TL;DR
Kamino Lend holds $1.38B and is still the largest lending venue on Solana, by a wider margin than last month. It is $1.38B against Jupiter Lend's $1.14B, a 21% lead where August's was 12%. The money came back. TVL is up 25.6% over 90 days after falling 24.2% over the 90 days before that, and the protocol now sits at 41.0% of its October 2025 peak rather than 31.3%. The admin picture measured in August survived re-measurement: 5 of 10 signers on a Squads v4 multisig, an 86400 second timelock, and an upgrade authority that is provably a program derived address rather than anyone's keypair. The timelock was enforced again in the period, on a real upgrade.
What changed this report is the oracle, and it did not come from a price feed going wrong. It came from reading Kamino's own lending source. Borrowing requires the full set of price checks, including the TWAP divergence guard. Liquidation requires a shorter set that leaves the TWAP guard out. So the check that refuses to let you open a position on a bad wick will not refuse to liquidate you on one. That is a verified code fact, not an inference, and it is why this report stays at caution instead of drifting upward on the back of good TVL numbers.
Checklist
Audits & contracts. 42 published reports in the official audits repository across six firms: Certora (13 files), OtterSec (13 across its two filename spellings), Offside Labs (7), Sec3 (4), Ackee Blockchain (3) and RX Security (1), with one file naming no firm. By product that is 21 on lending, 10 on vaults, 4 on Limo, 3 on Scope, 2 on liquidity and 2 on farms. Certora and OtterSec both contribute formal verification, and an Immunefi bounty paying up to $1.5M for a critical smart-contract bug backs it, re-verified live this run. For any lender on any chain this is unusually deep coverage, and it is the strongest thing about Kamino. The downgrade from last month is about freshness, and it is worse than the August note suggested. The audits repository's last push is still 2026-05-20, exactly where it was, and the newest lending reports cover version 1.17.0. That version is a commit from 2026-03-31. The source repository has since tagged eight releases past it, 1.18.0 through 1.25.0, and its master branch now reads 1.25.0. Release 1.25.0 was committed 2026-08-18 at 16:42Z, two hours before the upgrade proposal was created and two days before the program was redeployed on chain. We could not prove which version is running, because the deployed bytecode carries no version string, but the shape of it is six months and eight releases between the audited artifact and the one holding the money. Green should mean the code custodying deposits has been looked at.
Admin control. Re-measured, not carried over. Both programs are still upgradeable, neither is frozen, and both still name GzFgdRJXmawPhGeBsyRCDLx4jAKPsvbUqoqitzppkzkW as upgrade authority. This run proved that authority is what it claims to be rather than trusting last month's note: the key does not decompress to a valid ed25519 point, so no private key can sign for it, and recomputing the Squads v4 vault derivation from scratch reproduces it exactly at index 0, bump 250, of multisig 6hhBGCtmg7tPWUSgp3LG6X2rsmYWAc4tNsA6G4CnfQbM. That multisig account is owned by the Squads v4 program itself. Reading it directly: threshold 5, 10 members each holding initiate, vote and execute, config authority unset so it is autonomous, time lock 86400 seconds. All identical to August. The lock was exercised again in the period. Proposals 95 and 96 were created 2026-08-18 18:40Z, reached their last approval 2026-08-19 10:46Z and executed 2026-08-20 14:04Z, 27.3 hours later, clearing the 24 hour delay; the lending program's last deployed slot timestamps to that same minute. The two proposals that were sitting approved and unexecuted in August, 93 and 94, executed on 2026-08-12, twelve days after approval. Nothing is pending at the head of the queue now. Two things still hold this at yellow. Five keys can replace the code custodying every deposit, and a 24 hour warning only helps a depositor who is watching a multisig nobody has told them to watch. Separately, the parameters that decide whether you get liquidated do not run through that multisig at all: the primary market is owned by vault 0 of a different Squads v4 multisig, 7idEEVRidWrahZJhxXMqniDbV6ESj7ZjyLrigcMcEt6H, at threshold 4 of 10 with a 43200 second lock. The faster, looser path governs the settings that touch users first.
