search
Ctrlk

Version History

Reading older entries: Sections before v0.10.0 are historical. Neutral in v0.8.x described a standalone unpark_capital instruction and a deploy_capital path that required unparking Marginfi first. Current program (v0.10.0+): deploy_capital can withdraw USDC from Marginfi in the same transaction when usdc_in_lending > 0; there is no unpark_capital instruction. Always cross-check behaviour against programs/keystone-neutral on your branch.

hashtag
v0.11.5 (Current) — April 23, 2026

Security hardening: withdrawal queue integrity, NAV double-count fix, CoreGate payout redirect guard.

claim_withdrawal — payout redirect prevention: Added user_usdc.owner == user.key() constraint. Without it, a malicious keeper could supply an arbitrary ATA and redirect the USDC payout since user is a SystemAccount (not a signer).

unwind_position — unconditional sufficiency check: The USDC sufficiency guard (usdc_after >= pending) was previously conditional on jup_count > 0 && sol_price_usdc > 0, allowing a caller to skip the jitoSOL swap, bypass the check, and leave the fund short for claim_withdrawal. Guard is now unconditional when pending > 0.

close_position / unwind_position — NAV double-count fix (H-1): Both instructions now zero total_funding_earned and last_cumulative_funding_rate after the position state reset. Realized PnL is already returned to fund_usdc; calculate_nav was adding total_funding_earned on top, double-counting it. Stale last_cumulative_funding_rate also caused the first settle_funding after re-deploy to produce an incorrect carry delta.

deploy_capital / park_capital — re-deploy blocked while withdrawals pending (H-2): Both permissionless instructions now require total_pending_withdrawals == 0. Previously a keeper could call deploy_capital immediately after unwind_position, re-locking USDC before claim_withdrawal could run and permanently trapping users' withdrawals. Error: NoPendingWithdrawals (6033).

Core withdraw — atomic Neutral queued-withdrawal detection: After the Neutral fund CPI, Core reloads its USDC ATA. If Neutral queued the withdrawal instead of paying immediately (capital deployed), no USDC arrives and the transaction reverts with NeutralPositionDeployed (Core 6018). CoreShares are never burned; the user retries after unwind_position + claim_withdrawal.

New Core error: NeutralPositionDeployed (6018).

Frontend (keystone-frontend): BASIS_SHARE_DECIMALS corrected from 6 to 9, fixing a 1000× AUM inflation and a 1000× error in withdrawal amount calculation for the Neutral vault.

close_fund — standardized across all three sub-fund programs: All three programs now expose an identical close_fund(fund_id) instruction. Changes from prior state:

  • Defense: close_fund added (was missing entirely).

  • Alpha: account admin renamed to authority; system_program account removed; error changed from InvalidFundParams to Unauthorized.

  • Neutral: unchanged — was already the reference implementation.

  • All three: raw byte validation reads stored authority at data[16..48] without Anchor deserialization, so the instruction works even on stale struct layouts that the current program can't deserialize.

share_mint — init_if_needed on Neutral and Defense: initialize_fund in Neutral and Defense changed share_mint from init to init_if_needed. The share_mint PDA is permanent — close_fund only closes fund_state, not the mint. Re-initialization after a close no longer fails with "account already in use".

New script — scripts/devnet/close-funds.ts: Unified script that closes Alpha/Neutral/Defense fund_state PDAs for any fund_ids in one run. FUND_IDS and PROGRAMS env vars control scope. Idempotent — skips fund_ids not found on-chain.

Devnet — full fresh deploy at zero balance: All 9 fund instances (Alpha 1/2/3, Neutral 1/2/3, Defense 1/2/3) reinitialized. All 3 Core portfolios initialized with register_fund_atas. All 9 CoreGates enabled. No deposits.

hashtag
v0.11.4 — April 2026

Drop Core deposit cap. Sub-fund caps set to 10M. Registry + gate fixes.

  • Core initialize_portfolio and update_params no longer accept a deposit_cap — the cap is enforced at the sub-fund level only.

  • All three sub-fund programs updated with deposit_cap = 10_000_000_000_000 (10M USDC, 6 dec).

  • CoreUserRegistry — fixed a race where re-depositing into the same portfolio after a full exit could collide with a partially-closed registry state.

