> For the complete documentation index, see [llms.txt](https://docs.keystonefi.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keystonefi.xyz/how-it-works/whitepaper.md). # Whitepaper {% hint style="info" %} **TL;DR** Keystone holds jitoSOL and shorts the same amount of SOL on Phoenix, so the staking yield arrives in dollars instead of in a volatile asset. Both legs move in a single transaction, so the hedge is never half-on. When funding stops paying for itself the position closes and everything sits in USDC lending. Backtested on Phoenix's own funding over every day the venue has existed, 2025-11-19 to 2026-08-31: **5.04% net, −0.392% max drawdown**. Sections below derive each of those claims. {% endhint %} *Keystone Finance · Whitepaper v2.0 · 16 September 2026 · Kamran Choudhry* *** ## ksUSD turns SOL staking into dollar yield Deposit USDC. Keystone buys staked SOL and shorts the same amount of SOL perp. Price risk cancels down to a small residual, and the staking yield is what is left. You hold a vault share, not a pegged dollar: your balance is fixed, and the share price rises as that yield accrues — and can fall. Nothing is emitted, nothing sits off-chain, and every position is verifiable on Solana. **One program · one vault · one share mint.** | Where the yield comes from | Net APY | Bear year → bull year | Floor | Max drawdown | | -------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ------------------------------------------------------ | ------------------ | ------------------------------ | | \~82% of NAV in jitoSOL staking; funding adds a quarter of gross but roughly nets out after the trading its swings provoke | **5.04%** (5.37% gross) | 3.28% → 5.36% across a 2.00–5.50% staking range (§VII) | 3.69% USDC lending | **−0.392%** (286-day backtest) | **Status: pre-deployment.** v1 hedges on Phoenix Perps (Ellipsis Labs) with USDC margin via the Ember program; jitoSOL is held unlevered as the spot leg. Devnet only, audit pending. Phoenix's SOL perp opened 18 November 2025, so the backtest window is the venue's entire life: 286 days of its own funding, unscaled — not a CEX proxy, and not a market cycle. ## I. Where the yield comes from Almost every yield-bearing dollar on-chain is, underneath, a bet on perp funding. This one isn't. Funding is the obvious thing to build on, and the first thing to go when you need it. Ethena showed both halves: sUSDe rode positive funding to around 15% through 2025, then settled back to 3.7% as funding compressed.¹ Build a dollar on funding and you inherit funding's cycle. Here, funding is upside on a conversion that already works without it. Fully hedged, per $100 of NAV per year: | Leg | Per year | | ------------------------------------------------------------ | ---------- | | $81.8 of jitoSOL @ 4.94% staking | **+$4.04** | | $8.2 of USDC margin at Phoenix @ 0% | $0.00 | | $8.0 of redemption buffer, lent @ 3.69% | +$0.30 | | $2.0 of buffer held raw for instant redemption | $0.00 | | Funding on the short, at the +4.31% its hedged days averaged | +$3.53 | | Perp fees, charged per day held | −$0.08 | | **Hedged run rate** | **+$7.78** | That is the rate while the position is on. The vault is hedged three days in four and pays $1.53 a year to move between modes, which is what takes the run rate to the 5.37% gross. Funding is real and measured — Phoenix has averaged **+1.74% APR** since inception, positive on 59% of days — but it swings from −14% to +14% by month, and reacting to that is what most of it goes back out on. Keystone does collect that funding — it just isn't what carries the return. Switch each leg off in the backtest and the asymmetry is total: **with funding off Keystone still nets 4.23%; with staking off, funding alone nets 0.99%**, not even covering perp fees and the margin haircut. Staking isn't the larger share. It's the product. **Read those two numbers against the table above and they appear to disagree, so be precise about what each one measures.** The $3.53 is the funding *collected* while the hedge is on — the second-largest line in the table, and high because the vault parks when funding turns: the days it sat out averaged −6.83%. The 4.23% is what the vault earns with funding removed entirely, and it is *higher* than the 3.95% it earns with funding present when the hysteresis band is off. Both are true. Funding's gross contribution is large; its **marginal** contribution is 81 bps, because reacting to swings that run from −14% to +14% costs 20–40 bps a time. What makes it pay is holding through it rather than trading it — which is why the band below is worth 109 bps, nearly all of it switching avoided rather than funding held onto. Funding is the price of leverage on a given venue, paid by whichever side of *its* book is crowded — which is why Phoenix's cannot be inferred from anyone else's. Over the 286 days both series cover, Phoenix averaged **+1.58%** while Binance averaged **−0.11%**, and the two disagreed on sign for weeks at a time. (That +1.58% is the matched 286-day comparison window; the venue's average since it opened, used everywhere else in this paper, is +1.74%.) Same asset, different book, different funding. **Funding arrives with traders**, and Phoenix's book is young. The headline claims only what it has already paid. Two things follow from that: * **The correlation profile genuinely differs from both incumbents.