Sanctum Infinity

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

INF is not a single-validator or single-manager LST. It is the LP token of Sanctum Infinity, a managed pool of SOL and many Solana LSTs that earns the basket’s staking return plus swap fees. That genuinely solves fragmented exit liquidity, but it also converts a transparent choice of staking operator into exposure to a changing basket, Sanctum’s valuation adapters, and privileged administration. The protocol has operated since 2024, publishes its code and three audits, and handled the 2025-10-10 LST stress without a reported loss. The blocking issue is not whether the mechanism works; it is whether an adviser can underwrite and monitor every material constituent and the humans who can add, disable, reprice, rebalance, pause or upgrade it.

Kill criteria: the events that revoke this verdict
• No allocation until the live Infinity V2 program, every calculator and privileged authority are identified and mapped to published reviews
• Any constituent LST added without a published audit, authority review, and admission rationale
• Any one external LST issuer exceeding 20% of Infinity NAV
• A constituent impairment or calculator error causing INF redemption value to fall more than 1% below reported intrinsic SOL value
• Pool operations paused for more than one Solana epoch
• A proposed-size INF-to-SOL exit costing more than 50 basis points through both direct redemption and the best secondary route
• A live Infinity v2 program or calculator not mapped to a published audit

The research file

Mechanism and source of return

A user deposits SOL or an accepted LST and receives INF, a pro-rata claim on Infinity’s reserves. The controller values each LST in SOL through a constituent-specific on-chain calculator that reads the external staking program’s state. Users can swap one LST for another or burn INF to withdraw an available reserve asset. INF appreciates from the weighted staking return of the LST basket and from swap and withdrawal fees retained by the pool; it is therefore both a staking wrapper and an AMM LP position.

The legacy Infinity documentation says swap-fee revenue was split 90% to reserves and 10% to protocol fee vaults. Sanctum’s 2026-03-17 V2 launch announcement says that revenue model was scrapped and replaced with a 5% performance fee on INF yield, alongside slot-level reward distribution, multi-epoch yield smoothing, and a more concentrated, actively optimized LST portfolio. The current technical docs continue to state that removing liquidity incurs 20 basis points; V2 separately describes lower swap fees for partner LSTs and higher fees for non-partners. These are distinct charges and must not be collapsed into one “10% fee” description.

At epoch end, excess SOL above target is staked into selected top-performing LSTs, while under-target SOL is replenished by unstaking the worst-performing LSTs. That is an active allocation rule, and V2 makes manager selection more consequential by concentrating the basket. The public docs do not define “top” or “worst,” the target SOL formula, constituent caps, or the data window tightly enough to reproduce a future rebalance.

Constituents, valuation, and control

The controller stores an admin, rebalance authority, disable authorities, a pricing manager and fee beneficiary. The admin can whitelist or blacklist LSTs; pricing configuration determines input and output fees; the controller can pause all pool operations. The original public repository describes one admin and one rebalancing authority, not a permissionless index methodology. Development has since moved to the public inf-1.5 repository, confirming that the live system remains upgrade-oriented rather than frozen.

Intrinsic SOL valuation avoids dependence on a thin spot market, but it also treats an external LST program’s accounting value as realizable. A compromised stake-pool authority, validator slashing, stale external state, punitive withdrawal fee or faulty calculator can make face value differ from exit value. INF diversifies idiosyncratic operator risk only if weights are bounded; otherwise it can warehouse a troubled LST while providing departing users SOL.

Security and incident record

Sanctum publishes Infinity reviews by Neodyme, OtterSec and Sec3 and open-source controller code. Audits reduce implementation uncertainty; they do not attest to future constituents, live authority custody, external LST programs or each later upgrade. Sanctum says Infinity launched in March 2024 and held more than 2 million SOL during its 2024 Wonderland campaign. No exploit or principal loss attributable to Infinity was identified in the sources reviewed.

The best disclosed stress evidence is 2025-10-10. Sanctum reports that INF supplied substantial SOL liquidity during a BNSOL depeg and earned a 26.12% annualized epoch return from fees. This is issuer-reported evidence, not an independent post-mortem, and an annualized two-day return is not a durable yield estimate. It does show the intended countercyclical mechanism; it does not establish the loss that would occur if a constituent’s intrinsic value were itself impaired rather than merely illiquid.