  • set_core_gate — fixed authority derivation for the gate PDA when called across multiple portfolio IDs in the same transaction.

hashtag
v0.11.3 — April 21, 2026

Rebalance CoreGate fix. Full IDL rebuild from source. Devnet redeploy.

Rebalance was broken — all three CoreGate accounts were system_program: rebalance.rs passed system_program as alpha_core_gate, neutral_core_gate, and defense_core_gate, which fails Anchor's PDA seed validation. Added the three gate accounts to the Rebalance struct; scripts/mainnet/keeper-core.ts and deposit.ts updated to derive and pass them.

keystone_core.json IDL fixed: deposit, deposit_jupsol, deposit_with_swap, withdraw, withdraw_with_swap, and rebalance were missing alpha_core_gate, neutral_core_gate, defense_core_gate, and user_registry — causing a 4-account position mismatch. IDL synced with the on-chain struct.

Sub-fund IDLs rebuilt from target/idl/: set_core_gate, CoreGate account type, close_fund, and migrate_share_mint_authority are now present in all three sub-fund IDLs, matching the deployed programs. IDLs in idl/ and keystone-frontend/src/idl/ synced from target/idl/.

Core ATA addresses registered (new in this deploy): register_fund_atas now records the Core authority's ATA addresses on-chain. See updated devnet.md for all 12 ATA addresses (4 per portfolio × 3 portfolios).

hashtag
v0.11.2 — April 2026

Full devnet redeploy. 1:1 fund layout. CoreGate live on all 9 fund instances.

Fund layout change — 1:1 portfolio-to-fund mapping: Each risk profile now has its own dedicated fund instances across all three programs (fund_id == portfolio_id). Previously all Core portfolios shared the same three fund instances (Alpha=1, Neutral=2, Defense=3), which made CoreGate impossible to enforce per-portfolio. Now:

Portfolio
Alpha fund_id
Neutral fund_id
Defense fund_id

1 Conservative

1

1

1

2 Balanced

2

2

2

3 Growth

3

3

3

initialize_fund ATA accounts changed to init_if_needed: fund_usdc and fund_jitosol/fund_jupsol ATAs were previously init only. Changed to init_if_needed across all three programs so re-initialization is idempotent when ATAs already exist on-chain (e.g. after a program upgrade that doesn't touch the fund state).

set_core_gate added to IDLs manually: anchor build does not work on this repo due to toolchain constraints. The set_core_gate instruction (added in v0.11.0) was not in the generated IDLs. Added manually: instruction discriminator, accounts (with PDA seeds), args, and CoreGate account/type definitions to keystone_alpha.json, keystone_neutral.json, and keystone_defense.json.

New script — scripts/devnet/fresh-deploy.ts: Single idempotent script that handles the full devnet initialization sequence:

  1. Close existing Core portfolio states

  2. Initialize all 9 fund instances (3 per program)

  3. Initialize 3 Core portfolios and register fund ATAs

  4. Set all 9 CoreGates with the correct core_authority PDA per portfolio

scripts/devnet/set-core-gates.ts updated: Fixed to use core_authority PDA (not core_program_id), account name authority (not admin), and the new 1:1 fund_id layout across all 9 gates.

Build requirement clarified: anchor build does not work — use cargo-build-sbf directly with rustup's cargo on PATH. Alpha, Neutral, and Defense programs require -- --features devnet; Core does not.

hashtag
v0.11.1 — April 2026

Bug fixes: withdraw paths now correctly release the portfolio lock and pass proper gate accounts.

  • withdraw_with_swap lock not cleared on full exit. If you withdrew via the swap path and reached zero shares, your wallet stayed locked to the original risk profile forever. Fixed — the lock clears on full exit regardless of which withdraw instruction is used.

  • Both withdraw and withdraw_with_swap passed system_program as the CoreGate account in fund CPIs. Funds validate gate PDA seeds, so these CPIs would fail on-chain. All withdraw paths now pass the correct gate PDAs.

  • CoreGate now stores the exact allowed pubkey (core_authority) instead of re-deriving it from a hardcoded portfolio ID range (1–3). The set_core_gate parameter changed from core_program_id to core_authority — pass the pre-derived PDA: findProgramAddress(["core_authority", portfolio_id], CORE_PROGRAM_ID).

hashtag
v0.11.0 — April 2026

Access control hardening. Single-portfolio enforcement. Direct fund access blocked.