** RWA dollars move with the Fed. Ethena moves with the crypto leverage cycle. This moves with Solana network activity. * **The yield risk that matters is staking-rate compression, not thin funding.** Thin funding barely dents the return, and deeply negative funding parks Keystone in USDC lending where it still earns. A falling staking rate has nothing to park into — and Solana's is on a schedule to fall. That is §VII, and it is the section to read second. ## II. How it works ### Two modes, one rule Keystone is only ever in one of two states, and the same comparison decides which: | Mode | Position | Earns | | ---------------- | ---------------------------------------------------------------------------- | ---------------------------------- | | **Normal basis** | long jitoSOL spot (unlevered) + short SOL-PERP on Phoenix at 1×, USDC margin | jitoSOL staking + funding received | | **Parked** | all capital in USDC lending (Kamino) | lending yield (3.69%) | jitoSOL is held outright as the spot leg and USDC is posted as perp margin via Ember: no LST is used as perp collateral. Mode switches cost ≈20–40 bps round-trip. **Reverse basis is not in v1:** harvesting negative funding means borrowing, and the hurdle cleared on only \~2-4% of days over the 286-day window, worth \~+16 bps. Parked covers that range instead, and **v1 never borrows**.
Smoothed perp funding decides the mode: when funding clears the dynamic threshold (−0.78%) Keystone moves to Normal basis (short plus staking); when funding is below it Keystone moves to Parked (USDC lending). Transitions are automatic, driven by the funding signal.

One on-chain signal, smoothed funding, decides the mode.

### When it switches Keystone stays hedged for as long as hedging beats parking. Compare the two on $100: | | Parked | Normal basis | | -------------------- | ------------------ | -------------------------------------------- | | Where the money sits | $90 lent on Kamino | $81.8 in jitoSOL, $8.2 as perp margin | | What it earns | 3.69% on all of it | 4.94% on the $81.8; the margin earns nothing | | **Per year** | **$3.32** | **$4.04** | Hedging starts **$0.72 ahead**, and that surplus is the budget the short is allowed to burn. The short covers $81.8 of SOL, so $0.72 is **0.88%** of it; net of the amortized perp round-trip the break-even lands at **−0.78%**. Funding can run down to there and Keystone is still better off hedged — but that is thin headroom, and it was three times wider under the 7% staking rate this model used to assume. That is the whole rule. Not "is funding positive?" but "has the short started costing more than $0.72?" The keeper recalculates that number each cycle from live staking and lending rates, so it moves when they do. **Why the spread is the product.** The return is not the funding rate. It is the gap between what staking pays and what lending pays. Funding only decides whether the hedge is worth carrying, which is why the threshold sits below zero rather than at it. That same gap names the failure. If lending rises to meet staking, the threshold turns positive, and funding at the rate Phoenix has been paying cannot reliably clear it, and Keystone parks for good — a Kamino deposit carrying the operational risk of a hedged one. A falling staking rate closes the same gap from the other side. Neither side is hedged, which is why the keeper measures both rates every cycle instead of assuming either. A constant on either side would leave half the rule blind to the thing that ends the strategy. **What the floor is set to.