Oracle. This is the dimension that moved, and it moved on evidence. Kamino-run markets price through Scope, the protocol's own aggregator over Pyth and Switchboard with confidence and staleness checks, and Scope carries three independent audits. The confidence bound in the source is 2%. On top of that sits a TWAP divergence check, configured per reserve through max_twap_divergence_bps and max_age_twap_seconds. Reading PriceStatusFlags in the lending program this run, there are six check bits, and ALL_CHECKS requires all six. The borrow gate requires ALL_CHECKS, and so does withdrawing while the obligation has active borrows. But assert_obligation_liquidatable requires LIQUIDATION_CHECKS, which is defined as price loaded, price age checked and price usage allowed, and nothing else. The TWAP bit, the TWAP age bit and the heuristic bit are all absent. The practical shape of that: when spot runs far enough from TWAP that the protocol declares the price unfit to lend against, the same price remains fit to liquidate against. There is a second, quieter edge in the same file. When a reserve has TWAP disabled, the code sets the TWAP bits to satisfied rather than leaving them unset, so a reserve with no TWAP configured passes ALL_CHECKS on those bits anyway. Whether TWAP is enabled at all is a per-reserve setting owned by whoever owns the market. And most markets on this program are not Kamino's: 372 of 594 reserves, 62.6%, sit on markets owned by other keys. Kamino's documented remedy for an oracle incident is a market-level kill switch, the price_triggered_liquidation_disabled flag, which blocks all price-triggered liquidations. It is real, it is in the curator docs, and it belongs to the lending_market_owner and nobody else. On a lending venue the oracle is the fund-loss surface, and a guard that is off on the path where users actually lose money does not clear yellow.
Liquidity & exit. Better than last month on every number that moved. TVL is $1.3816B against the $3.3725B peak of 2025-10-07, so 41.0% of peak, up from 31.3% in August. It is up 21.0% over 30 days and 25.6% over 90, reversing the previous quarter's decline, and up 30.9% since the last report. Over longer windows it is still down 26.5% on 180 days and 55.8% on the year. No exit has ever failed here. Liquidations are permissionless, and the primary market's emergency mode reads not engaged. Three third-party markets do read emergency mode engaged right now, which is worth knowing both ways: the pause mechanism is real and in use, and if you are in one of those three markets you are not moving. On depth, the curator who writes Kamino's monthly risk report put the main market at 39% utilization for August, with Ethena at 46%, Prime at 43% and OnRe at 33%. Those are comfortable numbers and they argue against a withdrawal squeeze, but they are Allez Labs' figures for last month rather than our own sample of the reserves today.
Yield: real vs emission. Real. Borrow interest plus vault and liquidity fees, paid by borrowers. KMNO rewards and points sit on top as a separate incentive layer and should not be read into the base rate.
Holder concentration. Closed part of last month's gap, though not the part the scorecard line names. KMNO is 5,569,863,356 circulating against the 10B cap, so 55.70% is out and 44.30% is still locked, at $0.02763 for a $153.9M market cap and $276.3M fully diluted. The token is up about 52% since the August report while the protocol's TVL rose 31%. The allocation table is the part that matters: 35% to Key Stakeholders and Advisors and 20% to Core Contributors, so 55% of the entire supply is insider allocation, vesting into 2027 largely on cliffs. 229.17M KMNO unlocks on 2026-09-30, about 4.1% of circulating supply and roughly $6.3M at today's price, on what two sources describe as a monthly cadence of the same size. Top-holder distribution is still not pulled: the public RPC rate-limited the largest-accounts call across nine attempts over two rounds and the labelled alternative returned a paid-tier refusal. What can be said with certainty is the part that governs the money rather than the price. Both multisigs read config authority unset, meaning autonomous. They answer to their own members. The governance forum publishes monthly risk insights, most recently for August 2026 on 2026-09-05, and named Gauntlet as an official vault curator in November 2025, but it reads as an informational forum and no binding on-chain vote mechanism was found this run.
