Highbalances can be frozen by unrecognized controller AVzP…QK49 owned by program PERP…qQJu; new supply can be minted by unrecognized controller AVzP…QK49 owned by program PERP…qQJu
Highnew supply can be minted by unrecognized controller BCD7…YMV7 owned by program 1111…1111
Activity
Volume unavailable: no volume metric for this category; fees only.
FeesDaily fees in US dollars, from DefiLlama.Show as table
Fees
Date
Fees
2026-09-24
$392.02K
2026-09-25
$388.47K
2026-09-26
$124.16K
2026-09-27
$304.24K
2026-09-28
$250.25K
2026-09-29
$188.53K
2026-09-30
$299.57K
2026-10-01
$149.58K
2026-10-02
$484.06K
2026-10-03
$73.94K
2026-10-04
$139.46K
2026-10-05
$147.14K
2026-10-06
$123.53K
2026-10-07
$291.9K
2026-10-08
$611.6K
2026-10-09
$211.75K
2026-10-10
$113.22K
2026-10-11
$155.74K
2026-10-12
$443.48K
2026-10-13
$252.25K
2026-10-14
$271.1K
2026-10-15
$356.56K
2026-10-16
$120.46K
2026-10-17
$102.46K
2026-10-18
$159.78K
2026-10-19
$102.37K
2026-10-20
$166.09K
2026-10-21
$138.62K
2026-10-22
$155.91K
2026-10-23
$123.95K
Risk summary
MediumCore program code can be replaced by 4 of 8 votersA multisig member with the Vote permission. Celebtir counts signers, not all members, when it compares a threshold. of multisigAn account that acts only when enough of its members approve. On Solana this is usually a Squads multisig.AxkJ…UUSm.
MediumAn approved upgrade takes effect after 24 h. Withdrawal completion within that period is not established by these configuration facts.
MediumProtocol parameters can be changed by 4 of 7 voters of multisig 7ZyD…k8Sf using admin.
MediumThe deployed code of PERP…qQJu has not been verified against its public source.
MediumPrices can be manipulated if its only oracleAn account that publishes prices a protocol reads, for example to value collateral or trigger liquidations. network (pyth) reports a false price for BTC custody.
MediumPrices can be manipulated if its only oracle network (pyth) reports a false price for ETH custody.
MediumPrices can be manipulated if its only oracle network (pyth) reports a false price for SOL custody.
MediumPrices can be manipulated if its only oracle network (pyth) reports a false price for USDC custody.
MediumPrices can be manipulated if its only oracle network (pyth) reports a false price for USDT custody.
SquadsThe multisig program most Solana protocols use to hold upgrade and admin keys (version 4 is supported). v4 multisig, 4 of 8 voters, time lockA wait between approving a change and the change taking effect, which gives users time to leave. 24 h
To improve: a multisig of 5+ voters at a 60%+ thresholdHow many signers of a multisig must approve before it can act. → LOW, or make the program immutableNo key can change it: the upgrade authority was removed, or the program was deployed with a loader that cannot upgrade.
admin can change parameters, held by Squads v3 multisig, 4 of 7 voters, time lock 0 s
To improve: limit admin keysA key stored in a protocol's own accounts that can change parameters, pause the protocol or move funds, without upgrading its code. to parameters behind a 24 h+ time lock, or renounce them → LOW
BTC custody: single oracle network (pyth), no fallback; ETH custody: single oracle network (pyth), no fallback; SOL custody: single oracle network (pyth), no fallback; USDC custody: single oracle network (pyth), no fallback; USDT custody: single oracle network (pyth), no fallback
To improve: add an established fallback feed for every market → LOW
StagesA protocol's headline level, from Stage 0 (the team can change everything quickly) to Stage 2 (users are protected even from the team). Stages describe control, not code security. describe who can change the protocol and how fast. They don't measure code security.
Stage 0 (current)
Stage 1
Stage 2
Stage 0 3 of 3 met
✓Met: core programs identified in the registrySatisfied criterion and evidence
✓Met: no multisig has a single-key config authorityA key that can change a Squads multisig's members, threshold and time lock without a vote. If it is set, it, not the multisig, is the real controller.Satisfied criterion and evidence
✗Missing:verified buildsProof that the deployed program was built from a public commit, checked by OtterSec's verification service. for all core programsUnmet criterion
Click a box for its facts and evidenceThe on-chain account, field and slot a fact was read from, with a link to check it on Solscan.. Arrows point from who holds a power to what it controls. Controllers shared across protocols