** Keystone ships with its on-chain floor at **−78**, the break-even itself, and the keeper can only ever be tighter than the floor, never looser. So the program will short through mildly negative funding, and the keeper's dynamic rule decides when it actually does. What it gives up is the guarantee that the program itself can never short into negative funding. On the measured window a floor of zero would in fact have scored 31 bps better, by parking before February's −14% funding month — a path-dependent result over 286 days rather than a reason to move a threshold derived from the break-even. The figures here use −78. The threshold applies as a **±3% hysteresis band** rather than a line. Keystone opens only once funding clears the threshold by the band, and holds until funding falls clearly below. The width is a payback rule: a switch costs 20 bps, and the edge accrues on the 81.8% basis leg, so requiring `(f − f*) × 0.8181 × T/365 > 20 bps` says "only move if the move repays itself within T". At **T = 30 days that is 2.97 points** — the 3.00 in the code. On Phoenix's measured funding the band is worth **109 bps**: removing it drops net from 5.04% to 3.95%, because funding swings from −14% to +14% by month and reacting to every move costs 20–40 bps a time. Nearly all of that is cost avoided — the band halves the switches, worth 153 bps a year, and gives about 22 bps back in worse mode selection. It is load-bearing rather than cheap insurance, and a reader should know that a ninth of the headline rests on it. Sweeping the width across 0–6 points moves net between 3.95% and 5.32%, and **3 points is not the best value on this window** — 1.5 points returns 5.17% and 4 points returns 5.32%. The shipped value sits in a shallow trough between them. We have not re-tuned it, and the reason is the sample rather than the derivation. Those runs differ by four to twelve switching decisions over 286 days; what separates 4 points from 3 is mostly whether the band happened to park the vault before February 2026. Fitting a switching parameter on a dozen events is how a backtest gets optimised into something that does not generalise, and the payback rule is the thing that survives not having a long sample. The [historical simulation](/how-it-works/strategy-and-modes/historical-simulation.md) carries the full sweep. Transitions run automatically: the smoothed on-chain funding signal decides, a keeper bot executes, and a 7-day mean plus a 12-hour minimum hold filter out the noise. See [Strategy & Modes](/how-it-works/strategy-and-modes.md#when-does-the-vault-turn-the-trade-on). ### Near zero, not zero Three things stop the legs cancelling exactly. The spot leg is jitoSOL while the short is SOL-PERP, so they offset only while the jitoSOL/SOL ratio holds; a depeg is a straight loss. Delta drifts inside a 25 basis point band between rebalances, and a correction is bounded four ways — that band, a per-call clip, the position cap, and the collateral actually posted at the venue, since a short can only be as large as its margin carries. And the perp can trade away from spot, with the position marked against the perp. Staking accrual is not a fourth item, because it is hedged rather than carried. The appreciation *is* the yield: jitoSOL gains about 4.94% a year against SOL, and leaving that alone would leave the return denominated in SOL rather than dollars. A resize sells it forward as the drift passes the band, roughly once a fortnight. None of the three that remain is large in ordinary conditions. Together they are still enough that "no price risk" would be the wrong claim. See [Risk](/start-here/volatility-risk-management.md). ### What the conversion costs Every dollar posted as margin is a dollar not earning staking yield. At v1 sizing about **9.1% of deployed capital sits at Phoenix as USDC margin earning nothing**, which is about **8.2% of NAV**, against **81.8% in jitoSOL** earning the staking rate. A further 10% of NAV is the redemption buffer — 8% lent on Kamino, 2% held raw. That allocation is already inside every net figure here: the staking leg contributes 4.04 of the 5.37% gross. The obvious dismissal is that this is a hedged jitoSOL wrapper. The difference shows up when funding inverts. A naive hedged LST keeps paying to hold its short and bleeds; ksUSD closes and parks in USDC lending. That exit costs 20–40 bps, is written into the program, and runs automatically on a signal nobody has to interpret. Parking is the part that isn't a wrapper. ## III. Why the hedge is the product The hedge performs the conversion, so anything that can break the hedge breaks the product. That isn't a risk sitting beside the design; it is a hole in it. A venue that halts trading, or auto-deleverages a profitable short to cover someone else's loss, doesn't give ksUSD a bad day. It removes the leg that makes the yield a *dollar* yield, while Keystone still holds the jitoSOL. So the venue choice carries weight rather than being a footnote. Phoenix settles on-chain. The vault opens, defends and closes its own hedge by calling the program directly, the position is visible on Solana, and no operator sits in between. That doesn't remove venue risk — §VII is specific about what remains — but it puts the mechanism somewhere it can be inspected, which is the minimum you should want from the thing the product depends on. ## IV. The share, and what