Track record. TVL history begins 2023-10-12. DefiLlama's hacks list now runs to 1273 rows and contains zero Kamino entries, checked this run. No protocol-level exploit in almost three years, and two stress events cleared without bad debt to the protocol: the October 2025 deleveraging, and the February 5 to 6 2026 correction, where SOL fell 18% over 48 hours and the protocol processed 55,649 liquidations across 30,030 wallets, seizing $19.36M of collateral, with bad debt at zero. Context on the neighbourhood, from the same hacks list: Solana lending and trading venues lost real money in 2026, including Drift Trade in April and DefiTuna Lending in July. Kamino did not. One July 2026 event should be stated plainly so nobody files it wrong later: an attacker flash-borrowed $1.12M USDC from Kamino to drain $1.65M from Allbridge Core, repaying inside the same transaction. Kamino was the liquidity source, not the victim. The protocol's own claim of roughly $16B issued with zero bad debt is its claim, and was not independently verified here.
Worst case
Two shapes, and the cheap one is not the dramatic one.
The dramatic one: five of ten signers on the upgrade multisig collude or are compromised, queue a malicious upgrade, wait out 24 hours and replace the code holding $1.38B. The delay is a genuine warning window and it has been enforced twice in observable history, but it is a window only for someone watching a multisig address, and nothing about a queued proposal is pushed to depositors.
The cheap one costs an attacker nothing and does not need the multisig. A volatile hour prints a wick deep enough to exceed a reserve's TWAP tolerance. The protocol correctly refuses to let anyone open a new position at that price. It does not refuse to liquidate at it, because the liquidation path does not require the TWAP bit. Liquidators, who are permissionless and fast by design, take collateral from borrowers who were solvent at the reference price the protocol itself considers the honest one. The wick is not hypothetical, and we measured it rather than taking it on trust: on Binance, the SOL hourly candle beginning 2025-10-10 21:00Z opened at $196.84, traded down to $168.79 and closed back at $193.41. That is 14.2% down and most of the way back inside sixty minutes, against a SOL reserve whose divergence tolerance third-party analysis puts at 10%. What happened inside that window at Kamino is that analyst's count, not ours: about $20M of collateral liquidated across 9,121 events overall, of which 8,168 events and $16.9M fell in the crash hour itself, affecting roughly 1,700 wallets, with an estimated $1.08M of it premature on a TWAP basis. We did not reproduce those figures. The code asymmetry behind them we did reproduce, from Kamino's own repository, today. A depositor who only supplies is largely outside this. A borrower, and anyone running the leveraged loops Kamino is best known for, is squarely inside it.
Layered underneath both: 193 of the 220 decodable markets on this program are curator markets, which since V2 is the product rather than a defect. Their owners set LTV, caps, the kill switch and the price feed. The three largest such owners hold 44, 23 and 15 markets, all of them plain on-curve keys with nothing on chain requiring a second signature, and one of them has no account on chain at all. Bad debt in a K-Lend market is socialized across that market's lenders, and there is no meaningful insurance fund.
Bottom line
Caution, held for a different reason than last month. The financial trend improved on every axis this run: TVL up a quarter over 90 days, the lead over Jupiter Lend widened from 12% to 21%, a new CEO hired out of Yieldstreet on 2026-09-15 to run a New York institutional push, and Galaxy live since 2026-09-17 with curated USDC and USDT vaults on the protocol. The admin surface re-measured clean and the timelock proved itself again on a real upgrade. None of that is what decides the verdict.
What decides it is that the price guard which protects the protocol is not the price guard which protects the user, and we can point at the line where the two diverge. Kamino's position, as reported, is that this is intentional, and it is worth saying that most major lenders liquidate against a spot oracle too. The difference here is that Kamino built the TWAP defence, wired it into the borrow path, and left it out of the one path where a user's collateral leaves their account.
For the showcase: supplying into Kamino-administered markets is reasonable at a sized allocation, and that is where the audits, the multisig and the record actually apply. Leveraged borrowing on this venue carries a liquidation-pricing risk that the protocol's own documentation does not lead with, and should be sized as though a wick can take you out at a price the protocol would refuse to lend against. Anything on a curator market is a separate diligence job on that curator and is not covered by this verdict.
