Jito (jitoSOL)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED ON UNVERIFIED OPERATIONAL AUTHORITY, NOT DESIGN. Direct on-chain queries closed the strongest concern favorably: JitoSOL’s validator-selection (`staker`) authority is the on-chain, algorithmic Jito Steward program, not a human multisig. What remains open after repeated attempts — public docs, a headless-browser retry, and direct on-chain decoding — is whether the pool’s `manager` authority (a likely Squads vault, unconfirmed) has a published signer set and threshold, and whether the deployed program’s on-chain hash maps to an audited commit. Those are standing, verifiable facts a large, widely-held protocol should be able to produce; their continued unavailability is itself the disqualifying fact, not a reason to wait indefinitely. JitoSOL is an SPL Stake Pool claim on SOL delegated by the on-chain StakeNet Steward, earning consensus rewards plus MEV tips. The prior thesis is stale in two important ways. Solana now has an approved-with-limits chain verdict, so it is not a dispositive blocker. And current StakeNet targets equal allocations across the top 400 eligible validators while excluding validators in the network superminority; Marinade mSOL now delegates through a yield-ranked auction to only dozens of validators. The old decentralization comparison has inverted. The unsupported claim that Jito-Solana software share was equivalent to consensus-client share is also removed. The 400-validator figure is an allocation target, not a measured portfolio fact, and cannot support approval. JitoSOL remains under review at zero allocation for live authority verification, realized delegation and hosting concentration, liquidity at client size, and audit coverage of StakeNet changes—not because it is demonstrably more concentrated than mSOL.

Kill criteria: the events that revoke this verdict
• No allocation until a reproducible on-chain snapshot proves at least 300 realized delegated validators, no validator above 1% of JitoSOL active stake, and acceptable hosting concentration for one complete ten-epoch cycle
• Any selected validator enters Solana’s top-33.3% superminority without automatic removal
• A proposed-size DEX exit exceeds 50 basis points while delayed unstake is unavailable or exceeds one epoch
• Any JitoSOL principal loss, unaccounted exchange-rate decline, or unreconciled MEV distribution shortfall
• Management, withdrawal, MEV, or priority-fee terms changed without an executed governance record
• Current SPL Stake Pool, Steward, Validator History, or Interceptor deployment not mapped to a published audit
• Admin or parameter authority changed without a public governance and authority update

The research file

Mechanism and source of return

A depositor supplies SOL or an eligible stake account to the Jito stake pool and receives non-rebasing JitoSOL. The token’s SOL exchange rate rises as the underlying stake earns Solana inflation and transaction rewards plus Jito MEV tips. Jito’s current FAQ states a management fee equal to 4% of total staking and MEV rewards after validator commissions, and a 0.1% fee on direct withdrawal. MEV is real network revenue but variable and depends on Jito’s auction and tip-distribution infrastructure; it is not a fixed premium.

JitoSOL itself uses the canonical SPL Stake Pool program, not Jito’s restaking vaults. Holding JitoSOL does not by itself opt the client into node-consensus networks, restaking slashing or a leveraged DeFi integration. Those are separate transactions and must not be blended into this memo.

Delegation and concentration

StakeNet’s Steward scores validators in a ten-epoch cycle using commission, MEV commission, historical commission behavior, delinquency, priority-fee commission, software and data-integrity conditions. Validators in the top 33.3% network superminority fail an eligibility check. The top 400 eligible validators are selected and each receives an equal 1/400 target; if fewer are eligible, all eligible validators are used. New validators can enter the pool permissionlessly after five voting epochs and 5,000 SOL of stake.

These are target weights, not proof of current realized weights. Rebalancing is rate-limited by unstake caps and Solana’s epoch delay, so actual delegation can lag. Still, the published objective is materially broader than the current mSOL auction outcome described elsewhere in this registry. The former thesis’s claim that Marinade spreads over 400 while Jito curates a narrow set is no longer a defensible current comparison.

Control and governance

Core Steward execution is permissionless, but control is not absent. StakeNet defines a blacklist authority, parameters authority and admin. They can change eligibility and scoring parameters, blacklist validators, pause the state machine, update authorities and execute SPL Stake Pool passthrough instructions that require the staker signer. Jito DAO holds the stake-pool manager role and can affect fees and validator operations within the SPL program’s bounds.

Jito documentation says all parameters can be changed through DAO governance. A 2025 legal report describes a separate 4-of-6 security council with no Jito Foundation or Labs members, but this pass did not independently establish which current JitoSOL or StakeNet authorities that council controls. Approval requires reading the live authority accounts and governance execution path, not relying on constitutional description.

Security and incident record

The canonical SPL Stake Pool program has published Quantstamp, Neodyme and Kudelski reviews and an upgrade key held by a Solana staking-ecosystem committee. Jito publishes StakeNet source, verifiable-build commands and audits dated 2024-01-12 for Validator History and 2024-07-29 for Steward. That is a solid base, but the Steward documentation was updated in 2026 and the review must map the current program hash and newer scoring fields to audit scope.