it costs ksUSD is a **non-rebasing** share token. Your balance stays fixed and the share price rises as carry accrues. Redemption is against NAV, instant from the liquidity buffer and queued for larger size. It is a share in a hedged carry vault, not a dollar-pegged stablecoin. No fixed yield, no RWA, no emissions, no view on where SOL goes. The architecture is small on purpose: one program, one vault, one rule set. | Yield source | Active when | Contribution | | ------------------- | ----------------------- | ---------------------------------------------------------------- | | **jitoSOL staking** | Normal basis (spot leg) | **4.94% APR** | | Phoenix funding | Normal basis | −14% to +14% by month; **+1.74% average** since the venue opened | | USDC lending | Buffer + parked | 3.69% APR | | Fee | Rate | | ----------- | -------------------------------- | | Management | **0%** | | Performance | **20%, and only above a hurdle** | | Withdrawal | **0%** | **The floor is a Kamino deposit; the upside is 80% of everything above it.** The hurdle is the USDC lending rate — what the same capital would earn sitting in Kamino by itself — so the performance fee applies only to what Keystone adds on top. A year that returns exactly the hurdle costs nothing, so the fee cannot drag a holder under the benchmark. Above it, they keep 80 cents of every dollar of edge. Parked mode is why this matters. Parked, Keystone *is* a Kamino USDC deposit: no perp, no hedge, nothing the holder couldn't do themselves in a single transaction. Taking a fifth of that return would be charging a performance fee for holding a deposit, and it would leave a parked holder behind where they'd have been lending the USDC directly. The hurdle gives those days' yield back in full, so the fee starts only where the strategy does. Across the backtest window it cuts fees charged by 65%, from $2.59 to $0.91 per $100. The rate isn't fixed in code. The hurdle is read from Kamino's live supply APY at deploy and maintained against the smoothed rate afterwards. See [Fees](/start-here/fees.md). ## V. Why this only assembles on Solana The design needs four things on one chain, close enough together to compose: * **An on-chain perp.** Keystone opens its hedge by calling into Phoenix Perps with USDC margin from its own program. Phoenix settles on-chain, and that direct call is the part that doesn't port. * **Funding it receives**, rather than a pool borrow-fee it pays. * **A high-yield LST and deep USDC lending.** jitoSOL held unlevered as the spot leg; Kamino for the liquidity buffer and parked NAV. * **Fees low enough** that regular rebalancing stays economic. On Ethereum these don't line up. Gas makes rebalancing expensive, the deepest perps sit off-chain or on separate domains, and LST yield, funding and lending live apart from each other. The spot leg also earns more here: Solana staking plus MEV tips leave jitoSOL paying 4.94% after validator commission and Jito's fee, against roughly 3% for Ethereum LSTs. The staking leg is where the return comes from, so that gap matters more than the composability argument does. ## VI. What the backtest shows Daily resolution over every day Phoenix has quoted a SOL perp, 2025-11-19 to 2026-08-31. The v1 set, normal plus parked, turned $100 into **$103.93** over 286 days while never giving back more than **0.392%** from a peak. It held the hedge on 75.5% of days and switched modes six times. | Variant | Net APY | Gross APY | $100 net → | Max DD | | ------------------------ | ----------- | --------- | ----------- | --------------------- | | **Normal + parked (v1)** | **5.04%** | 5.37% | **$103.93** | **−0.392%** | | USDC lending benchmark | 3.69% | — | — | flat floor | | sUSDe benchmark | \~5% recent | — | — | bleeds in low funding | **The drawdown is the number worth reading, and worth attributing.** February 2026, the month Phoenix funding averaged −14%, closed *positive* — the short is a hedge, not the revenue. The 0.392% is mostly the vault's own trading: hold switching costs at zero and the worst fall is **0.127%**, and both the worst day and the worst month in the published run are mode changes rather than market days. That 5.04% is fully loaded. The performance fee, the margin-capital haircut where USDC posted as margin earns nothing, and trading costs are all inside it. Against USDC lending it leaves about 135 bps of edge. ### What the result depends on The venue is 286 days old, so there is no rolling-12-month band to quote and no bear year in the sample. What can be shown is which input the answer rests on. Move the lending benchmark from 3.61% to 5.00% and the edge over lending stays between **110 and 141 bps**. Move the staking rate across everything the next three years can plausibly deliver — 5.50% down to 