on better evidence in both directions. The governance is genuinely good and I can now prove it rather than quote it: three Squads multisigs with meaningful separation, real timelocks on the two consequential tiers, no plain key anywhere in the authority chain, and an audit record that holds up when you go read it. The yield is honest. The one real stress test was passed at four-fifths of today's size, which is a stronger record than the last two reports gave it. What keeps it off solid is sharper than before, not softer. Five upgradeable programs, an admin price-override instruction, the largest collateral asset priced by an undocumented mechanism, one shared liquidity layer under vaults marketed as isolated, 94% LTVs on assets valued off issuer state, more than half the collateral base issued by Jupiter itself, and a major mechanism change that went live two days before this review on code no listed audit has seen. Size it as a fast-moving, well-run money market with a serious reflexivity concentration and a brand-new layer carrying no track record at all.
Data appendix
- TVL: $942.71M (DeFiLlama
jupiter-lend). 90d: $895.33M on 2026-05-14, so +5.3%. 30d: $935.03M on 2026-07-13, +0.8%. ATH $1,173.85M on 2026-03-17, currently 19.7% below it. First listed 2025-08-19 at $7.52M. - Supply measures, stated separately. Borrow side: 73 markets, $979.08M supplied as collateral, $609.30M borrowed, 62.2% utilization (DeFiLlama
lendBorrow), which matches our /lending board's $978.1M, $608.5M, 62.2%. Supply side: 7 Earn pools totalling $550.29M, of which USDC is $437.00M (79.4%). DeFiLlama's 80 yields rows sum to $920.07M net. - CoinDesk's "$1.9 billion in deposits" (2026-08-10), reconciled. $920.07M of pool-row TVL plus $979.08M of supplied collateral is $1,899M. The figure counts the same dollars twice, once as vault collateral and once as liquidity-layer supply. Treat $942.71M as the protocol TVL. This corrects the draft, which reported the figure as irreconcilable.
- Programs (all verified on-chain, all upgradeable, none frozen, all under one upgrade authority): Lending
jup3YeL8QhtSx1e253b2FDvsMNC87fDrgQZivbrndc9, LiquidityjupeiUmn818Jg1ekPURTpr4mFo29p46vygyykFJ3wZC, Vaultsjupr81YtYssSyPt8jbnGuiWon5f6x9TcDEFxYe3Bdzi, Oraclejupnw4B6Eqs7ft6rxpzYLJZYSnrpRgPcr589n5Kv4oc, DEX (v2)jupZ4m2GqUCJ5iueMfzQf8khFfH31d4XAQt3RzCT9Vd. Last upgrades: Lending 2026-07-03; Liquidity, Vaults and Oracle 2026-07-16. DEX first deployed 2026-06-18, then 06-26, 07-14, 08-01, 08-05 and 08-10. The repo also ships IDLs for flashloan and a lending reward-rate model, not checked on-chain. refresh. - Correction to the previous report: it recorded the program as
solana:JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN. That account is owned by the SPL Token program and is 82 bytes, a mint, not a program. It is also the address DeFiLlama carries. The five above are the programs. - Admin tier 1, code upgrades: authority
4MsgBB5VPoTrUSp5XnfbViV386C1UnsTdifLBw33ZMSJ= vault index 0 (bump 255) of Squads v4 multisigJ3mJ3wz6xkVUk3T8qHnuAYNxsRH3ixHsryYNZAU2vG8P. Threshold 4 of 7, all 7 members hold initiate, vote and execute, time_lock 43200s (12h), config_authority none, transaction_index 42. - Admin tier 2, risk parameters, market listing, oracle assignment and the shared Liquidity program: authority
