Jupiter Lend (Solana)

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

UNDER REVIEW; do not approve at the scheduled review without proof that the July 2026 Code4rena findings were fixed in deployed programs. Jupiter Lend launched in August 2025 and scaled faster than its stress record: DefiLlama reported $925.7M TVL and $855.1M borrowed on 2026-08-14, after a $1.17B TVL peak in March. The architecture is Fluid on Solana: lenders receive transferable JL tokens, a shared liquidity layer funds Earn, Borrow, and Multiply within a market, and tick-based partial liquidation plus dynamic borrow and withdrawal ceilings manage flows. Separate top-level markets are isolated, but vaults inside the Jupiter Market reuse the same asset liquidity; “isolated vault” is not the same as segregated lender principal. Security work is substantial—seven listed firm audits, formal verification, and a 29-day Code4rena contest—but the final contest report found three medium issues, including a liquidation-engine denial of service during extreme ratios and two accounting paths that could over-credit suppliers and create reserve deficits. The public report does not record deployed remediation. Documentation also expanded the product in August 2026 to Smart Vaults whose collateral or debt doubles as Jupiter AMM liquidity, adding composition and DEX execution risk during this very review. Time remains a blocker, but it is no longer the only blocker. Reopen after deployed fixes are mapped to audited commits, live roles are disclosed for the Jupiter Market, and the fixed system completes at least twelve clean months including a material Solana volatility event.

Kill criteria: the events that revoke this verdict
• Any exploit or bad debt event
• Oracle design change without published migration
• TVL growth outpacing the audit and review cadence

The research file

The mechanism

Earn deposits enter a token-level liquidity layer and receive a transferable JL token whose redemption value grows from borrower interest. The protocol retains a 10% reserve factor, so lenders receive 90% of borrow interest before incentives. Borrow and Multiply positions are pair-specific vaults represented by position NFTs. Positions are grouped into debt-to-collateral ticks spaced by 0.15%; when a position crosses its liquidation threshold the engine partially liquidates it, while a higher Liquidation Max Limit causes full liquidation. Pyth, Chainlink, RedStone, and contract redemption rates can feed the hop-based price system.

The important boundary is the market, not every displayed vault. Jupiter now documents a Jupiter Market curated by Fluid and a separately administered Bitwise x Ethena Market. The top-level markets have distinct liquidity, configuration, and admins, so a failure in one should not contaminate the other. Within a market, the liquidity layer is explicitly shared across Earn, Borrow, and Multiply: the same asset supply supports several vaults and products. Dynamic borrow and withdrawal ceilings expand over six-hour intervals, throttling large instantaneous flows. Smart Vaults added in August 2026 go further by making collateral or debt token pairs serve as Jupiter AMM liquidity, so trading fees and changing pair composition enter the lending exposure.

Who controls it

Fluid curates the main Jupiter Market: it selects assets and configures LTV, liquidation thresholds and penalties, debt ceilings, and oracle review. Curators cannot custody or withdraw user assets, but their configuration choices determine whether liquidation and pricing remain solvent. New assets—including LSTs, JLP, xStocks, JUICED, and Smart Vault pairs—are added to this governed surface.

The docs disclose the Bitwise x Ethena Market more precisely: a distinct 6-of-10 multisig with a 12-hour timelock can upgrade programs and change oracles, core risk parameters, and borrow limits; a separate 6-of-10 team multisig can change rate kinks, fees, rewards, and invoke emergency pause. Oracle source configuration and the initialization-authority scope are described as immutable. Equivalent signer identities, thresholds, timelocks, upgrade authorities, guardians, and emergency powers for the much larger Jupiter Market were not located in the user docs reviewed. That disclosure gap is decision-relevant, not clerical.

The record

Jupiter says Lend launched in August 2025. DefiLlama’s series records rapid scale and, at this review, $925.7M TVL with $855.1M borrowed; TVL peaked at $1.17B on 2026-03-17. No confirmed exploit or realized bad-debt event in Jupiter Lend was located through 2026-08-14. Jupiter’s own year-end account claimed zero bad debt, but that is a sponsor statement and covers only the first five months.

