Jupiter Perpetual Exchange

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED ON A CATEGORICAL US-PERSON EXCLUSION, DESPITE A SUBSTANTIVE TECHNICAL SECURITY RECORD. Jupiter Perpetual Exchange is an oracle-priced, LP-to-trader perpetuals venue whose JLP token represents the pool standing opposite leveraged traders while also holding SOL, ETH, BTC, USDC, USDT, and JupUSD inventory. Jupiter’s current Terms identify Block Raccoon S.A. as the interface provider and state that Jupiter does not interact with wallets located in, established in, or resident of the United States; VPN circumvention is also prohibited. That alone makes both direct perpetual trading and a JLP allocation ineligible for this registry’s US-advisor client base. The refusal is not a claim that the pool lacks engineering controls: Jupiter publishes three dedicated perpetual-program audits and unusually useful on-chain account documentation. It is a legal-access decision reinforced by the economic fact that JLP is not passive cash yield—it is a multi-asset market-making and liquidation-risk position whose withdrawals can be constrained by pool weight limits and whose action permissions can be changed by a protocol administrator.

Kill criteria: the events that revoke this verdict
• Jupiter publishes terms permitting this registry’s United States client population to use both Perpetuals and JLP
• Administrator identities and the authority controlling every custody permission flag are publicly mapped to a named multisig and threshold
• A proposed-size JLP removal succeeds during a documented period when at least one custody is at its 20% target-weight boundary
• Any confirmed exploit, oracle failure, or realized pool loss exceeding 5% of JLP AUM opens an immediate off-cycle review

The research file

Mechanism and return source

Jupiter Perpetual Exchange routes leveraged traders against one JLP pool rather than against a peer-to-peer order book. The pool holds six documented custody assets—SOL, ETH, BTC, USDC, USDT, and JupUSD—and its AUM is the marked value of those assets less the amount reserved to pay profitable traders. JLP holders therefore earn from trading, borrowing, swap, and liquidity fees while bearing the inverse of aggregate trader PnL and the directional inventory mix. Jupiter’s pool-account specification sets the protocol share at 2,500 basis points, or 25% of collected pool fees; the remaining realized fees are reinvested in the pool and used to calculate a weekly annualized APR. That is a derivatives-market-making exposure, not a stablecoin deposit or a contractual interest claim, and its return can reverse when traders profit or inventory falls.

The categorical eligibility bar

The current Jupiter Terms of Use say the open-source Protocol was deployed by Block Raccoon S.A. and describe the web product as a non-custodial interface. The operative locality clause is nevertheless categorical: Jupiter does not interact with wallets located in, established in, or resident of the United States, alongside China, Singapore, and sanctioned jurisdictions, and users may not use a VPN or similar technique to evade the restriction. The same document reserves discretionary KYC/AML checks and the ability to block interface or protocol access. A permissionless Solana program does not cure an advisor recommending that a US client violate the operator’s express terms, so no further favorable technical fact can produce an approval while that clause remains in force.

Control, oracle, and audit record

Jupiter’s custody-account documentation exposes the relevant control surface clearly. Each asset has oracle parameters, pricing configuration, target weight, position limits, and a permissions set whose global flags can be changed by the protocol administrator to enable or disable trading actions during upgrades or black-swan events. That is useful emergency control but also means JLP is not immutable. Jupiter publishes three program-specific assessments from Sec3, OtterSec, and Offside Labs. The Offside engagement covered the Solana program and keeper and initially reported one critical, one high, six medium, two low, and six informational findings. Those audits are a meaningful positive security investment; they remain point-in-time code reviews and do not resolve either administrator authority or client eligibility.

Incident record and economic stress

No Jupiter Perpetuals fund-loss exploit was identified in the protocol materials, published audit index, or DefiLlama record reviewed through this cutoff. The absence of a known exploit is not the same as an absence of realized loss risk: pool accounting explicitly subtracts amounts owed to profitable traders, and each custody tracks globally locked assets, long guaranteed USD, and global short PnL. A large directional trader win, oracle discontinuity, or correlated decline in the pool’s volatile inventory can reduce JLP value without any smart-contract bug. The administrator’s black-swan permission flags are themselves evidence that operation under stress may require discretionary halts rather than uninterrupted autonomous execution.

Exit and comparison

Liquidity can be added to or removed from the single JLP pool for a fee, but exit is not unconditional. The pool has a maximum AUM ceiling and a token-weight buffer, currently documented as plus or minus 20% around each target weight; a deposit or withdrawal is rejected if it would move an asset beyond the permitted range. That makes stressed redemption dependent on the inventory composition other LPs and traders leave behind. Compared with holding the underlying assets directly, JLP adds trader-counterparty PnL, oracle, keeper, administrator, and pool-composition risks. Compared with HLP, another derivatives LP reviewed in this batch, Jupiter provides better public account-level documentation and a broader audit index, but both are categorically unavailable to US clients. The investable alternative is therefore no derivatives-LP allocation, not a different prohibited venue.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Jupiter — Terms of Use · primary · accessed 2026-08-19
  Supports: Block Raccoon S.A. interface role, categorical United States locality exclusion, VPN prohibition, KYC and access-blocking discretion
• Jupiter Developers — Perpetuals pool account · primary · accessed 2026-08-19
  Supports: single JLP pool, AUM calculation, 20% token-weight buffer, 25% protocol fee share
• Jupiter Developers — Perpetuals custody account · primary · accessed 2026-08-19
  Supports: six custody assets, oracle parameters, administrator permissions, pool PnL accounting
• Jupiter Developers — audit index · primary · accessed 2026-08-19
  Supports: Sec3, OtterSec, and Offside perpetual-program audits
• Offside Labs — Jupiter Perpetuals smart-contract security assessment · primary · accessed 2026-08-19
  Supports: program and keeper scope, initial finding severities
• DefiLlama — Jupiter Perpetual Exchange protocol data · secondary · accessed 2026-08-19
  Supports: Solana chain perimeter, current TVL, LP-to-trader category description

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.