HqPrpa4ESBDnRHRWaiYtjv4xe93wvCS9NNZtDwR89cVa= vault index 0 (bump 254) of multisig5Y93cxqp8rGtjDhxGkehewfhFdxLkrCfPDWookCGeASF. Threshold 5, time_lock 21600s (6h), config_authority none, transaction_index 673. Ten members, but7a5UoQppzj9SWzP4Mpw9SCNbmgAD8AzFtuSw6gfjna4kandHYbxGkNvEwvZ14RzJHPB9h3dWfXjxwAEhkyzJRHx1hBfhold initiate-only permissions and cannot vote, so the effective bar is 5 of 8, not 5 of 10. Gatesinit_vault_config,init_vault_state,update_collateral_factor,update_liquidation_threshold,update_liquidation_penalty,update_liquidation_max_limit,update_oracle, borrow and supply rate magnifiers,update_borrow_fee,update_core_settings; in Liquidityinit_token_reserve,init_new_protocol,update_rate_data_v1/v2,update_user_borrow_config,update_user_supply_config,pause_token,change_status; in the DEXinit_dex,force_set_price,update_center_price_address,turn_on_smart_col,turn_on_smart_debt,pause_dex. VaultAdmin.auths, DexAdmin.auths and the Liquidity AuthorizationList.auths each contain exactly this one address, so the auths-versus-authority distinction the draft flagged is moot: there is no separate operator key. - Admin tier 3, guardian:
3H8C6yYTXUcN9RRRDmcLDt3e4aZLYRRX4x2HbEjTqQAA= vault index 0 of a third Squads multisig,B9fGPEBP1M4SvQgtG7egVrdL5N9zBxrFpdtZevTkhQ6o. Threshold 3 of 7 with two initiate-only members, so 3 of 5 voters, time_lock 0. It holds the guardian slot in DexAdmin.guardians and, since aupdate_guardianscall on 2026-08-11, in the Liquidity AuthorizationList.guardians alongside the tier-2 vault. This corrects the draft, which called it "a plain system account with no data, not a Squads vault"; that inference is unsound, because Squads vaults are also system-owned with zero data. The decisive test is the curve: the address is off-curve, so no private key exists for it. The revenue collectorCvnta5ecoiCgNbLEXYm6kvhJMmRv3JM3ksKgTLVPg4hkis likewise off-curve. - Signer overlap (voting members): upgrade and parameter sets share 3 addresses, below the 4-of-7 upgrade threshold; upgrade and guardian share 2; parameter and guardian share none. Signer identities not established. refresh.
- Admin activity: 40 transactions on the parameter authority between 2026-07-28 and 2026-08-11, all executed through Squads
vault_transaction_execute. Notable:update_borrow_rate_magnifierandupdate_supply_rate_magnifierplus user borrow and supply config changes on 2026-08-08, user borrow config changes on 2026-08-07, andupdate_guardianson Liquidity on 2026-08-11. - Market and pool counts: VaultAdmin.next_vault_id = 99 and DexAdmin.next_dex_id = 10 on-chain, against 73 borrow markets and 7 Earn pools reported by DeFiLlama. Nine DEX pools exist on-chain, seven with smart collateral enabled and two with smart debt enabled.
- Oracle: program
jupnw4B6Eqs7ft6rxpzYLJZYSnrpRgPcr589n5Kv4oc, audited by Zenith and Offside per Jupiter docs. Hop-based, up to four sources in a sequential chain. Source types: Pyth, Chainlink, Redstone, StakePool, MsolPool, SinglePool, JupLend. Freshness 600s and 2% confidence for user operations; 7200s and 4% for liquidations. Docs state only Pyth validates confidence and the others "do not expose or check a confidence interval". JLP oracle wiring matches no documented source type. refresh. - Collateral concentration (73 vault markets, $979.08M): JLP $332.4M (33.9%), JUPSOL $199.4M (20.4%), WSOL $185.4M (18.9%), PST $66.5M (6.8%), dfdvSOL $63.5M (6.5%), INF $57.9M (5.9%), JLJUPUSD $19.3M (2.0%), SPYX $10.8M, cbBTC $10.4M, JitoSOL $8.5M, JUP $3.0M. Jupiter-issued combined $554.1M = 56.6%. Tokenized equities (SPYX, QQQX, NVDAX, TSLAX) about $9.9M.