CoreGate — fund access control:

  • New CoreGate PDA (["core_gate", fund_state]) on each fund (Alpha, Neutral, Defense).

  • When enabled, only the authorized Core authority PDA may call deposit or withdraw on a fund. Direct user access is rejected with DirectDepositsDisabled.

  • Gate is off by default (zero lamports = unenforced). Enable after deployment via set_core_gate on each fund.

  • New admin instruction set_core_gate(fund_id, core_authority, enabled) on each fund program.

  • New script scripts/devnet/set-core-gates.ts — enables all three gates in one run.

CoreUserRegistry — single-portfolio enforcement:

  • New CoreUserRegistry PDA (["core_user_registry", user]) on Core, created on first deposit.

  • Records active_portfolio_id. Subsequent deposits into a different portfolio are rejected with PortfolioMismatch.

  • Registry clears automatically when a user's shares reach zero on withdrawal.

  • Enforced on all deposit paths and both withdraw paths.

migrate_portfolio removed:

  • To switch risk profiles, fully withdraw then re-deposit into the desired profile.

Account size changes: CoreUserRegistry::LEN = 114. No changes to fund account sizes.

hashtag
v0.10.1 — April 2026

Devnet feature propagation fix. Defense fund operator scripts. Deposit compute budget.

Bug fix — InvalidOracleAccount on devnet deposits: All three fund programs (keystone-alpha, keystone-neutral, keystone-defense) had devnet = [] in their Cargo.toml. This compiled the program with the devnet flag but did not propagate it to the keystone-primitives dependency, which contains the oracle validation. Fixed by changing to devnet = ["keystone-primitives/devnet"] in each program's Cargo.toml. Without this, any deposit via Core or direct deposit to a fund failed with InvalidOracleAccount even on devnet.

New script — scripts/devnet/migrate-share-mint-authority.ts: One-time migration tool for funds whose share_mint authority was set to the legacy vault_authority PDA seed instead of fund_authority. Reads the current mint authority from raw SPL layout bytes and calls migrate_share_mint_authority. Required for Alpha fund ID=1 after the initial devnet deployment.

New scripts — Defense fund operators:

  • scripts/defense-settle.ts — Permissionless NAV refresh crank. Reads on-chain balances (USDC + JupSOL + lending), refreshes cached NAV and share price, calls settle (rate-limited by min_settle_interval), and optionally calls settle_funding if a Jupiter Perps position is open. Admin bypasses the rate limit.

  • scripts/defense-keeper.ts — Full Defense fund operator. Supports --action=open|close|lend|settle|auto flags and DRY_RUN=true env var. Auto mode: settle → lend idle USDC → settle_funding → evaluate whether to open/close a negative-funding long SOL-PERP position. Automatically skips Jupiter Perps position management on devnet. Includes cascade mode awareness and configurable negative-funding thresholds.

Deposit compute budget (scripts/deposit.ts): Core deposits fan out to three fund CPIs and exceeded the default 200K compute unit limit. Fixed by prepending a ComputeBudgetProgram.setComputeUnitLimit({ units: 600_000 }) instruction. All three risk profiles (conservative/balanced/growth) now work correctly.

End-to-end devnet deposit verified: Full deposit flow tested (deposit.ts balanced 100): Core → Alpha + Neutral + Defense sub-deposits within a single versioned transaction using ALT. All three Core portfolios (Conservative/Balanced/Growth) fully deployed.

hashtag
v0.10.0 — April 2026

Drift → Jupiter Perps migration. Drift was exploited; all perp positions were moved to Jupiter Perps (PERPHjGBqRHArX4DySjwM6UJHiR3sWAatqfdBS2qQJu).

Architecture changes:

  • Standard basis: USDC split by collateral_bps (default 20%) → Jupiter Perps short collateral; remainder → jitoSOL for staking yield. Previously 100% of USDC was swapped to jitoSOL and deposited to Drift.

  • Settle funding now reads the Jupiter Perps position account directly (no CPI) — computes carry delta as current_net_usd - last_net_usd each interval.

