TL;DR
jitoSOL is the receipt for SOL staked through Jito's stake pool. The pool runs on the canonical SPL stake-pool program maintained by Anza, not on a Jito fork. Read on-chain this run: 10.40M SOL backs 7.97M jitoSOL at 1.303721 SOL each. The stake is spread over 306 validators with none above 3.4%, and the pool takes 4% of rewards and 0.1% on withdrawals. The yield is real, inflation plus MEV at 4.87% over the last week on Jito's own API. The exit is good: Jupiter fills 50,000 jitoSOL within 11 bp of redemption value, and the manager has no switch that closes the stake-account withdrawal path. The weak point is how fast things can change. The program that holds the SOL upgrades on 6 of 10 Squads signers with no delay. The pool manager is the Jito DAO treasury, which a 4-of-7 Security Council can use the same day with no community veto. The Dev Council multisig that runs StakeNet reads a zero timelock, where the DAO's own JIP-36 specified 12 hours. None of the Jito-side powers reaches principal under today's program rules; only the stake-pool program's own upgrade key could. There has been no exploit or holder loss in almost four years.
Checklist
Audits & contracts. The SOL sits in stake accounts controlled by a program-derived address of SPL stake-pool (SPoo1Ku8WFXoNDMHPsrGSTSG1Y47rzgn41SLUNakuHy). I derived that address from the pool address, and it matches both the jitoSOL mint authority and the reserve's staker and withdrawer. The stake-pool docs list nine audits of the program: Kudelski 2021, Quantstamp 2021, Neodyme in 2021, 2022 and twice in 2023, OtterSec January 2023, and Halborn January and December 2023. Anza's audit repo adds a Certora formal verification dated 15 September 2025. That work found real bugs. The December 2025 release fixed accounting holes where a hijacked transient stake account could make a pool's share price jump or drop, and it said known deployments had been patched before disclosure. A small fee-check bug followed, fixed in a commit dated May 2026. The binary live today hashes to 8df58bc9..., the published verifiable build of v2.1.0, which carries that fix and caps any withdrawal-fee increase at 50 bp. Its embedded security.txt still names v2.0.3 as the source release, so the hash, not the label, is the evidence. No stake-pool report in Anza's repo is newer than the Certora work, so whether v2.1.0 had its own outside review is refresh. Jito's own code sits beside the principal rather than in it. OtterSec audited the Steward and Validator History programs in July 2024 and January 2024 (the reports carry osec.io contacts). Both have been upgraded many times since, most recently on 16 June and 21 May 2026. The Stake Deposit Interceptor has an Offside Labs report and two from Certora, the latest March 2026. Nothing in the stack is immutable.
Admin control. There are three layers, all read on-chain, and none has a timelock. First, the program. Its upgrade key is authority 1 of Squads v3 multisig 3yqoHFE4..., 6 of 10. The multisig took the key on 24 October 2023 and has upgraded the program four times since, last on 30 June 2026. The program's embedded security.txt points to Anza. Who holds the ten keys is refresh, and none of the fourteen current Jito Security Council and Dev Council keys I read is among them. Second, the pool. Squads' own Jito case study still says the stake pool manager is secured by a Squads multisig, but on-chain the manager, 5eosrve6..., is not a Squads vault. It is the native treasury of Jito's SPL-governance deployment (realm "Jito"). It became manager through a council proposal titled "Set JitoSOL Stake Pool Manager to DAO", executed on 4 December 2023, and it also holds about 209.8M JTO, 21.3% of supply. JTO holders pass proposals with yes votes worth 1% of supply, over a 5-day vote and a 2-day cool-off. The seven-member Security Council passes them at 51%, which is 4 votes, with early tipping and zero hold-up, and the community veto over council proposals is disabled. The council uses that power often: 45 council proposals have executed. They include a StakeNet fix drafted, voted and executed on 1 April 2026, and the August proposal that cast the pool's roughly 10M SOL in Solana governance. Third, delegation, which belongs to the StakeNet Steward. One Squads v4 multisig, 4 of 7, holds the Steward's admin and parameters authority, the upgrade keys of Steward, Validator History and the Interceptor, and the Interceptor's fee authority. It has executed 13 transactions since 17 June. Its configuration authority chains back to the DAO as JIP-36 describes: the DAO treasury configures a 3-of-4 Manager Squads, whose vault configures this one. Two things fall short of that design. All four Manager keys also sit on the 4-of-7, so the hop meant to check the Dev Council is held by a subset of its own signers. And its time_lock field reads 0, not the 12 hours JIP-36 specified. What keeps this yellow rather than red is the stake-pool program itself. Rewards-fee and withdrawal-fee changes wait two epoch boundaries, and each withdrawal-fee increase is capped at the smaller of 1.5 times the current fee or half a point, so from today's 0.1% the next step can only be 0.15%. The manager can gate stake deposits, SOL deposits and SOL withdrawals, but not stake-account withdrawals. Short of the program's own upgrade key, the Jito side can take yield and slow exits, but neither the manager nor the staker has an instruction that withdraws holders' SOL.