Data appendix
- TVL: $1,381,646,779 (DefiLlama, slug
kamino-lend, snapshot dated 2026-09-19). Peak $3,372,533,427 on 2025-10-07, so 41.0% of peak, up from 31.3% on 2026-08-11. 7d +2.2%, 30d +21.0% (from $1,141,781,459), 90d +25.6% (from $1,099,885,382, where the prior period read -24.2%), 180d -26.5%, 365d -55.8%. Up 30.9% against the last report's printed $1.0554B; DefiLlama's own stored point for 2026-08-11 is $1,052,065,914, which gives +31.3%. History begins 2023-10-12. - Scope:
kamino-lendis a child ofparent#kamino-finance. The siblingkamino-liquidityis a separate product at $75.99M and is deliberately excluded. Parent total reads about $1.458B. - Rank: largest Lending-category protocol by Solana TVL. On the
/protocolslisting, Kamino Lend $1,381,646,779 against Jupiter Lend $1,141,341,294, a 21.1% lead where August's was 11.8%, then Save $90.5M, Loopscale $73.8M, Project 0 $64.3M, marginfi $39.1M. The single-protocol/tvlendpoint reads Jupiter Lend slightly lower at $1,137,417,427; both sides of the comparison above come from the same listing. - Programs: lending
KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD, program data9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA, last deployed slot 440486775 whichgetBlockTimeputs at 2026-08-20 14:04Z. This is new since the August report, which read 2026-05-28. VaultsKvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd, program dataGeZ7nkkcbJ6VVV1XVFbmFnLCY3F1LPBGk6cufDZvrbGn, last deployed slot 432874668 at 2026-07-14 14:54Z, unchanged. Both carry a non-null upgrade authority under the upgradeable BPF loader, so neither is frozen. Neither deployed binary contains a version string, so the running version could not be read off chain. - Upgrade authority, proven this run: both programs name
GzFgdRJXmawPhGeBsyRCDLx4jAKPsvbUqoqitzppkzkW. Ed25519 point decompression on those bytes fails, so it cannot be a keypair. Recomputingfind_program_address(["multisig", 6hhB..., "vault", 0], SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf)reproduces it exactly at bump 250. The multisig account is owned by the Squads v4 program. - Upgrade multisig
6hhBGCtmg7tPWUSgp3LG6X2rsmYWAc4tNsA6G4CnfQbM: threshold 5, 10 members all holding initiate plus vote plus execute, config authority unset (autonomous), time lock 86400 seconds, transaction index 96 (was 94 in August), stale index 85, no rent collector. Every field identical to the August read except the transaction index. - Timelock, observed rather than assumed: proposal 95 created 2026-08-18 18:40:50Z, last approval transaction 2026-08-19 10:46:40Z, executed 2026-08-20 14:04:04Z, 27.3 hours later against the 86400 second lock. Proposals 95 and 96 both executed at 14:04Z, matching the lending program's last-deployed slot to the minute. Proposals 93 and 94, which were approved and unexecuted at the last report, executed 2026-08-12 16:07Z and 16:08Z, twelve days after approval. Every proposal from 77 to 96 now reads Executed with 5 approvals, zero rejections and zero cancellations.
- Still pending: proposal 76, a SetTimeLock to 259200 seconds, remains Active with 4 approvals and unexecuted since 2026-04-28, its last transaction 2026-04-30 11:26Z. It would lengthen the delay, not shorten it, so its inertia is not a risk. Contents of the executed proposals 93 to 96 were not decoded: refresh.