  • last_cumulative_funding_rate field repurposed to store last recorded net position value (i64).

Removed:

  • initialize_drift_accounts instruction (both Neutral and Defense programs)

  • drift_user, drift_user_stats, drift_state, drift_sub_account_id, jitosol_spot_market_index state fields

  • DriftAccountsInitialized event

Added:

  • jupiter_pool, jupiter_sol_custody, jupiter_collateral_custody, jupiter_position, usdc_collateral_deposited state fields

  • deploy_capital gains collateral_bps and acceptable_price parameters

  • open_position gains collateral_usdc, size_usd, acceptable_price parameters

  • close_position, emergency_close_position, adjust_position, deploy_reverse, close_reverse, unwind_position gain acceptable_price parameter

  • Errors DriftOperationFailed / InvalidDriftAccount renamed to JupiterPerpOperationFailed / InvalidJupiterPerpAccount

Post-upgrade / operations: Perp instructions require BasisFundState.jupiter_pool, jupiter_sol_custody, and jupiter_collateral_custody to match the Jupiter Perps deployment you use. The on-chain update_fund_params instruction does not set those pubkeys (see programs/keystone-neutral/src/instructions/update_fund_params.rs); configure them through your deployment process or program version that initializes them correctly.

Documentation: Instruction tables and program IDs were aligned with the current crates (e.g. Core collect_fees is authority-only; migrate_portfolio is user-facing; Neutral parking + reverse basis coexist; devnet IDs match declare_id!).

GitBook / integrations: Fund instructions take the main state account as fundState in the IDL; error enums are AlphaFundError, BasisFundError, and DefenseFundError (variant codes unchanged for a given deployed program binary).

Naming: Fund error variants and pause events were renamed from Fund* to Fund* (e.g. FundPaused, FundAccountMismatch, InsufficientFundBalance, InvalidFundParams, FundPausedEvent; Core FundCpiFailed → FundCpiFailed). Update clients and string matchers accordingly.

hashtag
v0.9.0 — March 2026

Keystone Neutral: Reverse basis engine — full funding regime coverage.

Neutral now earns on both sides of the funding market without Marginfi. When funding turns negative, the fund automatically deploys the reverse basis trade instead of parking in lending.

New instructions:

  • deploy_reverse — Permissionless crank. Borrows jitoSOL from Kamino, sells for USDC collateral, opens SOL-PERP long on Jupiter Perps. Requires N consecutive negative funding periods.

  • close_reverse — Permissionless crank. Closes SOL-PERP long and repays jitoSOL borrow on Kamino when funding recovers.

Funding regime cycle:

New events: ReverseBasisDeployed, ReverseBasisClosed.

New protocol integration: Kamino KLend for jitoSOL borrow in reverse basis.

Current program (doc correction): Reverse basis runs alongside standard basis and optional idle-capital paths. enable_basis_lending, park_capital (Marginfi USDC lending), and park_in_jitosol (staking parking) remain in the on-chain program. There is no separate unpark_capital instruction — deploy_capital withdraws Marginfi USDC when redeploying.

hashtag
v0.8.1 — February 24, 2026

Bug fixes: overflow safety, deploy cap, lending balance tracking.

  • settle_funding — Funding calculation now divides before multiplying to prevent arithmetic overflow for large position sizes. Mathematically equivalent, safe at any realistic scale.

  • deploy_capital — Volatility multiplier is now capped at 100% so the fund can never attempt to deploy more USDC than it holds.

  • withdraw_from_lending (Alpha Fund) — Partial withdrawals now subtract the actual amount received (including accrued interest) from the tracked balance, keeping usdc_deposited_lending accurate over time.

  • Docs — Corrected all references that described unpark_capital as funding-gated. Unparking is always permissionless when capital is parked; the funding gate lives on deploy_capital only.

hashtag
v0.8.0 — February 24, 2026

Superseded: This release notes describe unpark_capital and a deploy_capital + CapitalParkedInLending interaction that differs from the current codebase (deploy_capital auto-withdraws Marginfi). Kept for history only.

Keystone Neutral: Marginfi idle-capital parking — full self-healing lending cycle.