2.00% — and net APY runs **5.36% to 3.28%**, crossing below the lending benchmark near the bottom. That sweep and the schedule behind it are §VII, and it is the one that decides how long this works. The input the answer is *most* exposed to is the least glamorous one: what a mode change costs. The model charges 20 bps and the venue retains no historical depth to check it against. At 30 bps net is **4.40%**; at **40 bps it is 3.65%, below the lending benchmark**, and the drawdown roughly doubles to 0.928%. Both headline numbers move on the same parameter, so a reader who marks the slippage assumption up should discount the drawdown by as much as the yield. ### Method Staking runs at jitoSOL's **4.94%** published pool APY — the stake pool's rate, MEV included and net of validator commission and Jito's fee, not Solana's 5.30% network rate, which the vault does not receive. USDC lending runs at the live Kamino 3.69%, which parked mode earns and the fee hurdle ratchets at. Funding is **Phoenix's own hourly record, unscaled**. The mode threshold is the true break-even, −0.78%, with a ±3% band. The perp leg is over-margined well inside the venue's 15× limit, so \~9% of NAV sits at zero yield. Costs are 5 bps perp fee and 10 bps slippage per side, 20–40 bps per switch. Three things the venue's data cannot settle, all cutting the same way. Phoenix is still **gated** (`/v1/view/exchange/status` returns `"gated": true`), so every day in this window is a day we could not have traded. Historical order-book depth is not retained, so nothing supports or refutes the assumption that the hedge was placeable in full each day. And funding is treated as exogenous when at our size it is not: open interest is **$4.73M**, so a fully hedged $500k vault is \~11% of the book, and its own short pushes mark toward index and reduces the funding it collects. Alongside those, 286 days is a venue's whole life rather than a cycle, and the model runs a static $100 — deposits and redemptions each cost 20 bps and the program charges neither party, which is published beside the headline rather than folded into it. Detail: [historical-simulation.md](/how-it-works/strategy-and-modes/historical-simulation.md). ## VII. The staking runway {% hint style="warning" %} **The short answer.** Disinflation takes the spread, not the floor. Parked, ksUSD earns the lending rate, and the modelled drawdown is the same −0.39% at every staking rate in the sweep, so the schedule is a yield question rather than a safety one. On the schedule as passed: around 2027 staking alone stops paying for the short and whether the vault hedges at all becomes a funding call; by 2028 the edge over lending is about 40 bps; it turns negative only near 2.0% jitoSOL, roughly the terminal rate. What ends is not the strategy but what it earns above a Kamino deposit — and the fee that funds Keystone goes first. {% endhint %} Staking is the engine, and Solana's staking rate is on a schedule to fall — a schedule that got steeper a fortnight before this draft. **SIMD-0550 passed on 28 August 2026** with 67.001% of participating stake, doubling disinflation from −15%/yr to −30%/yr and pulling the 1.5% terminal rate forward to roughly 2029. Activation is expected in early 2027. Two break-evens follow from the allocation, and they hold regardless of whether any projection is right. Parked earns the lending rate on all but the instant tranche, 3.62%. Hedged earns staking plus funding on the 81.8% basis leg: | Below this jitoSOL rate… | …this stops being true | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | | **4.16%** | Staking alone justifies the hedge. Under it, the short only pays if funding is positive — the vault becomes funding-dependent. | | **2.42%** | Hedging beats parking at all, even at Phoenix's average +1.74% funding. Under it, the vault is a Kamino deposit. | jitoSOL pays **4.94%** today. Mapping the passed schedule onto those lines, at the measured jitoSOL/network ratio of 0.9327: | | Network | jitoSOL | Threshold | | ----- | ------- | --------- | ---------- | | Today | 5.30% | **4.94%** | −0.78% | | 2027 | 4.34% | 4.05% | **+0.11%** | | 2028 | 3.00% | 2.80% | +1.36% | | 2029 | 2.25% | 2.10% | +2.06% | **The first line is crossed in about a year.