- LTVs: range 0.50 to 0.94 across 73 markets. At 0.94: JupSOL/WSOL ($53.6M), INF/WSOL ($50.8M), JitoSOL/WSOL ($4.0M), fwdSOL/WSOL (dust). At 0.92: dfdvSOL/WSOL ($59.9M). Largest single market is JLP/USDC at $292.6M collateral, $185.6M borrowed, LTV 0.85.
- Yield: top APY 5.37% (JUPUSD Earn: 4.37% base plus 0.99% reward), then EURC 4.93% on $4.74M, USDG 4.91% on $3.20M, USDC 4.39% (3.70% plus 0.69%) on $437.00M, WSOL 3.62% all base. Zero pools above 8%. This corrects the draft's claim that the highest rates sit on the two largest pools; the second and third highest sit on small pools, but as pure base rates within 0.6pp of the largest, which is not the fake-headline pattern.
- Audits (verified at developers.jup.ag/docs/resources/audits this run, not carried): 10 reports. Certora formal verification 2026-01-07 to 2026-03-31; Code4rena 2026-02-12 to 2026-03-13; Certora formal verification 2025-09-15 to 2025-12-01; OtterSec report 2, 2025-11-12 to 2025-11-20; OtterSec report 1, 2025-08-20 to 2025-11-01; Offside Labs oracle and flashloan, 2025-10-13 to 2025-10-19; MixBytes vault, 2025-07-28 to 2025-10-14; Offside Labs vault, 2025-07-23 to 2025-08-04; Offside Labs liquidity, 2025-07-10 to 2025-07-18; Zenith, 2025-06-24 to 2025-07-31. That is 7 conventional audits by 4 firms plus 2 formal verifications plus the contest, confirming the previous report's count and adding a second Certora report. Code4rena independently confirms $107,000, mediums, no confirmed highs. No listed report covers the DEX, Smart Collateral, Smart Debt or v2, and every window closed on or before 2026-03-31, before the DEX program first deployed on 2026-06-18. refresh on whether any unpublished v2 audit exists.
- Change since last review: Lend v2 launched 2026-08-10 with Smart Collateral and Smart Debt, routing deposits into DEX liquidity pools so one position can earn lending interest, trading fees and staking rewards. CoinDesk states "The new version of Lend introduces two features, both optional", so this is opt-in rather than applied to all collateral, which corrects the draft. Corroborated on-chain by the DEX program's 2026-08-10 upgrades, its
turn_on_smart_colandturn_on_smart_debtinstructions, and nine live pools. - October 2025 stress test, corrected: TVL was $756.0M on 2025-10-10, fell 10.3% to $678.3M on 2025-10-11, recovered to $703.9M on 10-12 and $835.6M by 10-15. That is roughly 80% of today's TVL, not "a fraction" of it. Both the previous report's "October 2026" date and the draft's "roughly a month old and small" framing were wrong. Whether bad debt was incurred remains unverified. refresh.
- Incident scan: no Jupiter entry in DeFiLlama's hacks list (621 entries). Independent X scan 2026-06-01 to 2026-08-12 found no exploit, bad debt, socialized loss, oracle failure, liquidation failure, paused market, withdrawal problem or emergency multisig action. Criticism only, verified verbatim: @JukeOnSol (2026-08-10) on v2, "the risk is both yields sourcing from the same borrow demand, so they don't diversify, they liquidate together"; @MoneyCrptBunny (2026-08-10) noting that collateral providers absorb depeg losses while borrowers are protected and that "Jupiter controls the router deciding how much swap volume actually flows into these pools, and they also own the pools". One further post, @morteza_yousefy (2026-08-07), does allege realized retail losses from whale-triggered liquidation cascades and oracle lag during Solana congestion. It is a single uncorroborated account written in airdrop-farming promotional style, nothing in the on-chain or news record corroborates it, and it is recorded here as an allegation, not an incident.
- Bad-debt history and liquidation performance: not verified this run. refresh.
- Insurance fund or backstop: none confirmed. refresh. Maintained monthly. Methodology: DeFi Research Instruction v2.