When funding turns negative and the position is closed, the fund now automatically parks all capital in Marginfi USDC lending and earns lending yield while waiting. Once the funding rate recovers, the keeper withdraws and redeploys — no admin intervention.

New instructions:

  • enable_basis_lending — Admin one-time setup. Initializes a Marginfi account owned by the fund authority PDA and sets lending_enabled = true.

  • park_capital — Permissionless crank. After emergency_close_position, swaps jitoSOL → USDC via Jupiter then deposits all USDC into Marginfi. Requires !position_open && lending_enabled && usdc_in_lending == 0.

  • unpark_capital — Permissionless crank. Withdraws all USDC (principal + interest) from Marginfi back into fund_usdc, ready for deploy_capital. No funding-rate gate — unparking is always allowed when capital is parked.

Updated instructions:

  • deploy_capital — Now rejects with CapitalParkedInLending if usdc_in_lending > 0 (call unpark_capital first). Adds a staleness bypass: if settle_funding hasn't run for min_settle_interval × max_negative_funding_periods × 2 seconds (ring buffer frozen after close), the FundingRateTooLow gate is skipped to allow re-entry. The first settle after reopening records the actual current rate.

  • initialize_fund — Zero-initializes the four new lending fields.

New fund state fields:

  • lending_enabled: bool — Enabled via enable_basis_lending. Default: false.

  • marginfi_account: Pubkey — The fund's Marginfi account address.

  • marginfi_group: Pubkey — Marginfi group the account belongs to.

  • usdc_in_lending: u64 — USDC currently deposited into Marginfi. Included in calculate_nav.

NAV update: calculate_nav now adds usdc_in_lending to the base NAV, so share prices remain accurate while capital is parked.

New events: BasisLendingEnabled, CapitalParked, CapitalUnparked.

New errors: LendingNotEnabled, LendingAlreadyEnabled, LendingOperationFailed, InvalidLendingAmount, CapitalParkedInLending, FundingRateStillTooLow.

Account size: BasisFundState::LEN increased 860 → 933 (+73 bytes). Redeployment required.

Complete self-healing cycle (with lending enabled):

The fund oscillates between Jupiter Perps (positive funding) and Marginfi (negative funding) automatically:

Example with default settings (minSettleInterval=4h, maxNegativeFundingPeriods=2):

  • Close triggers: 2 consecutive 4h periods of negative funding = 8h total

  • Lending window: 4h × 2 × 2 = 16h before re-entry attempt

  • Full cycle: ~24h worst case

hashtag
v0.7.0 — February 24, 2026

Keystone Neutral: positive-APY enforcement — NAV drawdown guard + funding rate deploy gate.

The fund now actively defends against negative returns rather than relying solely on human monitoring. Two complementary on-chain mechanisms ensure capital is only deployed when the strategy is generating positive yield.

New fund state fields:

  • nav_high_watermark: u64 — Peak share price recorded at each settle_funding cycle. Set automatically on first settle.

  • nav_drawdown_guard_bps: u16 — If share price drops this many bps from its peak, the keeper triggers emergency_close_position. 0 = disabled (default).

  • min_funding_rate_to_deploy: i64 — deploy_capital rejects with FundingRateTooLow when the most recent funding snapshot is below this threshold. 0 = always deploy (default).

On-chain changes (keystone-neutral):

  • settle_funding — Updates nav_high_watermark on every settle; emits NegativeFundingAlert when drawdown guard is exceeded.

  • deploy_capital — Rejects with FundingRateTooLow when funding is below min_funding_rate_to_deploy.

  • update_fund_params — Exposes nav_drawdown_guard_bps and min_funding_rate_to_deploy as updateable params.

  • New errors: FundingRateTooLow, NavDrawdownExceeded.

Keeper (keeper-basis.ts):

  • Step 6 (NAV drawdown guard): If nav_drawdown_guard_bps > 0 and current share price has dropped from the watermark by ≥ that threshold, calls emergency_close_position immediately.

  • Deploy gate pre-check: checkAndDeployCapital checks isFundingBelowMinRate() before calling deploy_capital, skipping the transaction and parking idle USDC in Marginfi instead.

