KETJU Research

← The Register

staking

Sanctum Infinity

Rejected
Max sleeve
—
Reviewed
2026-08-16 · v1
Next review
2026-11-16
Research basis
Individual research
Chains
Solana · crypto-backed
Symbols
INF

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED. This is not an evidence gap anymore; direct on-chain queries turned up an active concern. The Infinity controller’s upgrade authority is a single plain keypair, not a multisig — a prior draft’s ”11-member multisig” claim traced to the wrong Sanctum program. And the audited fee model (a 90/10 reserve/fee-vault split) no longer matches the live V2 fee model (a 5% performance fee) despite an unchanged program ID, which reads as an unaudited logic change deployed by that single key. INF is not a single-validator or single-manager LST. It is the LP token of Sanctum Infinity, a managed pool of SOL and many Solana LSTs that earns the basket’s staking return plus swap fees. That genuinely solves fragmented exit liquidity, but it also converts a transparent choice of staking operator into exposure to a changing basket, Sanctum’s valuation adapters, and privileged administration. The protocol has operated since 2024, publishes its code and three audits, and handled the 2025-10-10 LST stress without a reported loss. The blocking issue is not whether the mechanism works; it is whether an adviser can underwrite and monitor every material constituent and the humans who can add, disable, reprice, rebalance, pause or upgrade it.

The research file

Mechanism and source of return

A user deposits SOL or an accepted LST and receives INF, a pro-rata claim on Infinity’s reserves. The controller values each LST in SOL through a constituent-specific on-chain calculator that reads the external staking program’s state. Users can swap one LST for another or burn INF to withdraw an available reserve asset. INF appreciates from the weighted staking return of the LST basket and from swap and withdrawal fees retained by the pool; it is therefore both a staking wrapper and an AMM LP position.

The legacy Infinity documentation says swap-fee revenue was split 90% to reserves and 10% to protocol fee vaults. Sanctum’s 2026-03-17 V2 launch announcement says that revenue model was scrapped and replaced with a 5% performance fee on INF yield, alongside slot-level reward distribution, multi-epoch yield smoothing, and a more concentrated, actively optimized LST portfolio. The current technical docs continue to state that removing liquidity incurs 20 basis points; V2 separately describes lower swap fees for partner LSTs and higher fees for non-partners. These are distinct charges and must not be collapsed into one “10% fee” description.

At epoch end, excess SOL above target is staked into selected top-performing LSTs, while under-target SOL is replenished by unstaking the worst-performing LSTs. That is an active allocation rule, and V2 makes manager selection more consequential by concentrating the basket. The public docs do not define “top” or “worst,” the target SOL formula, constituent caps, or the data window tightly enough to reproduce a future rebalance.

Constituents, valuation, and control

The controller stores an admin, rebalance authority, disable authorities, a pricing manager and fee beneficiary. The admin can whitelist or blacklist LSTs; pricing configuration determines input and output fees; the controller can pause all pool operations. The original public repository describes one admin and one rebalancing authority, not a permissionless index methodology. Development has since moved to the public inf-1.5 repository, confirming that the live system remains upgrade-oriented rather than frozen.

Intrinsic SOL valuation avoids dependence on a thin spot market, but it also treats an external LST program’s accounting value as realizable. A compromised stake-pool authority, validator slashing, stale external state, punitive withdrawal fee or faulty calculator can make face value differ from exit value. INF diversifies idiosyncratic operator risk only if weights are bounded; otherwise it can warehouse a troubled LST while providing departing users SOL.

Security and incident record

Sanctum publishes Infinity reviews by Neodyme, OtterSec and Sec3 and open-source controller code. Audits reduce implementation uncertainty; they do not attest to future constituents, live authority custody, external LST programs or each later upgrade. Sanctum says Infinity launched in March 2024 and held more than 2 million SOL during its 2024 Wonderland campaign. No exploit or principal loss attributable to Infinity was identified in the sources reviewed.

The best disclosed stress evidence is 2025-10-10. Sanctum reports that INF supplied substantial SOL liquidity during a BNSOL depeg and earned a 26.12% annualized epoch return from fees. This is issuer-reported evidence, not an independent post-mortem, and an annualized two-day return is not a durable yield estimate. It does show the intended countercyclical mechanism; it does not establish the loss that would occur if a constituent’s intrinsic value were itself impaired rather than merely illiquid.