Exit and liquidity waterfall

There are three economically different exits. A holder can redeem INF for an asset present in Infinity, paying the documented 20-basis-point withdrawal fee; swap INF or a received LST in secondary markets, accepting quote depth and slippage; or rely on Sanctum’s broader router and Reserve. The Reserve is last-resort SOL liquidity after the router and Infinity and charges a dynamic 8-to-800-basis-point fee as its SOL balance is consumed. Its docs say retail deposits are closed, so it is protocol-controlled backstop liquidity rather than client-owned capital.

“No lockup” is not the same as par liquidity. Available SOL can be exhausted, redemption can return an LST the client still must sell or unstake, the pool can be paused, and stress fees rise precisely when exit is most valuable. Approval requires executable aggregator and direct-redemption quotes at the proposed position size, plus a record of the SOL reserve share and largest constituents at the same block.

Comparison and decision frame

Against mSOL, JitoSOL or a carefully chosen single LST, INF offers broader routing liquidity and fee income but gives up control of validator program, constituent weights and future admissions. Against a conventional index, it does not yet publish a rules-based benchmark, reconstitution schedule and hard issuer caps sufficient for independent replication. Against a simple SOL-LST AMM, its intrinsic-value calculators reduce price slippage but create adapter and administration risk across many external programs.

Keep under review at zero allocation. The March 2026 V2 launch post is an issuer description, not proof of the live program, calculator set, authorities or audit coverage. Reopen only when a reproducible on-chain constituent report shows no unapproved LST, hard concentration limits are documented or imposed operationally, current authorities and upgrade controls are identified, and both direct and secondary proposed-size exits remain inside a written cost limit. Yield outperformance alone cannot compensate for an unbounded basket.

Open questions and observable triggers

This pass did not independently decode the current pool state, authority addresses, signer thresholds, program upgrade authority, SOL target, or full constituent weights. It also did not find a public admission policy specifying minimum audits, operator concentration, maximum withdrawal fee, slashing history, liquidity or per-issuer caps. The relationship between the March 2026 INF v2 upgrade and the three published legacy audits needs a scope map.

Observable reopen tests: publish a machine-readable weekly constituent and authority snapshot; cap any one external LST issuer at 20% of NAV; maintain at least 10% immediately withdrawable SOL or demonstrate a proposed-size exit below 50 basis points; map every live program hash to an audit; and document the exact admission/removal and rebalance rules. Any failed calculator, unannounced constituent addition, or pause beyond one Solana epoch should trigger immediate review.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Sanctum legacy Infinity architecture, fees, allocation and audits · primary · accessed 2026-08-15
  Supports: legacy Infinity mechanism, legacy fee routing, calculator model, legacy audits
• Sanctum legacy Infinity holder mechanism · primary · accessed 2026-08-15
  Supports: legacy deposit and withdrawal, intrinsic-value swaps, 20-basis-point removal fee
• Sanctum Reserve mechanism and dynamic fee · primary · accessed 2026-08-15
  Supports: reserve exit waterfall, dynamic fee, protocol-controlled liquidity
• Sanctum S legacy repository, authorities and verified program hashes · primary · accessed 2026-08-15
  Supports: legacy controller roles, pause and pricing authorities, legacy program hashes
• Sanctum inf-1.5 repository · primary · accessed 2026-08-15
  Supports: current code lineage, upgrade-oriented implementation, calculator source
• Sanctum Infinity launch, 2024-03-05 · primary · accessed 2026-08-15
  Supports: legacy launch, pool purpose, historical scale
• Sanctum Infinity 2025 performance review and October stress account · primary · accessed 2026-08-15
  Supports: issuer-reported October 2025 stress, BNSOL liquidity, epoch fee return
• Sanctum Infinity V2 launch commentary, 2026-03-17 · primary · accessed 2026-08-15
  Supports: V2 launch claim, 5% performance fee claim, concentrated active basket claim

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.