# Protocol by protocol (/invest/incidents/by-protocol)

A **leg** is one investment position of the vault, and its **adapter** is the small program that connects the vault to that leg's protocol. The vault's own rules are the same for every leg. What differs is how each adapter reads its protocol, and therefore which failures it can see. This page collects, for each adapter, what automated tests on copies of the real protocols' mainnet programs and accounts found. The tests use a 3,000 USDC leg; measured figures are rounded.

Every adapter on this page is deployed on mainnet except OnRe, which is not deployed yet. Token legs that hold ONyc use the deployed token adapter, not the OnRe adapter. [Networks and availability](/invest/availability#adapter-programs-on-mainnet) lists the addresses.

## At a glance [#at-a-glance]

| Adapter | Leg holds | Valued at | Low value below book | Valuation calls the protocol's program | Queued exits |
| --- | --- | --- | --- | --- | --- |
| Kamino | kUSDC receipts | The reserve's exchange rate | 0 | Yes | No |
| Jupiter Lend | jlUSDC fTokens | Earn's token exchange price | 0 | Yes | No |
| Huma | PST | The pool mode's assets per PST | 0.5% by default, more with a higher fee cap | No | Yes |
| Hastra | PRIME (staked wYLDS) | Hastra's posted stake price | 1% | No | Yes |
| Solstice | eUSX | Solstice's vault rate, USX at par | 1% | No | Yes |
| Maple | syrupUSDC | Maple's Chainlink syrupUSDC/USDC rate | 2% | No (reads the feed) | No |
| OnRe | ONyc | OnRe's `get_nav` | 2% | Yes | No |
| Token legs | USDG, syrupUSDC or ONyc | Par, Maple's Chainlink rate, or OnRe's `get_nav` | Market price under stress | Only the ONyc leg | No |

*Table: how each adapter values its leg and exits; "par" means 1 token = 1 USDC.*

The **book value** is what the protocol's own accounting says the leg is worth. The **low value** is a cautious value, roughly what the leg would fetch if it had to be sold now. The column "Low value below book" is the gap between them, a haircut: a 2% haircut on a 3,000 USDC leg gives a low value of 3,000 × 0.98 = 2,940. Withdrawals are priced at the low value, and the gap is taken from Junior first (see [Wrong or manipulated data](/invest/incidents/wrong-data#defence-3-value-bands)). Queued exits are exits the protocol pays later; see [Exits in flight](/invest/incidents/exits-in-flight).

## Kamino [#kamino]

- **Exits** go back through Kamino.
- **Outage:** valuation needs Kamino's program, so the leg goes stale and the vault stops until the guardian suspends it (sets it aside with its last value). Kamino's emergency mode makes the adapter fail with an error rather than a flag.
- **Unnoticed theft** of all the reserve's cash costs the leg about 292 of its 3,000 USDC, roughly 10%, because borrowers still owe the rest. Kamino refuses new deposits into a robbed reserve, and an exit fails with `InsufficientLiquidity`, which is the alarm.
- **Not applicable:** oracles, exit routes and issuers. A lending reserve has none.

## Jupiter Lend [#jupiter-lend]

- **Exits** go back through Jupiter Earn.
- **Outage:** like Kamino, the vault stops until the leg is suspended.
- **Unnoticed theft** costs about 304 of 3,000 USDC, roughly 10%. Unlike Kamino, Jupiter accepts new money: 500 USDC put in is worth about 449. An exit fails with `InsufficientBalance`, which is the alarm.
- **Dependency:** Huma keeps its idle cash in Jupiter Lend (see [Several legs at once](/invest/incidents/several-legs#example-3-one-failure-spreads-to-another-protocol)).

## Huma [#huma]

- **Exits** are instant through Huma, or queued through Huma's exit queue.
- **Instant exit fee:** Huma charges a fee for instant withdrawals that rises as its pool's cash share falls. On the copy of Huma's accounts used in the tests, the cash share was about 9.7%, and at that level Huma's fee was 1%. The adapter refuses any instant exit whose fee is above the leg's cap, which is 0.25% unless the curator raises it. A curator can raise the cap for a leg up to 1% by creating a fee-limit account with the adapter's `init_instant_fee_policy` instruction and binding it to the leg. When the fee is above the cap, exits use the queue instead.
- **Low value:** the adapter puts the low value below book by the fee cap plus a 0.25% margin, and at least 0.5%. With the default cap that is 0.25% + 0.25% = 0.5%; with a 1% cap it is 1% + 0.25% = 1.25%.
- **Outage:** the leg is still valued from Huma's accounts, so the vault keeps running. Only money going into or out of Huma fails, and Akashi's off-chain monitor warns the guardian.
- **Unnoticed theft** of the pool's cash costs the leg about 11 of its 3,000 USDC, because the pool's cash is a small part of its assets.
- **Exit in flight:** Huma's claim is PST in escrow, so a loss in Huma reduces it. A short payment is booked as a loss (see [Exits in flight](/invest/incidents/exits-in-flight)).