Oracle. There is no oracle in the mint or redeem path. The program computes the rate from the pool's own stake and reserve balances through a permissionless epoch update, last run in epoch 1045, the current one. Deposits and withdrawals refuse to run until that update lands each epoch, and anyone can run it. The remaining oracle question is ours. Hyperliquid lists no jitoSOL and the Birdeye fallback in our code is a stub, so the showcase sync prices jitoSOL from Jupiter's price API alone. That feed is noisy against the redemption value: reads seconds apart this run put jitoSOL/SOL anywhere from 54 bp under to 4 bp over 1.303721, because the two USD quotes update at different moments. On a 31.83 jitoSOL leg that is a marking wobble of up to about $26, not a protocol risk. Our cron logged four failed jitoSOL price ticks on 26 September, a day this host had network outages.
Liquidity & exit. Measured on Jupiter against the on-chain rate: the showcase's 31.83 jitoSOL returns 6.1 to 6.3 bp under redemption value, 1,000 returns 6.4 to 6.7 bp under, 10,000 8.8 bp and 50,000 10.6 bp. Past that it breaks: 100,000 costs 66 bp and 250,000 costs 289 bp. The pool's own paths are the backstop. SOL can come straight out of the reserve for a 0.1% fee; the reserve held 64,240 to 65,490 SOL across reads, about 0.6% of the pool, or roughly 49,000 to 50,000 jitoSOL of room. Anyone can also withdraw a stake account for the same 0.1% and wait up to about two days for it to deactivate. The manager can close the reserve path by setting a SOL withdraw authority, but the stake-account path has no such switch.
Yield: real vs emission. Real. Holders get Solana inflation plus MEV tips, minus a 4% rewards fee, with no JTO emissions mixed in. Where that fee goes changed this year. JIP-31, executed on 15 January 2026, says the fees go to a foundation-managed address that funds the BAM validator subsidy, and its execution moved the pool's fee account off a DAO-treasury account to one owned by GSyXx6WR..., which is also the block-builder account in Jito's tip-payment program. That changes who receives the fee, not what holders pay. Jito's API gives 4.87% averaged over the last 7 days, 5.10% over 90 and 5.69% over 365. That is down from 6.53% a year ago and 8.77% in January 2025. The slide has a structural cause beyond MEV: SGP-0002, which passed on 28 August at 67.001%, doubles Solana's disinflation rate from 15% to 30% a year once implemented. JIP-39 claims about 15 bp back by passing block rewards through a Jito-run validator.
Holder concentration. At network level jitoSOL is small: 10.40M of 441.25M staked SOL, or 2.36%. Delegation inside the pool is unusually broad: 306 validators hold 99.99% of it, the top ten 8.53%, and the 18 superminority validators 0.31%. Two sit well above the standard 31,927 SOL allocation: an unnamed validator at 3.40% whose stake comes almost entirely from the pool, and Hylo's at 2.65%. Directed staking under JIP-27 is the likely reason, but I did not confirm it. That spread is set to narrow. JIP-39 tells the Steward to move 25% of the pool, about 2.3M SOL by its own estimate, to Jito-operated validators. Its vote closed on 22 September with 10.60M JTO for and 0.71M against, over the 1% bar, and had not been finalized when read. Governance power is narrower still. Of the 21.17M JTO deposited to vote, 96.7% sits in 29 records of about 706,000 to 708,000 JTO each, 27 of them delegated, and the largest record outside that band is 250,000 JTO. The sizing fits the Jito Foundation delegation program: a February 2024 JTO vote approved delegating 12M JTO, which split 17 ways is exactly 705,882, and a September 2024 sentiment check backed expanding it. I did not map the owners. On the token side, the DAO treasury itself holds 95,170 jitoSOL, 1.19% of supply; the full holder list did not load this run: refresh.