Exit and liquidity waterfall

There are three economically different exits. A holder can redeem INF for an asset present in Infinity, paying the documented 20-basis-point withdrawal fee; swap INF or a received LST in secondary markets, accepting quote depth and slippage; or rely on Sanctum’s broader router and Reserve. The Reserve is last-resort SOL liquidity after the router and Infinity and charges a dynamic 8-to-800-basis-point fee as its SOL balance is consumed. Its docs say retail deposits are closed, so it is protocol-controlled backstop liquidity rather than client-owned capital.

“No lockup” is not the same as par liquidity. Available SOL can be exhausted, redemption can return an LST the client still must sell or unstake, the pool can be paused, and stress fees rise precisely when exit is most valuable. Approval requires executable aggregator and direct-redemption quotes at the proposed position size, plus a record of the SOL reserve share and largest constituents at the same block.

Comparison and decision frame

Against mSOL, JitoSOL or a carefully chosen single LST, INF offers broader routing liquidity and fee income but gives up control of validator program, constituent weights and future admissions. Against a conventional index, it does not yet publish a rules-based benchmark, reconstitution schedule and hard issuer caps sufficient for independent replication. Against a simple SOL-LST AMM, its intrinsic-value calculators reduce price slippage but create adapter and administration risk across many external programs.

Reject, not a postponed judgment. The March 2026 V2 launch post is an issuer description, not proof of the live program, calculator set, authorities or audit coverage, and the on-chain single-key upgrade authority confirmed above is now an affirmative reason, not just an absence of proof. Reopen only when a reproducible on-chain constituent report shows no unapproved LST, hard concentration limits are documented or imposed operationally, current authorities and upgrade controls are identified, and both direct and secondary proposed-size exits remain inside a written cost limit. Yield outperformance alone cannot compensate for an unbounded basket.

Open questions and observable triggers

Correction, 2026-08-16: the prior update in this section, citing Solana Compass for an 11-member-multisig upgrade authority, described a different Sanctum program (their generic SPL stake-pool deployments), not the Infinity controller this entry actually depends on. Direct on-chain queries against the Infinity controller program (5ocnV1qiCgaQR8Jb8xWnVbApfaygJ8tNoZfgPwsgx9kx — confirmed to match Sanctum’s own technical docs, which were independently reachable this pass via a headless browser after the prior pass’s automated fetch was blocked) show its ProgramData account lists a single upgrade authority address (47SND7bGKvNXrqfP1bjsLCbwTgZhFBzAgmZ42QSkRScz), owned by the System Program with zero account data — a plain keypair, not an on-chain multisig program account (a Squads vault would be owned by the Squads program and carry parsed multisig data; this is not that). Whether that key is informally held by multiple parties off-chain cannot be determined on-chain. This is a materially weaker finding than the entry previously recorded, not a stronger one, and it stays a live gap. Separately, Sanctum’s own docs (independently confirmed) state the Infinity program page was ”last updated 8 months ago” and still describes a 90/10 reserve/fee-vault split — the pre-V2 model — while the March 2026 V2 announcement describes a 5% performance-fee replacement. Since the program ID is unchanged, this reads as the same audited program upgraded in place by that single-key authority, with no evidence the V2 fee-logic change itself was independently re-audited. That sharpens, rather than closes, the scope-map gap below.

This pass did not independently decode the current pool state, or full constituent weights. It also did not find a public admission policy specifying minimum audits, operator concentration, maximum withdrawal fee, slashing history, liquidity or per-issuer caps. The relationship between the March 2026 INF v2 upgrade and the three published legacy audits (Neodyme, OtterSec, Sec3 — confirmed still hosted at github.com/igneous-labs/sanctum-static as of 2026-08-16) still needs a scope map: it was not confirmed whether those reports cover the exact v2 deployment or an earlier version, and the fee-model finding above suggests they may not.

Observable reopen tests: publish a machine-readable weekly constituent and authority snapshot; cap any one external LST issuer at 20% of NAV; maintain at least 10% immediately withdrawable SOL or demonstrate a proposed-size exit below 50 basis points; map every live program hash to an audit; and document the exact admission/removal and rebalance rules. Any failed calculator, unannounced constituent addition, or pause beyond one Solana epoch should trigger immediate review.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.

ChainVerdictGradeControl constraint
SolanaApproved · limits crypto-backed no admin key can seize funds, but stake concentration and a sub-25 Nakamoto coefficient are the standing watch items.
AssetGradeWho can freeze it
INF sovereign Sanctum Infinity. A basket of Solana LSTs — you inherit the weakest constituent rather than choosing the strongest.
The memo is public. The watching is the product: the terminal reads your clients’ wallets against this Register and flags the events above when they fire. $49 per advisor per month, first 14 days free. Start the trial.