Security
Nothing here has been audited by a third party. These are the checks the program makes and the tests it passes.
A holder cannot be liquidated
A holder owns plain SPL tokens in their own token account. The program keeps no record of holders and no instruction takes tokens from a wallet without that wallet's signature. liquidate only reads and changes a vault.
The 150% line
healthy(collateral, debt_value) is collateral × 10,000 ≥ debt_value × 15,000. mint_power and withdraw must end healthy. liquidate only works on a vault that is not healthy.
SOL's worst moves
A short's ratio falls in proportion to 1/SOL, so only fast rises hurt it. We replayed 
Binance SOLUSDT one-minute bars from 2020-08-11 to 2026-10-24 (3,260,812 bars) and kept the fastest rise from a close to a later high inside each window:
| Window | Worst rise | When |
|---|---|---|
| 1 min | +24.5% | 2021-05-19 12:50 |
| 5 min | +27.5% | 2022-12-29 22:33 |
| 15 min | +27.8% | 2022-12-29 22:28 |
| 60 min | +45.7% | 2021-05-19 12:55 |
A vault at 150% leaves bad debt only if SOL rises +36.4% before a liquidator acts (the point where its SOL no longer covers the debt plus 10%), and is itself under 100% after +50%. The worst 15 minutes in six years is +27.8%. The worst hour, +45.7%, is the reason liquidation is open to anyone at any time.
Oracle checks
| Check | Error |
|---|---|
owner is the  Pyth receiver and the layout is PriceUpdateV2 | WrongOracle, BadPrice |
| verification level is Full | PartialVerification |
| feed id is SOL/USD | WrongFeed |
| published at most 120 s ago | StalePrice |
| confidence at most 2% of the price | PriceTooUncertain |
Funding limits
One update counts at most one day (MAX_FUNDING_DT), and the mark/index ratio is clamped to 0.8 to 1.25, so one stale or pushed reading cannot move NF by more than ln(1.25) / period per day of time.
Who controls what
- Only the upgrade authority can call
init_market, once. - There is no admin instruction after that: no pause, no parameter change, no fee switch.
- The program is upgradeable until the authority decides otherwise. That is a trust assumption you should know about.
Tests
The local suite runs 34 checks on its own validator, including: init refused for a stranger and for out-of-range parameters; stale, wrong-feed, partially verified, random and wide-confidence prices refused; mint to 143% refused and to 200% accepted; withdraw to 133% refused; a stranger cannot touch a vault; a healthy vault cannot be liquidated; exact swap outputs and the slippage guard; funding moved NF from 1.000000 to 0.947346 while the pool traded 21% rich; at SOL $160 a 132% vault is liquidated, more than half refused, the liquidator paid exactly the repaid value plus 10%; the holder's tokens untouched by the pump and the crash.
Known gaps
- Funding uses
f64powf(deterministic soft float on SBF). A fixed-point version is cleaner. - The index uses the Pyth spot price at each update;
Opyn's Squeeth also averages the index. - One vault per owner, classic SPL Token.