** From 2027 the threshold is positive, and the sentence this paper leans on in §II — staking already out-earns lending, so the short can cost a little — stops being true. The funding sign, which in §VI moves only the topping, then decides whether the hedge goes on at all: the vault is still staking-based, but it is funding-dependent. The second line is crossed around 2029. Running the backtest across that range, with the threshold re-derived at each step: | jitoSOL | Threshold | Gross | Net | Hedged | Perf fee /$100 | vs lending | | ---------------------------- | ---------- | --------- | --------- | --------- | -------------- | ------------ | | 5.50% | −1.34% | 5.77% | 5.36% | 76.2% | $0.31 | +167 bps | | **4.94% *****(today)*** | **−0.78%** | **5.37%** | **5.04%** | **75.5%** | **$0.25** | **+135 bps** | | 4.16% *(break-even 1)* | 0.00% | 5.39% | 5.06% | 53.5% | $0.25 | +137 bps | | 4.05% *(2027)* | +0.11% | 5.34% | 5.02% | 53.5% | $0.24 | +133 bps | | 2.80% *(2028)* | +1.36% | 4.20% | 4.11% | 50.3% | **$0.07** | +42 bps | | 2.42% *(break-even 2)* | +1.74% | 4.01% | 3.96% | 49.7% | $0.04 | +27 bps | | 2.10% *(2029)* | +2.06% | 3.94% | 3.90% | 48.3% | **$0.03** | +21 bps | | 2.00% | +2.16% | 3.30% | 3.28% | 46.9% | $0.02 | **−41 bps** | **Net APY degrades gracefully; the fee does not.** Parking is a floor, so the vault keeps roughly the lending rate all the way down — but the performance fee collapses from $0.25 per $100 to $0.03, because the hurdle ratchets at the lending rate and the gap the fee is charged on closes from the top. By 2029 a $500k vault generates a few hundred dollars a year. **The strategy outlives its own staking decline. The fee that funds the strategy does not.** Four qualifications, all of which cut toward this table being too harsh: * The projection scales jitoSOL's rate proportionally with the network rate. **MEV is not inflation-linked**, so a growing share of the pool's yield should survive the taper and the tail is understated. How much could not be established: Jito's published MEV series implies 4.48% APR against pool TVL, which cannot sit inside a 4.94% total, so it is not the pool's own share and no decomposition is offered here. * The schedule cuts emissions, and a staker's yield is emissions divided by the staked share, so the cut lands one-for-one only if that share holds at today's 69%. Stake that leaves as the rate falls lifts the yield of what stays. * The lending benchmark is held at 3.69% throughout. If rates fall with staking — and they have historically moved together — the spread closes far more slowly than this. * The low-staking rows are **mode-behaviour dominated**. At those thresholds the vault parks about half the time and switches four times in 286 days, so those returns turn on a handful of decisions rather than on a stable edge. Read them as direction, not as forecast. ## VIII. What can go wrong ### How redemption works Share price is NAV divided by shares, marked from on-chain balances and oracle-priced legs. Deposits and instant withdrawals do not price off a keeper attestation at all: they read the Phoenix trader account and the SOL oracle directly and mark the perp leg themselves, so the number a depositor transacts at is computed from chain state at the moment they transact. Attestation still carries NAV between those moments, bounded by a per-hour change cap and now checked against the program's own reading of the position rather than a wide sanity band. A 10%-of-NAV buffer covers normal redemptions instantly. Larger ones burn at the locked price and settle against what the unwind actually realizes, through a permissionless crank. A queued payout in stressed markets can therefore come in below marked NAV. ### Risks **Structural — the ones that can end the conversion** | Risk | Mitigation | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Hedge removed by the venue** | The one that matters most, per §III. A market halt, or auto-deleveraging that force-closes a profitable short to cover another trader's loss, ends the conversion while Keystone still holds jitoSOL — leaving it long SOL until it can re-hedge or sell. On-chain settlement means Keystone can see and act on this itself, and an emergency unwind can close the spot leg once the market is readable, but neither prevents an ADL. Sizing the short at a small fraction of open interest is the main defence, and it is why the deposit cap tracks the venue rather than demand. | | jitoSOL depeg or slashing | **Marked at market**, via the Pyth jitoSOL/USD feed — so a liquidity discount hits NAV and the share price immediately, not on sale. A discount past the depeg guard, measured against the Jito stake pool's redemption rate, auto-pauses Keystone and arms the emergency unwind. Slashing is unhedgeable, and neither Jito nor any third party reimburses it. | | Smart-contract | Pre-mainnet audit scheduled; devnet only until then. | **Venue & counterparty** | Risk | Mitigation | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Perp-venue dependency | Phoenix is the only hedge venue, so an exploit, outage, or socialized loss hits ksUSD directly. Phoenix is in private beta, and trader onboarding needs an Ellipsis builder-access grant, which is a live external dependency. A second venue is the structural fix and is not in