- Market-configuration multisig
7idEEVRidWrahZJhxXMqniDbV6ESj7ZjyLrigcMcEt6H: threshold 4, 10 members, time lock 43200 seconds, config authority unset, transaction index 296. Its vault 0 is24LjDBukaUSHgPowcF2wY1XscnhChcBUDETN2UhBZMMT, the owner of the primary market. - Market layer, recounted: 594 Reserve accounts, and 222 accounts carrying the LendingMarket discriminator. Two of those 222 are 664 byte stubs rather than the 4664 bytes of a real market and were not decoded (
3wC2sxs6bKSYZ5k8KmoYXGy2nCJkWYwrHssf4SMXkW9vand9pMFoVgsG2cNiUCSBEE69iWFN7c1bz9gu9TtPeXkAMTs; both read the same value at the owner offset, and it matches no real market, so the bytes are not an owner). Across the 220 decodable markets there are 58 distinct owner keys (August read 558 reserves, 213 markets and 54 owners). 27 markets holding 222 reserves belong to the two Kamino authorities:24LjDBuk...(14 markets, 149 reserves) andA9rQoX1sictAQkyXxaZA8nz674xutHwoqpK2mwLyexCZ(13 markets, 73 reserves), both off-curve. The other 193 markets and 372 reserves belong to 56 other keys, so 62.6% of reserves and 87.7% of markets are configured by someone other than Kamino. Largest third-party owners:Cv4MFCqMqp5AwoEgybC17Qt4EqSQZ9oCf21AVPVuG8jC(44 markets, 49 reserves),radixktqpGoNxK6Y8eKBvKkerx6yLgEJUJ2pTwEFajS(23, 20),FU76ac2Hm2mo4hoyckhAKDrbKTFwxyDPHnrrERfMXusE(15, 28),sadmBTQm5HJsyzWHEjV4YwG9CiahZKVDVqAyS4Wx1zH(11, 27). All four are on-curve;radixktq...has no account on chain at all and the other three exist only as funded system accounts with no data. - Emergency mode: the primary market
7u3HeHxYDLhnCoErrtycNokbQYbWGzLs6JSDqGAv5PfFdecodes quote currency USD, referral fee 0 bps, emergency mode 0, meaning not engaged. Three real markets read emergency mode engaged,3FgMPrMmtBRzPVsjPdDXYvEJvc3R4pg1c3SmG95Tgznc,5UQZbR5geHGuYY1EWQeu2W6iHtX8coR7HE16K7gBZAcAand7kaNagzbxvu3LwLa176Vrhb8TJFbDq5nDQtBB7zwrzQV, and all three are third-party owned. A fourth hit in the scan is one of the 664 byte stubs, where that offset is not the emergency field. Field offsets were validated against the primary market before the scan. - Oracle check masks, read from
Kamino-Finance/klendmaster this run:programs/klend/src/state/last_update.rsdefinesPriceStatusFlagsas PRICE_LOADED 0b000001, PRICE_AGE_CHECKED 0b000010, TWAP_CHECKED 0b000100, TWAP_AGE_CHECKED 0b001000, HEURISTIC_CHECKED 0b010000, PRICE_USAGE_ALLOWED 0b100000.ALL_CHECKSis all six.LIQUIDATION_CHECKSis PRICE_LOADED union PRICE_AGE_CHECKED union PRICE_USAGE_ALLOWED, that is 0b100011, omitting three bits. Inprograms/klend/src/lending_market/lending_operations.rs,check_borrow_possiblerequiresALL_CHECKS, andwithdraw_obligation_collateralrequiresALL_CHECKSwhen the obligation has active borrows andNONEwhen it does not, whileassert_obligation_liquidatablerequires onlyLIQUIDATION_CHECKSfor the repay reserve, the withdraw reserve and the obligation. Inprograms/klend/src/utils/prices/checks.rs, when a reserve has TWAP disabled the code explicitly sets TWAP_CHECKED and TWAP_AGE_CHECKED to true.MAX_CONFIDENCE_PERCENTAGEis 2 inprograms/klend/src/utils/prices/mod.rs. - Oracle stack: Scope aggregator over Pyth and Switchboard with confidence and staleness checks, three independent audits (Sec3, OtterSec, Offside Labs). Per-reserve feed configuration, TWAP enablement and divergence tolerance belong to the market owner. Kamino's curator docs describe the market-level kill switch as the
price_triggered_liquidation_disabledfield, set by thelending_market_owner, which blocks all price-triggered liquidations during an oracle incident. Whether any live market points at a hardcoded or issuer-controlled feed, and how many reserves have TWAP disabled: refresh. - Audits: 42 PDF reports in
github.com/Kamino-Finance/audits, default branchmaster, last pushed 2026-05-20T11:07Z, unchanged since the August report. By product: 21 lending, 10 vault, 4 Limo, 3 Scope, 2 liquidity, 2 farms. Newest lending reports cover version 1.17.0 (Certora, and an OtterSec file covering 1.16.0 and 1.17.0). A third-party summary encountered this run credited Kamino's audits to Halborn; no Halborn report exists in the repository and none is claimed here. - Version drift, measured this run:
Kamino-Finance/klendmaster reads version 1.25.0 inprograms/klend/Cargo.toml. Tagrelease/v1.17.0is a commit dated 2026-03-31; eight tags sit past it (1.18.0 through 1.25.0). Tagrelease/v1.25.0is a commit dated 2026-08-18 16:42Z, two hours before upgrade proposal 95 was created and two days before the on-chain redeploy. Which version is actually running: refresh. - Bug bounty: Immunefi, live, paying 10% of funds directly affected for a critical smart-contract bug with a $1.5M maximum and a $150k minimum, $100k high, $10k medium, and $50k for a critical web or application bug.