No JitoSOL principal-loss exploit or published slashing loss was identified in this pass. Jito maintains a DAO-funded bounty administered by Asymmetric Research; JIP-5 initially funded it with 1 million JTO through a 3-of-5 multisig. Absence of loss is meaningful operating evidence but not proof against authority, calculator, MEV-distribution, liquidity or Solana runtime failure.

Exit and liquidity

The reliable exit is delayed unstake through the stake pool: Jito documents a wait of up to one Solana epoch, approximately two to three days, a 0.1% direct-withdrawal fee and no market slippage at the on-chain exchange rate. The fast exit is a Jupiter or other DEX sale, where time is immediate but depth and slippage are market-dependent. The delayed path is the solvency backstop; the DEX path is the liquidity convenience.

The registry’s $50 million floor has not been reproduced at client trade size in this pass. Before approval, record best-route quotes at the intended size, pool reserve SOL, delayed-unstake capacity and any Interceptor effect. The Interceptor’s ten-hour hold applies to stake-account deposits designed to prevent toxic liquidity extraction; it is not the normal SOL deposit or JitoSOL withdrawal path, but it is part of the broader operational perimeter.

Comparison, decision, and open questions

Against current mSOL, JitoSOL has the stronger published delegation target: 400 equal targets and a superminority exclusion versus Marinade’s yield-ranked auction and much smaller realized set. Against INF, JitoSOL avoids a changing basket of external LST programs but forgoes pool swap-fee diversification. Against native stake, it adds smart-contract, governance and secondary-liquidity risk in exchange for fungibility and automated validator rotation.

Reject, with a credible reopen path. Update, 2026-08-16: three items now have current figures. Solana Compass’s live pool stats show 292 active validators, average stake 33,978 SOL, with 76 of 292 (about 26%) sitting in datacenters Solana Compass flags as overpopulated — moderate, not resolved, hosting concentration, not the ”unknown” this entry previously carried. Realized net yield is currently about 5.1-5.32% APY after Jito’s roughly 4% fee on rewards plus a 0.1% withdrawal fee, toward the low end of JitoSOL’s historical 6-8.5% MEV-boosted range — a live, moving figure, not a static one. The Immunefi bug bounty is confirmed active: $250K maximum, live since 2024-08-28, last updated 2026-08-12, four days before this review — not lapsed. Still unresolved: current program upgrade authority and signer thresholds (Jito’s own deployed-programs and technical-FAQ pages returned 403 to automated fetch, and a Cloudflare bot-check blocked a direct headless-browser retry too — a research-access gap, not evidence of a problem) and whether the deployed program hash maps to an audited commit. Update, 2026-08-16: decoded the pool’s on-chain state directly instead. The JitoSOL stake-pool account (Jito4APyf642JPZPx3hGc6WWJ8zPKtRbRs4P815Awbb) sits on the shared SPL Stake Pool program, so that program’s own upgrade authority isn’t the decision-relevant one; the pool’s own governance fields are. Its `staker` authority is held by the Jito Steward program (Stewardf95sJbmtcZsyagb2dg4Mo8eVQho8gpECvLx8) — an autonomous, on-chain, algorithmic validator-scoring and delegation system, not a human multisig, which is a concrete, positive fact this entry previously lacked. Its `manager` authority is a System-Program-owned address holding ~12,066 SOL with zero account data, consistent with a Squads multisig vault (matching a prior secondary source) but not confirmed: the actual Squads config account, its signers, and its threshold were not traced this pass. Open items remaining: the manager multisig’s signers and threshold; whether the deployed program hash maps to an audited commit; reserve SOL and proposed-size DEX depth; and MEV/priority-fee distribution dependencies. Reopen when those are snapshotted on-chain and the direct and delayed exits pass.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• JitoSOL general FAQ, fees, withdrawal and validator selection · primary · accessed 2026-08-15
  Supports: reward and MEV mechanism, management fee, withdrawal fee, validator-selection description
• JitoSOL technical FAQ, direct and secondary exits · primary · accessed 2026-08-15
  Supports: delayed unstake, epoch timing, secondary-market exit
• Jito StakeNet Steward program, scoring, equal targets and admin abilities · primary · accessed 2026-08-15
  Supports: 400-validator target, superminority exclusion, scoring cycle, admin authorities
• JitoSOL automated management through StakeNet · primary · accessed 2026-08-15
  Supports: StakeNet management path, target allocation, rebalancing mechanism
• JitoSOL deployed programs and SPL Stake Pool audits · primary · accessed 2026-08-15
  Supports: program IDs, SPL Stake Pool audits, deployment boundary
• Jito StakeNet repository, deployed accounts, verifiable builds and audits · primary · accessed 2026-08-15
  Supports: StakeNet source, verifiable builds, Validator History and Steward audits
• JitoSOL security overview and DAO manager role · primary · accessed 2026-08-15
  Supports: DAO manager role, security model, SPL Stake Pool dependency
• Jito Interceptor mechanism and audit links · primary · accessed 2026-08-15
  Supports: stake-account deposit hold, Interceptor scope, audit references
• JIP-5, Jito bug-bounty funding and control · primary · accessed 2026-08-15
  Supports: bounty funding, multisig control, initial program term

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.