## Hastra [#hastra]

- **Exits** sell PRIME for PYUSD, then PYUSD for USDC, or go through Hastra's operator queue.
- **Outage:** the leg is still valued, and exits that sell the token keep working.
- **Unnoticed theft** of Hastra's vault cash costs the leg almost nothing (about 0.04 of 3,000 USDC). An exit that sells the token succeeds, so the theft stays hidden from the vault.
- **Depeg:** the adapter treats PYUSD as on its peg between 0.98 and 1.02 dollars. Outside that range it raises `PRICE_UNCERTAIN` and exits stop. Inside it, a leg slippage limit of 0.5% (the most an exit may lose) refuses exits once PYUSD falls to about 0.995 (see [Depegs](/invest/incidents/depegs)).
- **Stale price:** Hastra's administrators post the stake price every few hours. When it goes stale, the adapter raises `PRICE_UNCERTAIN`.
- **Issuer:** PRIME has a freeze authority. A frozen account raises `PROTOCOL_PAUSED`.
- **Exit in flight:** the claim is a wYLDS redemption paid at one USDC per wYLDS or not at all, so it cannot be paid short.

## Solstice [#solstice]

- **Exits** sell eUSX for USX, then USX for USDC, or go through Solstice's cooldown.
- **Outage:** the leg is still valued, and exits that sell the token keep working. A freeze by Solstice's controller raises `PROTOCOL_PAUSED`.
- **Unnoticed theft** of USX from Solstice's asset vault costs everything (3,000 of 3,000 USDC). New money is lost too: 500 USDC put in afterwards is worth about 0.36. An exit that sells the token succeeds, so the theft stays hidden. This is the worst case found in the tests, and the main reason for Akashi's off-chain balance monitor.
- **Depeg:** a USX price outside 0.98 to 1.02 dollars, the range in which USX is treated as on its peg, raises `PRICE_UNCERTAIN`.
- **Exit in flight:** the claim is USX in escrow. If USX trades at 0.70 USDC when the exit sells it, far below the adapter's 1% per-swap loss limit, the sale is refused and the claim stays open.

## Maple [#maple]

- **Exits** sell syrupUSDC.
- **Value** comes from Maple's Chainlink feed, not from the pool. If the pool's price moves away from the feed, or the pool runs short of USDC, the adapter raises `MARKET_STRESS`: the low value drops to the market price, and trades stop.
- **Stale or absurd feed:** the adapter fails with an error, and the leg goes stale.

## OnRe [#onre]

The OnRe adapter is not deployed on mainnet yet. The results below come from tests on a copy of OnRe's real mainnet programs and accounts.

- **Entry** goes through OnRe's permissionless USDC offer. **Exits** sell ONyc to OnRe's Prop AMM for USDG, then USDG for USDC, with a 2% leg slippage limit (the most an exit may lose) in the tests.
- **Outage:** valuation needs OnRe's `get_nav`, so the vault stops until the leg is suspended.
- **Theft:** OnRe sets its net asset value (NAV) itself, so a theft shows only as a lower NAV, which the vault books as an honest loss.
- **Depeg:** a USDG price outside 0.98 to 1.02 dollars, the range in which USDG is treated as on its peg, raises `PRICE_UNCERTAIN`.

## Token legs [#token-legs]

- **What:** the leg holds a token directly, valued by the token adapter. Money moves in and out only through a trade bracket: `begin_trade`, a swap signed by the bracket's delegate, then `end_trade`.
- **Guards:** each token leg checks a market price against a reference, within a band in basis points (bps; one basis point is 0.01%). USDG checks Pyth's USDG/USD price and the USDG/USDC pool against 1 dollar, with a 50 bps (0.5%) band. syrupUSDC checks the syrupUSDC/USDC pool against Maple's rate, with a 100 bps (1%) band. ONyc compares OnRe's NAV with its market price.
- A guard reading outside its band is `MARKET_STRESS`. A stale or unverified reading is `PRICE_UNCERTAIN`.
- **Issuer:** USDG has a freeze authority, a permanent delegate and a transfer fee extension (see [The token issuer acts](/invest/incidents/issuer-actions)).

## Advanced details [#advanced-details]

- For every kind of failure, the tests record whether it is simulated on the protocol's real accounts, run for real, or not applicable to that adapter. A check fails if a failure an adapter can suffer has no test.