docs/SECURITY.mdin the audits repo states the previous program was replaced by Immunefi. - KMNO: $0.02763, market cap $153.9M, fully diluted $276.3M, circulating 5,569,863,356 of a 10,000,000,000 cap (55.70% out, 44.30% locked). On-chain total supply reads 9,999,956,814.836090. All-time high $0.2478 on 2024-12-15, down 67.2% over the year, up about 52% since the 2026-08-11 report. Allocation: Key Stakeholders and Advisors 35%, Core Contributors 20%, Community and Grants 18.5%, Liquidity and Treasury 10%, Genesis Community 7.5%, Seasons 2 to 5 9%, with cliff vesting on the insider tranches. Next unlock 2026-09-30, 229.17M KMNO, about 4.1% of circulating and 2.29% of the cap, roughly $6.3M at today's price, on a monthly cadence of the same size; two sources name Core Contributors as the recipient and neither reproduces a split across allocations, so the split is refresh. Top-holder distribution: refresh, the public RPC returned 429 on
getTokenLargestAccountsacross nine attempts in two rounds and the labelled holder source returned a paid-tier refusal. - Governance: both multisigs read config authority unset, so neither answers to a token vote.
gov.kamino.financepublishes monthly Kamino Lend Risk Insights written by the Allez Labs risk team, most recently for August 2026 posted 2026-09-05, and announced Gauntlet as an official vault curator on 2025-11-11. No binding on-chain vote mechanism was found this run: refresh. - Utilization and liquidation stress, from the curator's own August 2026 report (not our sample): main market 39%, Ethena 46%, Prime 43%, OnRe 33%. August saw $0.47M of collateral seized across 616 liquidation events at an average size of $760, with no bad debt; 87.7% of the uncorrelated book sat more than 25% from liquidation and $0.62M sat inside 5%. The same report notes that about 95% of the month's $258.6M supply increase was price revaluation rather than new deposits, and that Prime and Maple shed a combined $30M.
- Incidents: zero Kamino entries across all 1273 rows of DefiLlama's hacks list, checked 2026-09-20. The 2026-07-19 Allbridge Core exploit ($1.65M) used a $1.12M USDC flash loan drawn from Kamino and repaid in the same transaction; Kamino was the liquidity source and took no loss. The February 5 to 6 2026 correction (SOL 18% lower over 48 hours) produced 55,649 liquidations across 30,030 wallets and $19.36M of seized collateral with zero bad debt, per Kamino's own governance post-mortem. October 2025 event figures (about $20M of collateral liquidated across 9,121 events overall, of which 8,168 events and $16.9M in the crash hour, roughly 1,700 wallets, an estimated $1.08M premature on a TWAP basis, against a stated 10% divergence tolerance on the SOL reserve) come from third-party analysis and were not independently reproduced: refresh. The price move behind them was measured here: Binance SOL/USDT hourly candle opening 2025-10-10 21:00Z ran 196.84 open, 199.15 high, 168.79 low, 193.41 close, so 14.2% down from the open and most of the way back within the hour.
- Recent news: 2026-09-15, Kamino named Michael Weisz, co-founder of Yieldstreet, as CEO, with a New York headquarters and an expansion into tokenized real-world assets including home equity loans; the same report cites $1.4B of assets, PRIME market deposits passing $600M within 107 days of launch, more than $650B of cumulative transaction volume over four years, and Forward Industries and Galaxy Digital using Kamino infrastructure. Galaxy Curation's USDC and USDT vaults on Kamino were reported live 2026-09-17 by several outlets, described as moderate-risk strategies with the USDT vault aimed at capital preservation and the USDC vault at broader collateral exposure; not verified on chain this run.
Maintained monthly. Methodology: DeFi Research Instruction v2.