Track record. Live since late 2022, with no Jito entry among the 1,290 rows of DeFiLlama's hacks list and no holder loss that I could find. 2026 was busy without being costly. The Security Council shipped three StakeNet fixes: on 14 January a Steward fix for directed-staking logic, on 2 March a fix bundled with preparation for the SIMD-0185 feature gate, and on 1 April an intervention after a Solana feature-gate change broke StakeNet's reading of validator commission; the GitHub fix is titled "decode v4 inflation commission bps". The holder impact of those bugs was not disclosed: refresh. The stake-pool program went through two security releases in the last year without an incident. Demand has cooled: the pool holds 10.40M SOL today against 18.96M at the June 2025 peak, a 45% outflow measured in SOL, before any price effect. One name check: a March 2026 headline pairing the Jito Foundation with a $27 million exploit is about SolanaFloor, which the Foundation bought after its parent Step Finance was hacked in January; no Jito program or jitoSOL was involved.
Worst case
The tail risk is the program, not Jito. Six of ten signers can replace the SPL stake-pool code that controls all 10.40M SOL, and there is no delay in which to leave. Solana had its reminder this year: DeFiLlama classifies the 1 April Drift loss of $295M as an upgrade hijack. A captured Security Council or Dev Council does less damage than it sounds, because the stake-pool program limits what the manager and the staker can do. They could queue a rewards fee of up to 100%, raise the withdrawal fee by at most 1.5 times per step and never more than half a point, close reserve withdrawals, and steer delegation to validators charging full commission. Every rewards or withdrawal fee change comes with two epochs' notice, and lifting the withdrawal fee from 0.1% to 1% would take six such steps. That is lost yield and a slower exit, not lost principal. BonkDAO's $20M drain in July, which DeFiLlama classifies as a malicious proposal, is the governance version of the same risk. Jito's backstop is the council's 51% veto over community proposals, which cuts both ways because nobody can veto the council. On the market side, a Solana stress day widens the discount. 100,000 jitoSOL already costs 66 bp, and beyond the reserve's roughly 49,000 to 50,000 jitoSOL, an exit at fair value waits about two days. For the showcase the sharp edge is the hedge. The 41.12 SOL short on Pacifica offsets SOL's price, not jitoSOL's exchange rate. Any discount is an unhedged loss, and if jitoSOL itself were impaired the short would be left naked. Slashing is not live on Solana. If SIMD-0212 is adopted, delegated stake becomes burnable, and JIP-39's 25% with one operator would matter a great deal more.
Bottom line
Solid. The SOL sits under a program address in Anza's canonical stake-pool program, which has been audited nine times and formally verified, and the binary on-chain matches its published build. Exits are deep to 50,000 jitoSOL, the manager cannot close the stake-account path, and the yield is real. The qualification is how fast governance can act. Nothing in the stack has a timelock, and the Security Council can act as pool manager the same day with no community veto. 96.7% of deposited JTO voting power sits in 29 uniform records. The 12-hour Dev Council delay the DAO voted for in June is not set on the multisig. None of the Jito-side powers reaches principal under today's program rules, and the one key that could, the stake-pool program's own 6-of-10 upgrade authority, has deployed exactly the published v2.1.0 build. That is why the verdict holds. Re-check next month: whether JIP-39 finalizes and how fast stake moves to Jito-operated validators, the Dev Council time_lock, who holds the stake-pool program's ten keys, where the 4% fee goes as the BAM subsidy winds down, and the yield after SGP-0002.
