Granite

Summary

Ketju does not approve Granite under the class rule for protocols on unapproved chains: Granite runs only on Stacks, and Ketju has not reviewed Stacks. Granite lends USDCx, the Circle xReserve dollar on Stacks, to borrowers who post sBTC as collateral. A liquidity provider deposits USDCx into the single market and earns the borrow rate, less a reserve share. Granite never lends out the collateral. On 2026-10-16 the DefiLlama yield feed showed one pool with about $3.83M of unlent USDCx. DefiLlama’s protocol page showed about $6.92M on Stacks. The StackingDAO memo records the same lack of a Stacks review. We made no finding against Granite itself.

Review triggers
• Stacks passes Ketju’s chain review, with no open review of the chain
• Granite launches a verifiable lending deployment on an approved chain and sustains it above the size limit for 30 days

Ketju checks this memo every night and opens a review if its venues or files show a warning or a cited document changes. The first confirmation is due 2027-01-16.

Research

How it works

A liquidity provider deposits USDCx into the state contract (SP3M2BYF7RGF8WKW5FVDNJ6WR8D7AR9BHDXAKPXZE.state-v1) and holds a share of the pool. Borrowers post sBTC and draw USDCx up to a loan-to-value limit that governance sets. They pay a variable rate from a linear kinked curve tied to utilisation. Interest accrues continuously, and Granite charges it on repayment. The provider receives the borrow rate minus the protocol reserve share. That amount is split between staked and unstaked providers according to the Safety Module rate.

Loans have no term. A position stays open while its loan-to-value holds. Once it does not, a liquidator repays part of the debt and takes collateral at a premium. Granite does not rehypothecate collateral, so sBTC stays in the contract until the loan is repaid or liquidated.

The position depends on three things outside Granite’s contracts: Stacks finality, the sBTC peg that the Stacks signer set maintains, and Circle’s xReserve attestation that backs USDCx one to one.

Size and holdings

The yield feed computes the pool from the contract’s own data. The pool size is the market’s unlent USDCx balance, about $3.83M; the feed reports total supplied and open interest alongside it. DefiLlama’s protocol page counts what the contracts hold on Stacks, about $6.92M, and its data has run since 2025-06-04.

Who controls it

A multisig with a 60% signer threshold governs Granite. The docs do not name the signers or give their number. Changes to collateral settings, rate parameters, caps, the reserve percentage, the allowed-contract list and the governance contract itself wait 24 hours in a timelock, so providers can withdraw first. Governance can pause a market, disable deposits, withdrawals, borrows or liquidations, and update the Pyth price feed with no timelock. A freeze-upgrades action can make the contracts permanently immutable. The docs do not say whether governance has used it. Guardian wallets can pause the protocol on their own, and only governance can unpause it.

Withdrawal caps limit how much USDCx or collateral can leave over a rolling window, and the caps refill over 24 hours. Borrower interest funds a protocol reserve, which stands behind the Safety Module as the second protection against bad debt. Pyth supplies prices through a pyth-adapter contract. Trust Machines incubated the project. We did not verify the signer set, the guardian list, the live caps or the Safety Module slashing terms.

Losses and incidents

The audit repository holds ten reports from June 2024 to June 2026. The auditors are Strata Labs, Halipot, ABA (twice), Clarity Alliance (four times) and Cybasecurity (twice, on security changes and liquidation changes). An Immunefi bounty pays up to $100,000. We found no exploit or loss.

Withdrawals

A provider withdraws from the pool’s unlent balance. Three things can block a withdrawal. First, lent USDCx is not available until borrowers repay. Second, the liquidity provider withdrawal cap refuses withdrawals once the rolling limit is reached, and it refills over 24 hours. Third, governance or a guardian can pause withdrawals with no timelock. Governance may use the reserve to add withdrawal liquidity in a thin market. Governance also holds an update-withdrawal-finalization-period action, so it can set a delay on withdrawals. To leave Stacks, a holder bridges USDCx back through Circle’s xReserve. A client allocation would be large against a $3.83M pool. The protocol cannot remove its dependence on the sBTC peg and the Stacks signer set.

Class rule

The class rule for protocols on unapproved chains covers protocols whose live yield venues settle only on a chain that has not passed Ketju’s chain review, or that Ketju has not approved. Stacks is a chain with no review. Ketju does not approve a protocol while its only reachable deployment depends on an unreviewed chain. Every liquidation, oracle update and withdrawal depends on that chain’s signers, finality and emergency controls, and audits of the contracts cannot remove that dependence. Granite’s rule against lending out collateral counts in its favour against other overcollateralised stablecoin lending. But an advisor cannot reach Granite without depending on Stacks and sBTC.

Ketju will review Granite again only if Ketju approves Stacks, or Granite launches a material deployment on an approved chain. Either event would start a full review and would not by itself approve Granite. The pool is also below the size limit for a full review.

Sources

Each claim above comes from one of these sources. Where Ketju could not verify a number, the memo states that.

• Granite docs, about Granite · primary · accessed 2026-10-16
  Supports: sBTC collateral, stablecoin loans, built on Stacks, no rehypothecation
• Granite docs, liquidity provisioning · primary · accessed 2026-10-16
  Supports: providers supply stablecoins, yield from borrower interest, variable rates
• Granite docs, interest rates · primary · accessed 2026-10-16
  Supports: utilisation curve, protocol reserve rate, staked and unstaked LP split
• Granite docs, no rehypothecation · primary · accessed 2026-10-16
  Supports: collateral not lent out, collateral available after repayment
• Granite docs, oracle implementation · primary · accessed 2026-10-16
  Supports: Pyth price feeds
• Granite docs, withdrawal caps · primary · accessed 2026-10-16
  Supports: LP withdrawal cap, rolling window, 24-hour refill, guardians notified
• Granite docs, protocol reserve · primary · accessed 2026-10-16
  Supports: second line against bad debt, withdrawal liquidity at discretion
• Granite docs, safety module · primary · accessed 2026-10-16
  Supports: staked LP tokens, first loss on bad debt
• Granite docs, governance · primary · accessed 2026-10-16
  Supports: multisig 60% threshold, 24-hour timelock, pause and flag actions not timelocked, freeze-upgrades, withdrawal finalization period
• Granite docs, guardians · primary · accessed 2026-10-16
  Supports: guardians can pause, governance unpauses
• Granite docs, audits and bug bounty · primary · accessed 2026-10-16
  Supports: seven listed audits, Immunefi up to $100,000
• Granite docs, contracts · primary · accessed 2026-10-16
  Supports: state-v1 address, pyth-adapter-v1, withdrawal-caps-v1, governance-v1
• Granite docs, USDCx · primary · accessed 2026-10-16
  Supports: Circle xReserve, one-to-one USDC backing, SIP-010 token
• Granite audit repository · primary · accessed 2026-10-16
  Supports: ten audit reports, June 2024 to June 2026, Cybasecurity liquidation audit
• DefiLlama, Granite protocol page · secondary · accessed 2026-10-16
  Supports: current TVL, chain, category, listing date, Trust Machines

The asset and the chain

This memo covers the protocol. A position also holds an asset and settles on a chain. Whichever of the three holds the most power over the position decides who can freeze it. These tables describe control and do not judge quality.