  • Staleness-aware redeployment (1b): After an emergency close, settle_funding stops running and the funding history goes stale. Keeper now uses lastFundingSettleTs age as a proxy — once (settleInterval × periodsRequired) seconds have elapsed without a settle, it recalls USDC from lending and attempts a fresh deploy. If funding is still negative the position closes again after 2 settle cycles (self-healing oscillation: lending while negative, trading while positive).

  • isFundingNegative() / isFundingBelowMinRate() helpers: Extracted correct implementations (fixes prior FUNDING_HISTORY_SIZE = 32 bug; correct size is 8).

  • recallAllFromLending(): New helper called before redeployment to ensure checkAndDeployCapital has the full balance available.

Account size: BasisFundState::LEN increased from 842 → 860 (+18 bytes for 3 new fields). Redeployment required.

hashtag
v0.6.1 — February 23, 2026

v0.6.1 — Keystone Neutral: fully automated withdrawal queue.

Users can now withdraw at any time — even when all capital is deployed in the basis trade. No admin intervention required.

New instructions:

  • unwind_position — Closes short SOL-PERP on Jupiter Perps, recovers USDC collateral, swaps jitoSOL→USDC via Jupiter. Permissionless when total_pending_withdrawals > 0; admin anytime.

  • claim_withdrawal — Transfers queued USDC to user, closes PendingWithdrawal PDA (returns rent). Permissionless.

Updated instructions:

  • withdraw — Unified dual-path instruction. If idle USDC ≥ withdrawal amount: transfers immediately. Otherwise: burns shares at current NAV, records USDC owed in a PendingWithdrawal PDA, keeper delivers within the next cycle.

New events: WithdrawQueued, PositionUnwound, WithdrawClaimed

Fund state: Added total_pending_withdrawals: u64 — non-zero signals keeper to run unwind_position.

Keeper (keeper-basis.ts): Withdrawal queue servicing is now the highest-priority keeper task. Keeper detects pending withdrawals → calls unwind_position → calls claim_withdrawal for each user → redeploys remaining capital via deploy_capital.

hashtag
v0.6.0 — February 21, 2026

Mainnet consolidation — both funds redeployed clean.

All fields (volatility config, Policy v2 risk controls) are now initialized at fund creation with sensible defaults. No migration instructions needed — update_fund_params handles all tuning post-deploy.

Keystone Alpha:

  • Removed upgrade_fund_vol_config and upgrade_fund_v2 instructions

  • initialize_fund now sets all v2 fields: NAV guard, emergency rebalance, auto-lending reserve

Keystone Neutral:

  • Removed upgrade_fund_vol_config and upgrade_fund_v2 instructions

  • initialize_fund now sets vol sizing defaults (2%/6% thresholds, 150%/100%/75%/50% multipliers)

  • adjust_position now respects min_hedge_drift_bps and position_reduction_step_bps

  • settle_funding now emits per-period funding loss alerts against max_funding_loss_per_period_bps

  • update_fund_params extended to cover vol config and all v2 risk controls

hashtag
v0.5.2 — February 19, 2026

Utilization tracking for both fund programs and SDK.

No new on-chain state — no redeployment required. Pure view helpers added to existing state structs.

Keystone Alpha:

  • calculate_capital_utilization_bps(usdc_wallet, nav) — (lending + jitoSOL_value) / NAV in bps. Measures what fraction of NAV is in yield-bearing form; idle wallet USDC is the non-productive portion.

  • calculate_target_alignment_bps(sol_price) — 10_000 - |current_sol_bps - target_sol_bps| in bps. Measures how closely the current SOL allocation tracks the DCA target at the current market price.

Keystone Neutral:

  • calculate_capital_utilization_bps(usdc_balance, nav) — (NAV - idle_usdc) / NAV in bps. Measures deployed vs idle capital; ~90–95% when fully deployed per the 95% rule in deploy_capital.

TypeScript SDK (scripts/calculations/utilization.ts):

  • calculateSolCapitalUtilization, calculateSolTargetAlignment, getSolFundUtilization

  • calculateBasisCapitalUtilization, getBasisFundUtilization

  • SolFundUtilization and BasisFundUtilization interfaces added to scripts/types.ts

  • All functions exported from scripts/index.ts

scripts/status.ts: New --- Utilization --- section displays capital utilization, target alignment, and per-bucket breakdown (lending %, jitoSOL %) for the Alpha fund.

hashtag
v0.5.1 — February 17, 2026

Security hardening release for both fund programs.