v1. | | Counterparty | Phoenix, Ember, Kamino, Jupiter, Jito. No single one holds all NAV, but nothing stands in front of a venue failure either — there is no insurance fund, see below. | | Swap router | Jupiter V6 routes every USDC↔jitoSOL swap. Slippage is bounded on-chain. An outage stalls mode rotation; buffer redemptions stay open. | | Oracle | Pyth reads gated by 5-min staleness and 2% confidence; outages past that can still cause loss. | **Yield** | Risk | Mitigation | | ------------------------ | ---------------------------------------------------------------------------------------------------- | | Staking-rate compression | Quantified in §VII: two break-evens, at 4.16% and 2.42% jitoSOL, and the schedule that reaches them. | | Funding compression | Secondary. Keystone parks and earns 3.69%; upside above that isn't guaranteed and is \~0 today. | **Operational** | Risk | Mitigation | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Liquidation | The short is over-margined and the keeper tops margin up actively — idle USDC first, then a Kamino recall. Both are needed: the jitoSOL sits in Keystone while the margin sits at Phoenix, so the venue cannot see the collateral backing the short. When both sources are exhausted, Keystone de-levers instead: it buys back part of the short and sells the matching fraction of jitoSOL in one transaction, so notional and the collateral requirement fall together and the hedge never opens. Proportional is the whole point — selling jitoSOL alone is the obvious way to raise cash and the one that turns a squeeze into a loss, shrinking the long leg while the short stays whole and leaving Keystone net short into the very rally that caused the shortfall. Anyone may call it once margin falls below the floor, and a caller who is not the keeper may only route the proceeds back to margin — so a stranger can defend the position but cannot drain it. | | Redemption under stress | Buffer and queue absorb normal flow, and a queue larger than both can be funded by de-levering a proportional slice of the position rather than waiting for a mode flip; an extended liquidity drought still lengthens the queue and widens unwind slippage. | | Regime-transition | Mode switches cost 20–40 bps and can mistime fast funding flips; the 7-day mean and 12-hour minimum hold trade a little latency for far less whipsaw. | | Keeper outage | Buffer withdrawals stay open; rotation and queue processing pause until cranking resumes. Anyone can crank. | ### How big are these, in numbers The risk tables above say what can go wrong. These say how much. Both come from the same stress run, against the same window and constants as the headline. **A jitoSOL discount is the largest unhedged exposure.** The short covers SOL, not jitoSOL, so a discount lands directly on the $81.8 basis leg with nothing offsetting it: | Discount | NAV impact | | | -------- | ---------- | ------------------------------------------- | | 0.5% | −0.41% | | | 1.0% | −0.82% | | | 2.0% | −1.64% | roughly a year of net yield | | 5.0% | −4.09% | marking NAV auto-pauses, opening hard-fails | | 10.0% | −8.18% | | | 20.0% | −16.36% | | The 5% guard measures against the Jito stake pool's redemption rate rather than against 1.0. That matters: jitoSOL appreciates against SOL as rewards accrue, so a guard anchored at 1.0 would drift out of reach and fire on nothing. Slashing sits underneath all of it and is unhedgeable — Jito runs no insurance fund and nobody reimburses it. **No insurance fund.** There is no reserve standing in front of any of this, and that is a design choice rather than a gap. A reserve sized against market risk would have to be large — a 1% jitoSOL discount costs 0.82% of NAV, and no skim on a 20% performance fee gets near it — and a reserve too small to cover an incident is machinery without a purpose. **ksUSD defends no peg.** An insurance fund is what a pegged dollar needs, since a discount there is an existential failure. Here the share price absorbs the shock: NAV is marked at market, the price is designed to be able to fall, and a holder exiting into a bad unwind bears it rather than passing it to the holders who stayed. What Keystone does stand behind is narrower: shortfalls the *protocol* caused rather than the market — a bad fill, an oracle mismark later corrected, an accounting gap. Holders did not sign up for those, and the operator makes them whole from its own fees by sending USDC to the vault, which the share price reflects at the next settle. That needs no instruction and holds no capital idle against an event that has not happened. **How often the short's margin comes under pressure.