Mainnet Checklist

ksUSD is not yet deployed to mainnet. This page is the launch checklist that gates the mainnet program-deploy transaction. One program, one vault, one mint.

Pre-deployment (v1). The perp venue is Phoenix Perps (Ellipsis Labs), USDC margin via Ember, integrated by on-chain CPI (Rise SDK). Before it can post margin, the vault's trader PDA needs its CAN_DEPOSIT/CAN_WITHDRAW capabilities enabled — a self-serve step against Phoenix's public endpoint, claimed by scripts/onboard/onboard.ts. The exchange still reports itself gated, so treat it as unproven until the first send lands.

---

Phase 1 — Engineering (in progress)

• Single-program rewrite: one keystone_finance program, one vault, one share mint

• Phoenix Perps CPI via the Rise SDK — Ember USDC-margin path, trader onboarding, funding/position reads (phoenix-rise account views)

• Ellipsis capability grant on the vault's trader PDA — flags 6 → 63, via scripts/onboard/onboard.ts (one funded send, ~0.05 SOL)

• Kamino KLend CPI surface (idle/reserve USDC lending)

• Jupiter V6 swap CPI helper with explicit min_*_out slippage bounds

• Hardened account-context offsets (checked_add on all slice math)

• Funding EMA + staleness guard on-chain (funding_apr_smoothed_bps, FundingSignalStale)

• Drawdown latency (consecutive_dd_settles_required, DrawdownTriggerLatent)

• LST depeg auto-pause (lst_depeg_bps, LstDepeg)

• Reserve fund segregation (reserve_ata, separate cToken ATA, excluded from effective_nav_usdc)

• Wind-down terminal path (init_wind_down, claim_wind_down)

• Devnet round-trip test scaffold (scripts/devnet/test-roundtrip.ts)

• Keeper bot end-to-end on devnet (open/close normal + settle + emergency_close + lend cranks)

• Replay-protected admin transfer demo (transfer_admin + accept_admin)

• Devnet QA: ≥ 30 days continuous keeper operation with no manual intervention

• scripts/mainnet/init-v1.ts dry-run on mainnet RPC

---

Phase 2 — Audit

• Audit firm engaged (Ottersec / Sec3 / Neodyme — pick one)

• All issues triaged; high / critical findings resolved

• Public audit report published in the repo and linked from the whitepaper

• Bug bounty stood up (Immunefi or equivalent)

---

Phase 3 — Mainnet deployment

The program deploy itself is one script — scripts/mainnet/deploy-mainnet.sh — which builds, preflights, deploys, verifies the on-chain binary against the local build, writes the IDL, and records the deploy. Run --check first (no transactions), and --rehearse against devnet to walk the identical path.

npm run mainnet:deploy:check     # preflight only
npm run mainnet:deploy           # the real thing
npm run mainnet:deploy:verify    # re-verify on-chain binary vs local build

• Final program build under audit-locked commit; anchor idl build regenerated

• Admin multisig (Squads or equivalent) provisioned and tested on devnet

• deploy-mainnet.sh --check clean on the audit-locked commit

• Program deployed to mainnet (--rotate-id first if the launch ID must be isolated from devnet)

• On-chain binary hash verified against the local build (the script does this and fails loudly)

• On-chain IDL upgraded

• deployments/mainnet-<utc>.json committed as the deploy record

• initialize with conservative launch params:

  • deposit_cap_usdc = $250k (venue-derived; recompute with npm run phoenix:capacity on the day, raise after 30 days of clean operation)

  • liquidity_buffer_bps = 1_000 (10%)

  • emergency_close_dd_bps = 500 (5% drawdown auto-trip)

  • consecutive_dd_settles_required = 2

  • perf_fee_bps = 2_000 (20% above HWM)

  • reserve_skim_bps = 500 (5% of perf fee)

  • lst_depeg_bps = 500 (5%)

  • max_nav_change_bps_per_hour = 5_000 (±50%/hr)

• set_oracles with Pyth pull-oracle pubkeys for SOL/USD + jitoSOL/USD

• enable_phoenix — onboard the vault PDA as a Phoenix trader (Rise builder path) and pin the Phoenix/Ember accounts

• enable_lending against Kamino USDC reserve

• transfer_admin → accept_admin to the multisig (two-step)

• Upgrade authority moved to the multisig (deploy-mainnet.sh --transfer-authority <PK>), IDL authority moved with it

---

Phase 4 — Private beta

• Invite-only; raise deposit_cap_usdc $250k → $1M once the launch cap fills cleanly (gated by live OI, not demand)

• Keeper bot running with redundancy (≥ 2 independent operators)

• lend_idle_usdc running so the buffer's excess sits in Kamino productively

• Monitoring + alerting wired (/for-operators/monitoring.md)

• First collect_fees cycle after 30 days

• Public dashboard with live NAV, share price, position mode, queue depth, reserve fund

---

Phase 5 — Public launch

• Raise deposit_cap_usdc to $5M, then $25M as TVL fills

• First composability integration (Kamino accepts ksUSD as collateral; Marginfi v1.1 second-venue)

• DAO / treasury wrappers announced (Solana-aligned partners)

• Public docs polish + integrator quickstarts

---

Rollback / circuit-breaker plan

If any of the following occur in the first 90 days post-launch:

Trigger	Action
Audit reveals a missed critical issue	set_pause(true) immediately; if non-recoverable, init_wind_down and coordinate redeploy under new program ID
NAV drawdown exceeds 3% within a week	emergency_close + set_pause(true); investigate before resuming
Phoenix or Kamino announce a critical incident	set_pause(true) until the dependency is verified safe
Pyth feed instability for > 1h	set_pause(true); instant withdrawals stay open
LST depeg auto-trip	Vault is already paused by settle; admin investigates and either unpauses or emergency-closes

In all cases, instant withdrawals from the liquidity buffer remain available. Depositors can always exit during a pause.

---

Related

• Security model · Admin operations

• Pre-mainnet audit notes

• Whitepaper