Protocol by protocol

A leg is one investment position of the vault, and its adapter is the small program that connects the vault to that leg's protocol. The vault's own rules are the same for every leg. What differs is how each adapter reads its protocol, and therefore which failures it can see. This page collects, for each adapter, what automated tests on copies of the real protocols' mainnet programs and accounts found. The tests use a 3,000 USDC leg; measured figures are rounded.

Every adapter on this page is deployed on mainnet except OnRe, which is not deployed yet. Token legs that hold ONyc use the deployed token adapter, not the OnRe adapter. Networks and availability lists the addresses.

At a glanceCopy Anchor Link

Table: how each adapter values its leg and exits; "par" means 1 token = 1 USDC.

The book value is what the protocol's own accounting says the leg is worth. The low value is a cautious value, roughly what the leg would fetch if it had to be sold now. The column "Low value below book" is the gap between them, a haircut: a 2% haircut on a 3,000 USDC leg gives a low value of 3,000 × 0.98 = 2,940. Withdrawals are priced at the low value, and the gap is taken from Junior first (see Wrong or manipulated data). Queued exits are exits the protocol pays later; see Exits in flight.

KaminoCopy Anchor Link

• Exits go back through Kamino.
• Outage: valuation needs Kamino's program, so the leg goes stale and the vault stops until the guardian suspends it (sets it aside with its last value). Kamino's emergency mode makes the adapter fail with an error rather than a flag.
• Unnoticed theft of all the reserve's cash costs the leg about 292 of its 3,000 USDC, roughly 10%, because borrowers still owe the rest. Kamino refuses new deposits into a robbed reserve, and an exit fails with InsufficientLiquidity, which is the alarm.
• Not applicable: oracles, exit routes and issuers. A lending reserve has none.

Jupiter LendCopy Anchor Link

• Exits go back through Jupiter Earn.
• Outage: like Kamino, the vault stops until the leg is suspended.
• Unnoticed theft costs about 304 of 3,000 USDC, roughly 10%. Unlike Kamino, Jupiter accepts new money: 500 USDC put in is worth about 449. An exit fails with InsufficientBalance, which is the alarm.
• Dependency: Huma keeps its idle cash in Jupiter Lend (see Several legs at once).

HumaCopy Anchor Link

• Exits are instant through Huma, or queued through Huma's exit queue.
• Instant exit fee: Huma charges a fee for instant withdrawals that rises as its pool's cash share falls. On the copy of Huma's accounts used in the tests, the cash share was about 9.7%, and at that level Huma's fee was 1%. The adapter refuses any instant exit whose fee is above the leg's cap, which is 0.25% unless the curator raises it. A curator can raise the cap for a leg up to 1% by creating a fee-limit account with the adapter's init_instant_fee_policy instruction and binding it to the leg. When the fee is above the cap, exits use the queue instead.
• Low value: the adapter puts the low value below book by the fee cap plus a 0.25% margin, and at least 0.5%. With the default cap that is 0.25% + 0.25% = 0.5%; with a 1% cap it is 1% + 0.25% = 1.25%.
• Outage: the leg is still valued from Huma's accounts, so the vault keeps running. Only money going into or out of Huma fails, and Akashi's off-chain monitor warns the guardian.
• Unnoticed theft of the pool's cash costs the leg about 11 of its 3,000 USDC, because the pool's cash is a small part of its assets.
• Exit in flight: Huma's claim is PST in escrow, so a loss in Huma reduces it. A short payment is booked as a loss (see Exits in flight).

HastraCopy Anchor Link

• Exits sell PRIME for PYUSD, then PYUSD for USDC, or go through Hastra's operator queue.
• Outage: the leg is still valued, and exits that sell the token keep working.
• Unnoticed theft of Hastra's vault cash costs the leg almost nothing (about 0.04 of 3,000 USDC). An exit that sells the token succeeds, so the theft stays hidden from the vault.
• Depeg: the adapter treats PYUSD as on its peg between 0.98 and 1.02 dollars. Outside that range it raises PRICE_UNCERTAIN and exits stop. Inside it, a leg slippage limit of 0.5% (the most an exit may lose) refuses exits once PYUSD falls to about 0.995 (see Depegs).
• Stale price: Hastra's administrators post the stake price every few hours. When it goes stale, the adapter raises PRICE_UNCERTAIN.
• Issuer: PRIME has a freeze authority. A frozen account raises PROTOCOL_PAUSED.
• Exit in flight: the claim is a wYLDS redemption paid at one USDC per wYLDS or not at all, so it cannot be paid short.

SolsticeCopy Anchor Link

• Exits sell eUSX for USX, then USX for USDC, or go through Solstice's cooldown.
• Outage: the leg is still valued, and exits that sell the token keep working. A freeze by Solstice's controller raises PROTOCOL_PAUSED.
• Unnoticed theft of USX from Solstice's asset vault costs everything (3,000 of 3,000 USDC). New money is lost too: 500 USDC put in afterwards is worth about 0.36. An exit that sells the token succeeds, so the theft stays hidden. This is the worst case found in the tests, and the main reason for Akashi's off-chain balance monitor.
• Depeg: a USX price outside 0.98 to 1.02 dollars, the range in which USX is treated as on its peg, raises PRICE_UNCERTAIN.
• Exit in flight: the claim is USX in escrow. If USX trades at 0.70 USDC when the exit sells it, far below the adapter's 1% per-swap loss limit, the sale is refused and the claim stays open.

MapleCopy Anchor Link

• Exits sell syrupUSDC.
• Value comes from Maple's Chainlink feed, not from the pool. If the pool's price moves away from the feed, or the pool runs short of USDC, the adapter raises MARKET_STRESS: the low value drops to the market price, and trades stop.
• Stale or absurd feed: the adapter fails with an error, and the leg goes stale.

OnReCopy Anchor Link

The OnRe adapter is not deployed on mainnet yet. The results below come from tests on a copy of OnRe's real mainnet programs and accounts.

• Entry goes through OnRe's permissionless USDC offer. Exits sell ONyc to OnRe's Prop AMM for USDG, then USDG for USDC, with a 2% leg slippage limit (the most an exit may lose) in the tests.
• Outage: valuation needs OnRe's get_nav, so the vault stops until the leg is suspended.
• Theft: OnRe sets its net asset value (NAV) itself, so a theft shows only as a lower NAV, which the vault books as an honest loss.
• Depeg: a USDG price outside 0.98 to 1.02 dollars, the range in which USDG is treated as on its peg, raises PRICE_UNCERTAIN.

Token legsCopy Anchor Link

• What: the leg holds a token directly, valued by the token adapter. Money moves in and out only through a trade bracket: begin_trade, a swap signed by the bracket's delegate, then end_trade.
• Guards: each token leg checks a market price against a reference, within a band in basis points (bps; one basis point is 0.01%). USDG checks Pyth's USDG/USD price and the USDG/USDC pool against 1 dollar, with a 50 bps (0.5%) band. syrupUSDC checks the syrupUSDC/USDC pool against Maple's rate, with a 100 bps (1%) band. ONyc compares OnRe's NAV with its market price.
• A guard reading outside its band is MARKET_STRESS. A stale or unverified reading is PRICE_UNCERTAIN.
• Issuer: USDG has a freeze authority, a permanent delegate and a transfer fee extension (see The token issuer acts).

Advanced detailsCopy Anchor Link

• For every kind of failure, the tests record whether it is simulated on the protocol's real accounts, run for real, or not applicable to that adapter. A check fails if a failure an adapter can suffer has no test.