Data appendix
- TVL: $1,254.2M (DeFiLlama
jito-liquid-staking, child ofparent#jito, verified for this run; Jito Restaking is a separate $20.4M child). The same source's live field read $1,229.3M later in the day, and 10.40M SOL at Jupiter's roughly $118 per SOL gives about $1,227M, so read the figure as a band. Against the live $1,229.3M: $1,028.8M on 2026-08-31 (+19.5%), $771.3M on 2026-07-02 (+59.4%), $3,223.0M on 2025-09-30 (-61.9%), and the ATH of $3,909.9M on 2025-01-26 (-68.6%). In SOL (Jito API): 18.96M peak on 2025-06-02, 15.14M on 2025-09-29, 9.86M on 2026-06-30, 10.40M now. - Audits: SPL stake-pool, per solana-program.com: Kudelski 2021-07-07, Neodyme 2021-10-16, Quantstamp 2021-10-22, Neodyme 2022-12-10, OtterSec 2023-01-20, Halborn 2023-01-25, Neodyme 2023-01-31, Neodyme 2023-11-14, Halborn 2023-12-31. Anza's security-audits repo adds CertoraStakePoolFV-2025-09-15. Releases: v2.0.4 (2025-12-04, fixes found in audit and formal verification, with deployments patched before disclosure); v2.1.0 (2026-07-09, a fee-check fix and a 50 bp cap on each withdrawal-fee increase on top of the existing 1.5x limit); v2.1.1 (2026-09-09, not deployed, since the program's last deploy is 2026-06-30). The live code hash 8df58bc9f9428c02bf34fa845ae2961274156e7ff07a8dc1be0018dd765baeff equals the published v2.1.0 build; the embedded security.txt reads source_release program@v2.0.3 and lists security@anza.xyz ↗. StakeNet: Steward 2024-07-29 (commit f4ea93a) and Validator History 2024-01-12 (fc34c25), both by OtterSec. Interceptor: Offside Labs 2024-11-01, Certora 2024-12-01 and 2026-03-20. DeFiLlama's second audit link, a Neodyme Jito PDF on GitBook, now returns a small JSON body instead of a PDF: refresh.
- Admin/governance:
- Pool and mint: pool
Jito4APyf642JPZPx3hGc6WWJ8zPKtRbRs4P815Awbbruns onSPoo1Ku8WFXoNDMHPsrGSTSG1Y47rzgn41SLUNakuHy. The withdraw authority PDA6iQKfEyhr3bZMotVkW6beNZz5CPAkiwvgV2CTje9pVSS(bump 253) is the mint authority. There is no freeze authority, and the token is classic SPL Token. - Program upgrade key:
dPpFfahSWhm5M2RB3nVaHsXfnh9ooz5bWtR3WeUguDH, authority 1 of Squads v33yqoHFE4nBGchuVH5rJuZMFvsmnaDTuLLdvGPDUEJcbW, 6 of 10 (v3 has no timelock field). Held since 2023-10-24, with upgrades on 2023-12-28, 2025-06-19, 2025-09-30 and 2026-06-30. Signer identities: refresh. - Manager:
5eosrve6LktMZgVNszYzebgmmC7BjLK8NoWyRQtcmGTF, the native treasury of governance8cEhMTswovtkzQKWZx7h66bL2ZKF8fBADyzfL6MPt4PKin realm "Jito"jjCAwuuNpJCNMLAanpwgJZ6cdXzLPXe2GfD6TaDQBXt, on programjtogvBNH3WBSWDYD5FJfQP2ZxNTuf82zL8GkEhPeaJx(logs version 3.1.1). The 2023-12-04 SetManager, signed over by the previous manager key9X5Zn4dF..., named this treasury as manager and the treasury-ownedfeeeFLLsam6xZJFc6UQFrHqkvVt4jfmVvi2BRLkUZ4ias fee account. The treasury also holds 95,170 jitoSOL and about 12,155 SOL. - Fee account: since the JIP-31 execution on 2026-01-15,
8yoigZfzZ1nNaadumY9uPVD118225UYHTDpmjpr2nrSa(306.8 jitoSOL at read), owned byGSyXx6WRm2o6Qu4RWxTH17swLZKpTKQdQTS2uGcus1NF, a data-less system account that is also the block builder in Jito's tip-payment program. Single key or multisig, and where its balance is swept: refresh. - Governance config: community yes threshold 1% of supply, 250,000 JTO to propose, 432,000s of voting plus a 172,800s cool-off, hold-up 0, community veto disabled. Council yes threshold 51% of 7 tokens, early tipping, council veto 51%. The council mint's authority is the DAO treasury, and seven members hold one token each. This governance has 102 proposals, of which 45 council and 37 JTO proposals completed.
