Security and trust
This page lists what the admin can and cannot do, the one way a position can be touched without its owner, and the real risks.
What the admin can do
- Add a collateral (up to 4) with a borrow limit, an unwind threshold and a debt ceiling.
- Change a collateral's borrow limit (never above 80%) and debt ceiling, and pause new borrowing for it.
- Raise a collateral's unwind threshold (never above 95%).
- Hand the admin seat to a new key in two steps.
What the admin cannot do
- Lower an unwind threshold. Existing positions cannot be made unwindable by a settings change (
UnwindLtvLowered). - Move anyone's LST, burn anyone's uSOL, or change a position's debt. No instruction gives the admin access to vaults or positions.
- Freeze uSOL. The mint has no freeze authority, no transfer hook and no permanent delegate.
- Point a collateral at a different rate source after it is added.
Pausing borrowing for a collateral never blocks repaying, withdrawing, syncing, redeeming or unwinding.
No price oracle
The program reads only stake pool exchange rates: total_lamports / pool_token_supply from an SPL stake pool, or msol_price from Marinade's state. It never reads a SOL dollar price, so a market crash, a bad oracle print or a thin DEX price cannot move any number the program checks.
Measured on a local chain with Jito's real pool account cloned in: a position at the 50% limit, then SOL down 50% and 90% against the dollar, then JitoSOL trading 10% under its pool rate on DEXs. In all three the position's loan to value stayed at 50.0%, and an attempt to unwind it failed with PositionHealthy. The same loan in dollars would have been at 100%, 500% and 55.6%.
The one forced path: unwind
A position can only be touched by someone else when its loan to value is above its collateral's unwind line (60% in the launch setup). With the debt and the collateral both in SOL, that only happens if the stake pool's own rate falls: a bug or an exploit in the pool, or slashing if Solana ever adds it.
Then anyone may burn uSOL against the position's debt and take the same SOL value of its LST, at the pool rate, back down to the borrow limit. It is a par exchange: no penalty, no liquidation bonus, no auction. The owner's SOL equity (value minus debt) is the same before and after.
Fresh rates
Borrowing, withdrawing while a debt is open, repaying with collateral, redeeming and unwinding all need the pool to have been updated for the current epoch (StaleRate). Nobody can borrow, take collateral out or price a redemption against a rate the pool has not confirmed. Withdrawing from a position with no debt needs no rate at all.
Rounding
Every rounding goes the protocol's way: values are rounded down, shares taken from a position are rounded up, and redemption payouts are rounded down. The buffer always holds at least the SOL value credited to debts.
Real risks
- The pool rate falls. A pool bug, an exploit, or slashing if Solana ever adds it, lowers the rate. Positions near the limit can then pass the unwind line and be unwound at par. Borrowing below the limit leaves room. Measured on a local chain whose JitoSOL pool booked a 60% loss:
| Loan to value before | After | What happened |
|---|---|---|
| 10% | 25.0% | nothing; the owner can still borrow |
| 22% | 55.0% | frozen: no new borrowing or withdrawal, not unwindable; back under 50% after 290 epochs (388 days) of yield |
| 25% | 62.5% | unwound at par: 29.99 uSOL burned for 29.99 SOL of its JitoSOL, back to 50%; the owner's SOL equity unchanged |
| 50% | 125.0% | underwater: an unwind took all 120.01 SOL of collateral at par, and 29.99 uSOL of debt was left with nothing behind it |
An unwind opens only after the pool loses more than 16.7% for a position at the 50% limit, and bad debt needs a loss over 50%. Nothing insures that last case: uSOL holders would carry it.
- uSOL trades below one SOL. uSOL is redeemable for one SOL of LST only as fast as the buffers fill. If many holders want out at once and the buffers are thin, uSOL can trade below one SOL on the open market until yield and repayments refill the buffers. A borrower who repays during that time pays less SOL than they borrowed.
- LST depeg on markets. JitoSOL or mSOL can trade below their pool rate on DEXs during stress. That changes nothing inside URUOI, but a redeemer who sells the LST they receive gets the market price.
- Smart contract risk. The program is new. Read the code before you deposit more than you can lose.
Upgrade authority
The program is deployed as upgradeable, and only its upgrade authority can run initialize. Who holds the upgrade authority after launch is published here with the program address.