The memo
REJECTED, ahead of the scheduled review, because the review's own condition for rejection is now confirmed met. The prior draft said do not approve without proof the July 2026 Code4rena findings were fixed in deployed programs, and formally reject if remediation evidence is still absent at the next review; that evidence is now confirmed absent, not merely unchecked — no Code4rena mitigation review was ever commissioned, and no public program source exists to verify a fix independently. Waiting until 2026-11-30 to record what is already true serves no one. Jupiter Lend launched in August 2025 and scaled faster than its stress record: DefiLlama reported $925.7M TVL and $855.1M borrowed on 2026-08-14, after a $1.17B TVL peak in March. The architecture is Fluid on Solana: lenders receive transferable JL tokens, a shared liquidity layer funds Earn, Borrow, and Multiply within a market, and tick-based partial liquidation plus dynamic borrow and withdrawal ceilings manage flows. Separate top-level markets are isolated, but vaults inside the Jupiter Market reuse the same asset liquidity; “isolated vault” is not the same as segregated lender principal. Security work is substantial—seven listed firm audits, formal verification, and a 29-day Code4rena contest—but the final contest report found three medium issues, including a liquidation-engine denial of service during extreme ratios and two accounting paths that could over-credit suppliers and create reserve deficits. The public report does not record deployed remediation. Documentation also expanded the product in August 2026 to Smart Vaults whose collateral or debt doubles as Jupiter AMM liquidity, adding composition and DEX execution risk during this very review. Time remains a blocker, but it is no longer the only blocker. Reopen after deployed fixes are mapped to audited commits, live roles are disclosed for the Jupiter Market, and the fixed system completes at least twelve clean months including a material Solana volatility event.
What would reopen the file
- Any exploit or bad debt event
- Oracle design change without published migration
- TVL growth outpacing the audit and review cadence
Facts on file
- Verdict
- Rejected
- Exposure
- stable lending
- Chains examined
- Solana
- Instruments
- USDC, USDT, SOL
- Memo version
- v1
- Reviewed
- Next review