- A second, council-only governance (
EA4eoKGvoHK7ouJ2HnFbZPm18LuhUsoYVJEmETCVduvs, community voting disabled) holds the upgrade keys of the tip distribution and tip payment programs and of the governance program itself. - Staker and StakeNet: staker
9BAmGVLGxzqct6bkgjWmKSv3BFB6iKYXNBQp8GWG1LDYis the Steward state. Steward configjitoVjT9jRUyeXHzvCwzPgHj7yWNRhLcUoXtes4wtjvnames8EP3VommYzMRSdnSn88GnQpxjRwxg6nroTeUNJoqu9b8as admin and parameters authority. That is vault 0 of Squads v4AJVQRHk9rg25HzE2TompdcjfvQGuZdytPXhU1SgxUxBa(4 of 7, time_lock 0, 13 executed transactions from 2026-06-17 to 2026-09-24). The same vault holds the upgrade keys of Steward (last deploy 2026-06-16), Validator History (2026-05-21) and the Interceptor (2026-04-21). The Steward's blacklist authority is a separate system account,BXKbPdBDeiakHdumRXdodLuuFFNFDfAhGUvpf1zQAGak: refresh. - Config chain: the Dev Council multisig's config authority is vault 0 of Squads v4
578kK6o48Ygea1EDUY5ZV8UoMFGvZMq9SXZe2ERAev5x(3 of 4, time_lock 0, no transactions yet), whose own config authority is the DAO treasury. All four of its keys are also Dev Council keys, among them9X5Zn4dF..., the key that handed the manager role to the DAO in 2023. - Deposit and withdraw authorities: stake deposit authority
6hg6RMfjn3QSW6MdjH2Dg3dhF9XsVEE8CQXhjYwkRCiK(the Interceptor) charges a 10% fee that decays to zero over 36,000s, pays it to the DAO treasury, and held 41.78 jitoSOL in its vault at read. No SOL deposit or SOL withdraw authority is set. - Fees on-chain: rewards 4/100, SOL withdrawal 1/1000, stake withdrawal 1/1000, deposits 0, referrals 0, no pending changes.
- JIP-35 (new DAO constitution, executed 2026-06-18) and JIP-36 (veto trigger and Dev Council structure, passed 2026-06-16) set the current layout. Names behind the Security Council, Dev Council and Manager Squads keys, and whether JIP-36's 12h delay is enforced anywhere else: refresh.
- Pool and mint: pool
- Oracle: No external oracle. At the second read the rate was 10,396,677,847,199,958 lamports over 7,974,621,157,645,221 pool-token base units, or 1.303721 SOL per jitoSOL, and last_update_epoch was 1045, the current epoch. Showcase pricing tries a Hyperliquid mid first (1,119 symbols listed, no jitoSOL), then a Birdeye stub, then Jupiter
lite-api.jup.ag/price/v3($153.13 to $153.86 across reads with SOL near $118, a ratio of 1.29672 to 1.30422). DeFiLlama coins also prices jitoSOL (about $153.5) but is not wired into the showcase's jitoSOL pricing. - Validator set / delegation: Validator list
3R3nGZpQs2aZo5FDQvd2MUQ6R7KhAPainds6uT6uE2mnhas 673 entries (max 10,000), all Active, with about 10.33M SOL in validators plus the reserve. The 306 validators above 1,000 SOL hold 99.99%, and 364 sit at 2 SOL or less. Top 1 3.40% (DyjoG2US2XiVvL1MVzL2wjS5jCTmvo6aNwvqJfaPNx9u, unnamed on Stakewiz, about 351,750 SOL), top 2 2.65% (Hylo, 274,205 SOL), top 10 8.53%, top 50 20.89%, top 100 36.34%. The network superminority is 18 validators, and they hold 0.31% of the pool. Stake-weighted commission is 2.73%. Six to seven pool validators were delinquent across the two reads, holding 31,929 to 63,855 SOL. Why the top validator draws almost all its stake from the pool: refresh. - Holder concentration: jitoSOL top holders: refresh (the public RPC returned 429 on getTokenLargestAccounts in both reads, and Nansen holder data needs Pro). One known holder is the DAO treasury, with 95,170 jitoSOL (1.19% of supply) across two accounts. JTO supply is 986,522,462.9, of which the DAO treasury holds about 209.8M (21.3%). Voting: 1,275 records hold 21,171,169 JTO deposited (2.15% of supply). Of that, 29 records of 705,882 to 707,850 JTO each hold 20.48M (96.7%), 27 of them delegated, and the largest record outside that band is 250,000 JTO. Owners of those records and JTO insider unlocks: refresh.