Fixes (both funds):

  • Oracle price scaling bounds checking — rejects extreme exponents, uses 128-bit intermediate math

  • Fee collection timestamp updated even when zero fees, preventing over-accrual

Fixes (Alpha Fund):

  • Marginfi account ownership validation on enable_lending — group and account must be owned by Marginfi program

  • Lending balance tracking uses principal-based accounting instead of received amounts

  • rebalance now uses typed TokenAccount constraints instead of unchecked accounts

  • read_marginfi_position_value validates account ownership before reading data

Fixes (Neutral Fund):

  • Jupiter Perps program ID validation on all CPI instructions (open_position, close_position, deploy_capital, adjust_position)

  • deploy_capital now takes explicit jupiter_account_count parameter instead of heuristic account splitting

  • Post-swap slippage verification on deploy_capital

  • Fixed funding rate sign convention in settle_funding (positive = shorts earn)

  • Separate last_adjust_ts timestamp for adjust_position rate-limiting (was sharing last_funding_settle_ts)

hashtag
v0.5.0 — February 16, 2026

Keystone Alpha (current repo declare_id!): 2JTb5UiM6mAYDUmnSiTgZXTTEJAJs98YRDcKLU6AGeZN Keystone Neutral (current repo declare_id!): BxKFa6GRKYgNKxRzJ4kXCHiDo2PodpNtKVWhJTZMtAXR

What's New:

  • Keystone Neutral — Delta-neutral yield strategy (11–21% APY target) using jitoSOL + short SOL-PERP on Jupiter Perps

    • Health factor monitoring with auto-deleverage

    • Funding rate tracking with negative funding detection

    • Permissionless capital deployment with volatility-aware position sizing

    • Permissionless settle/adjust cranks

  • Simplified to two funds — Removed stablecoin fund, focused on Keystone Alpha and Keystone Neutral

Keystone Neutral - New Instructions: initialize_fund, deposit, withdraw, deploy_capital, open_position, close_position, settle_funding, adjust_position, collect_fees, update_fund_params, pause_fund, transfer_authority

Status: Ready for mainnet after audit

hashtag
v0.4.0 — February 16, 2026

What's New:

  • Volatility-Aware Position Sizing — 30-day realized volatility tracking, dynamic step sizing (0.75-4.5%)

  • Market Regime Detection — 4 regimes: Normal, Low Vol Near Peak, High Vol Drawdown, Bear Market

  • Circuit Breakers — Auto-reduce or skip rebalancing during extreme market stress

Volatility-aware sizing and regime detection added. Vol config initially required a separate upgrade_fund_vol_config migration instruction (removed in v0.6.0 — now initialized at fund creation).

hashtag
v0.3.1 — February 11, 2026

Fix: Deposit decimal scaling — first deposit share minting now properly accounts for USDC (6 decimals) vs shares (9 decimals).

hashtag
v0.3.0 — February 2026

Production-ready Alpha Fund:

  • Atomic rebalancing (single-tx)

  • Real APY queries (no mocks)

  • Full Marginfi, Jupiter, Pyth integration

  • Three-tier fee stack (management + performance HWM + rebalancing)

  • Emergency pause, deposit caps, permissionless rebalancing

hashtag
v0.2.0 — January 2026

Atomic rebalancing, real APY queries, Marginfi CPI integration, auto-withdrawal from lending.

hashtag
v0.1.0 — January 2026

Initial Alpha Fund with price-based DCA, two-step rebalancing.

hashtag
Planned: v1.0.0 (Mainnet Pre-Release)

Partial unwinds: Only unwind proportional to total_pending_withdrawals, keeping remaining capital deployed.

On-chain keeper incentives: Configurable reward bps on claim_withdrawal for sustainable third-party keepers.

Deposit lock period: min_deposit_lock_secs to prevent flash deposit/withdraw MEV.

hashtag
Planned: v1.0.0 (Mainnet)

  • Security audit

  • Multisig admin (Squads)

  • Gradual TVL ramp

  • Community keeper network

  • Keystone Defense deployment

PreviousMainnet Checklist

Last updated