The official security page lists seven Lend assessments: Offside on liquidity, vaults, and oracle/flash loans; MixBytes on vaults; two OtterSec engagements; and Zenith, all in 2025. A Certora formal-verification report is also published. The Code4rena contest ran 2026-02-12 through 2026-03-13 against live/deployed code; its final report dated July 11 records three medium findings and 86 QA reports. M-01 describes an extreme-ratio window that can revert the liquidation engine and other operations precisely during market stress. M-02 and M-03 describe interest-bearing supplier accounting that can credit more redeemable value than borrowers fund, leaving later withdrawers with a reserve deficit. The report supplies recommended fixes but no resolved status or deployed commit, so this review cannot assume they are remediated.

The exit

JL tokens are transferable claims on their lending pool, but contractual redemption depends on unborrowed liquidity and the active withdrawal ceiling. Jupiter warns that high utilization or mass withdrawals can delay exit. The ceiling contracts as outflows accumulate and expands over time; the protocol also retains a Withdrawal Gap so liquidation flows have priority over maximum lender exit. These controls can reduce a run’s speed while explicitly denying immediate par liquidity to every supplier at once.

TVL is not executable liquidity. A client file must record pool-level available cash, utilization, current and base withdrawal limits, withdrawal gap, borrower concentration, and whether a secondary JL-token market has usable depth. Those measurements were not preserved in this registry entry. For Smart Vaults, exit can also entail internal rebalancing or swaps to match a pair ratio. The memo therefore does not establish that its $10M minimum-liquidity rule is satisfied for USDC, USDT, or SOL independently.

The comparison

Kamino is the mature Solana lending comparator; Aave is the cross-chain standard for operating history. Jupiter’s advantages are efficient tick liquidations, dynamic flow limits, transferable claims, Jupiter distribution, and isolated top-level markets. Its disadvantages are less than one year of public operation at review, very rapid balance-sheet growth, a shared within-market liquidity layer, curator and upgrade powers, and unresolved public audit findings that touch liquidation liveness and reserve conservation.

Offerbook is not a substitute comparator inside this memo. It is fixed-term peer-to-peer lending with different collateral enforcement and no price-based liquidation, so it requires a separate exposure and exit analysis. The decision recommendation for Jupiter Lend is continued zero allocation, followed by a formal rejection if remediation evidence and main-market authority disclosure are still absent at the next review.

Open questions

For each Code4rena medium, identify the deployed fix transaction, program version, source commit, follow-up test or auditor confirmation, and any reserve reconciliation performed for the period before the fix. Determine whether M-02 and M-03 could have created an existing accounting deficit and publish the result by token. Publish the Jupiter Market multisig signers, thresholds, timelock, upgrade authority, guardian powers, oracle-change path, and curator service agreement.

For a candidate USDC pool, preserve daily available liquidity and withdrawal limits, the ten largest borrowing vaults and collateral sources, liquidation volume during the largest SOL drawdown, oracle failover tests, bad debt, and incentive-free lender yield. Reopen only after twelve months on the remediated deployment and at least one material volatility event without frozen operations, reserve deficit, lender loss, or discretionary treasury rescue.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Jupiter documentation — Lend markets and curator model · primary · accessed 2026-08-14
  Supports: market isolation, curators, admin controls
• Jupiter documentation — Earn · primary · accessed 2026-08-14
  Supports: JL tokens, reserve factor, lender risks
• Jupiter documentation — liquidity layer and risk management · primary · accessed 2026-08-14
  Supports: shared liquidity, dynamic ceilings, oracle providers
• Jupiter documentation — protocol details · primary · accessed 2026-08-14
  Supports: tick liquidations, withdrawal limits, Smart Vaults
• Jupiter documentation — security and audits · primary · accessed 2026-08-14
  Supports: audit count, auditors, audit dates
• Code4rena — Jupiter Lend findings and analysis report · secondary · accessed 2026-08-14
  Supports: liquidation DoS, reserve-deficit findings, remediation uncertainty
• Certora — Jupiter Lend formal-verification report · secondary · accessed 2026-08-14
  Supports: formal verification, verified scope, known limitations
• DefiLlama — Jupiter Lend protocol data · secondary · accessed 2026-08-14
  Supports: current TVL, borrowed value, historical peak

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.