- Peg and exit: Jupiter quotes against 1.303721 redemption: 31.83 jitoSOL -6.1 to -6.3 bp; 1,000 -6.4 to -6.7 bp; 10,000 -8.8 bp; 50,000 -10.6 bp; 100,000 -66.2 bp; 250,000 -288.5 bp (routed through Manifest, AlphaQ, Whirlpool, Raydium CLMM and Sanctum). Jupiter's price API ratio moved from -54 bp to +4 bp across reads. Daily DeFiLlama USD prices divided by the Jito API's daily TVL-over-supply rate give a worst reading of -47.8 bp in the last 90 days (2026-08-19), -93.6 bp in the last year (2025-12-03), and -610 bp on 2022-11-09, the FTX week, when the pool was days old. The same series prints +581 bp on 2025-01-19, so single days are sampling noise as much as trades. I found no primary depeg record. Worst real traded discount: refresh.
- Yield: Jito API APY 4.871% latest daily, 7d 4.87%, 30d 4.88%, 90d 5.10%, 365d 5.69%; 6.53% on 2025-09-29 and 8.77% on 2025-01-01. Solana Compass shows 4.86% (10-epoch realised). JIP-39 projects about +15 bp, to about 5.28%.
- Recent-news scan (2026-09-29): No exploit, pause or depeg found.
- JIP-39 (posted 2026-08-26): moves 25% of delegation, about 2.3M SOL, pro-rata to Jito-operated validator(s) at 0/0 commission with block rewards passed through, throttled at 12.5% per cycle. It also winds the BAM subsidy down to zero by the end of Q2 2027. The vote closed 2026-09-22 20:14 UTC at 10.60M for and 0.71M against and was still unfinalized on-chain at read.
- JIP-31 (executed 2026-01-15): the BAM Early Adopter Subsidy, funded by redirecting pool fees to a foundation-managed address; JIP-37 extended it through Q3 2026.
- JIP-38 (passed 2026-09-22): JTX fee buybacks and burns, aimed at JTO rather than jitoSOL yield.
- JIP-36 (passed 2026-06-16): two-hop Squads authority structure plus a 12h Dev Council timelock. The structure is live, but the timelock reads 0.
- SGP-0002 (closed 2026-08-28 at 67.001%): raises disinflation from 15% to 30% a year, pending implementation. The pool's stake was voted for by a Security Council proposal executed 2026-08-27 (882 transactions, also voting for SGP-0001 and SGP-0003), and Solana Compass reports the vote would have failed without JitoSOL's override.
- SEC staff FAQ (2026-09-25, non-binding): staking receipt tokens issued by protocol-based providers may be classified as digital commodities. Jito reads it as clearing JitoSOL for staked-SOL ETFs, but the SEC did not name it.
- Solana Compass on Q2 2026: Jito protocol revenue $1.28M (-45% QoQ), and JitoSOL's share of the LST market 17.3%.
- Slashing: not live (Everstake, updated 2026-09-09). SIMD-0212 would burn delegated stake and is not final.
- Solana analogs in DeFiLlama's 2026 list: Drift $295M (2026-04-01, upgrade hijack) and BonkDAO $20M (2026-07-06, malicious proposal).
- Name check: the March 2026 story of the Jito Foundation buying SolanaFloor refers to the January hack of Step Finance, SolanaFloor's parent, which DeFiLlama records at $40M. No Jito program or jitoSOL was involved.
Maintained monthly. Methodology: DeFi Research Instruction v2.