** The short is the leg that liquidates, so the adverse direction is SOL *up*. Counting intraday highs against the previous close: | Adverse move | Days | Share | | | ------------ | ---- | ----- | ------------------------------------------------------------------ | | ≥ 3% | 289 | 39.6% | | | ≥ 5% | 139 | 19.0% | about half the entry margin; where a maintenance requirement bites | | ≥ 9% | 27 | 3.7% | exhausts the entry margin outright | | ≥ 15% | 4 | 0.5% | | Entry margin is 9.1% of deployed capital, so a 5% move does not liquidate the position outright. It removes roughly half the cushion, and the margin top-up exists to replace it. The 5% row is often quoted as a liquidation count. It isn't one. **A realistic bad month.** The modelled worst month is −0.04%, funding only. Adding a depeg and a round-trip reprice on the basis leg gives −1.6% at a 1% discount and −4.9% at 5%. A bad month is dominated by depeg rather than by funding. ### Failure modes Fallbacks are built in. Funding compression parks Keystone. Perp-venue trouble triggers an oracle-divergence auto-pause and a permissionless emergency unwind. Margin falling below its floor opens de-levering to anyone, so it does not wait for the keeper either. A depeg auto-pauses. Wind-down turns Keystone into a pro-rata USDC claim. Redemption works whether or not the team is present. ## IX. Position Where this sits against the other yield-bearing dollars, by what actually produces the yield: | | Yield source | Behaviour when funding dies | Transparency | Venues | | -------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------ | ------------------------------------------------ | | **ksUSD** | **Staking**, plus funding and lending | Parks at the lending floor | Fully on-chain | Phoenix, Kamino, Jito (Solana-native) | | Hylo (hyUSD) | LST staking across the whole collateral pool, financed by xSOL | Unaffected by funding; tracks leveraged-SOL demand and rebalancing cost | On-chain | LST issuers + its own xSOL tranche and Earn Pool | | Ethena (sUSDe) | Delta-hedged perp funding | Yield follows funding down | Off-chain CEX, attested | CEXs + custodians | | MakerDAO / Sky | Stability fees + RWA/savings | Unaffected; tracks rates instead | On-chain + off-chain RWA | RWA counterparties | | Perena (USD\*) | Swap fees + stable yields | Tracks volume instead | On-chain | Solana AMM/DEX | **Hylo (hyUSD) is the closest Solana-native design, and it out-yields this one today** — ≈9.7% against 5.04% net here. It overcollateralises hyUSD with a basket of LSTs and issues xSOL, a junior tranche that absorbs SOL's volatility so hyUSD can hold its peg, and its savings token earns on the whole pool because xSOL and unstaked holders forgo their share. Both designs are claims on the same engine: Solana staking pays both. Hylo levers it through its tranche; Keystone hedges it with a perp. The lasting difference is the leverage multiple, not the source of the return. That rate is a participation ratio rather than a spread, so it converges downward as the product grows — toward the collateral ratio times the LST yield, which at Hylo's 150% target puts it at 9.5–10.5%. It has already made most of that move: 52.4% in Q1 2026, 9.7% the quarter after. The structural difference that outlasts the rate gap is that **Keystone has a cash state and Hylo does not** — when the trade stops paying, this parks in USDC lending, while Hylo's V2 reaches neutrality by charging rebalance subsidies to its own savers in exactly the drawdowns they bought the token to sit out. Full teardown, including eHYUSD: [Hylo comparison](/how-it-works/whitepaper/hylo.md). Ethena showed there is real demand for a yield-bearing dollar, and showed what happens when the one source of that yield compresses. The answer here isn't a better funding trade. It is a different engine, with funding as upside rather than foundation. The longer goal is dollar yield that comes from the market it lives on, and can be checked against it. *Simulated performance does not predict future results.* ¹ *Ethena figures are directional, per public dashboards from the backtest era.* *** [app.keystonefi.xyz](https://app.keystonefi.xyz) · [docs.keystonefi.xyz](https://docs.keystonefi.xyz) · *Simulated figures only. Not investment advice.* *** ## Related * [Strategy & Modes](/how-it-works/strategy-and-modes.md) — the two modes, the funding threshold, and the switch * [What can go wrong](/start-here/volatility-risk-management.md) — drawdown guard, slippage bounds, depeg and staleness guards * [Historical Simulation](/how-it-works/strategy-and-modes/historical-simulation.md) — the backtest behind the headline numbers * [Fees](/start-here/fees.md) — HWM math and the hurdle ratchet * [NAV & Share Pricing](/how-it-works/strategy-and-modes/nav-calculation.md) — how a share is priced * [Security Model](/reference/security.md) — oracle, authority, and permissionless paths