> For the complete documentation index, see [llms.txt](https://docs.keystonefi.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keystonefi.xyz/reference/whitepaper.md). # Whitepaper *Keystone Finance · Whitepaper v1.2 · 2026 · Kamran Choudhry* *** ksUSD is a share in a vault that holds staked SOL and hedges the price risk away. Deposit USDC, hold the token, and the share price rises as carry accrues. Nothing is emitted, nothing sits off-chain, and every position can be checked on Solana. One program, one vault, one share mint. ## I. What it converts ksUSD converts SOL staking yield into dollar yield. The hedge is what makes that conversion possible, and when funding is positive the hedge pays you rather than costing you. That is the whole product. It is worth saying against the usual framing, because almost every yield-bearing dollar on-chain is, underneath, a bet on perp funding, and this one isn't. Funding is the obvious thing to build on and the first thing to go when you need it. Ethena demonstrated both halves: sUSDe rode positive funding to around 15% through 2025, then settled back to 3.7% as funding compressed.¹ Build a dollar on funding and you inherit funding's cycle. Here funding is upside on a conversion that already works without it. Fully hedged, per $100 of NAV per year: | Leg | Per year | | ---------------------------------------------- | ----------- | | $90.9 of jitoSOL @ \~7% staking | **+$6.36** | | $9.1 of USDC margin at Phoenix @ 0% | $0.00 | | Funding on the short — *Binance proxy, +3.76%* | +$3.42 | | Funding on the short — ***measured Phoenix*** | **\~$0.00** | | Perp fees + \~6 mode switches | −$0.30 | The staking leg on its own earns more than the vault's entire net APY. Funding contributes about a third of the return in backtest, and close to nothing at the rate Phoenix has actually paid: over the past week its median hourly funding was zero, with 27% of hours positive. A few things follow from that. The correlation profile genuinely differs from both incumbents. RWA dollars move with the Fed. Ethena moves with the crypto leverage cycle. This moves with Solana network activity. And the yield risk that matters is staking-rate compression, not thin funding. When funding is thin the vault parks in USDC lending and still earns. If Solana's staking rate falls there is nothing to park into; the ceiling simply comes down. ### Hedge integrity is the product If the hedge is the mechanism that performs the conversion, then anything able to break the hedge breaks the product. It isn't a risk sitting beside the design; it is a hole in the design. A venue that can halt trading, or auto-deleverage a profitable short to cover someone else's loss, doesn't expose ksUSD to a bad day. It removes the leg that makes the yield a dollar yield while the vault is still holding the jitoSOL. That is why the venue choice carries weight here rather than being a footnote. Phoenix settles on-chain. The vault opens, defends and closes its own hedge by calling the program directly, the position is visible on Solana, and no operator sits between the vault and its own short. None of that removes venue risk, and §VI is specific about what remains. It does put the mechanism somewhere it can be inspected, which is the minimum you should want from the thing the product depends on. ### What the conversion costs Two things, stated rather than blended into a headline number. Every dollar posted as margin is a dollar not earning staking yield. At v1 sizing about **9% of NAV sits at Phoenix as USDC margin earning nothing**, and about **91% is in jitoSOL** earning the staking rate. That drag is already inside every net figure here; it is the difference between jitoSOL's \~7% and the \~6.4% the staking leg actually contributes. The obvious dismissal is that this is a hedged jitoSOL wrapper. The difference is what happens when funding inverts. A naive hedged LST keeps paying to hold its short and bleeds. ksUSD closes and parks in USDC lending, an exit that costs 20–40 bps, is written into the program, and is taken automatically on a signal nobody has to interpret. Parking is the part that isn't a wrapper. ## II. How it works The vault has two modes and one rule for choosing between them. | Mode | Position | Earns | | ---------------- | ---------------------------------------------------------------------------- | ---------------------------------- | | **Normal basis** | long jitoSOL spot (unlevered) + short SOL-PERP on Phoenix at 1×, USDC margin | jitoSOL staking + funding received | | **Parked** | all capital in USDC lending (Kamino) | lending yield (\~4–5%) |
Smoothed perp funding decides the mode: when funding clears the dynamic threshold (near 0%) the vault moves to Normal basis (short plus staking); when funding is below it the vault moves to Parked (USDC lending). Transitions are automatic, driven by the funding signal.

One on-chain signal, smoothed funding, decides the mode.

The rule asks whether the hedge pays for itself, not whether funding is positive. Staking already carries the position, so the basis beats parked lending down to roughly −1.3% funding. The keeper computes that break-even live from the staking-versus-lending spread, and an on-chain floor of zero stops the program shorting into negative funding whatever the keeper concludes. It applies as a ±3% band rather than a line. The vault opens only once funding clears the threshold by the band, and holds until funding falls clearly below it. In a thin regime funding crosses the line constantly, and paying the round-trip switch cost on every crossing is the largest avoidable leak in the design. Transitions run automatically. The smoothed on-chain funding signal decides, a keeper bot executes, and a 7-day mean plus a 12-hour minimum hold filter out the noise. See [Strategy & Modes](/how-it-works/strategy-and-modes.md#when-does-the-vault-turn-the-trade-on). ### Near zero, not zero Four things stop the legs cancelling exactly. The spot leg is jitoSOL while the short is SOL-PERP, so they only offset while the jitoSOL/SOL ratio holds; a depeg is a straight loss. Delta drifts between rebalances. Staking accrual is left unhedged on purpose, since that appreciation is the yield, which leaves the vault carrying a small deliberate net long. And the perp can trade away from spot, with the position marked against the perp. None of this is large in ordinary conditions. It is still enough that "no price risk" would be the wrong claim. See [Risk](/how-it-works/volatility-risk-management.md). ## III. The share, and what it costs ksUSD is a **non-rebasing** share token. Your balance stays fixed and the share price rises as carry accrues. Redemption is against NAV, instant from the liquidity buffer and queued for larger size. It is a share in a hedged carry vault, not a dollar-pegged stablecoin. No fixed yield, no RWA, no emissions, no view on where SOL goes. The architecture is small on purpose: one program, one vault, one rule set. | Fee | Rate | | ------------ | -------------------------------------- | | Management | **0%** | | Performance | **20%, and only above a hurdle** | | Reserve skim | **5% of perf** → on-chain reserve fund | | Withdrawal | **0%** | The hurdle is the USDC lending rate, which is what the same capital would otherwise earn, so the performance fee applies only to what the vault adds on top. Without it the fee took a fifth of the parked leg's return and left a parked holder behind where they'd have been simply lending the USDC. Charging for that is hard to defend. The rate isn't fixed in code. `hurdle_apr_bps` is read from Kamino's live supply APY at deploy and maintained against the smoothed rate afterwards. See [Fees](/reference/fees.md). ## IV. Why this only assembles on Solana The design needs four things on one chain, close enough together to compose: * **An on-chain perp.** The vault opens its hedge by calling into Phoenix Perps with USDC margin from its own program. Phoenix settles on-chain, and that direct call is the part that doesn't port. * **Funding it receives**, rather than a pool borrow-fee it pays. * **A high-yield LST and deep USDC lending.** jitoSOL held unlevered as the spot leg; Kamino for the liquidity buffer and parked NAV. * **Fees low enough** that regular rebalancing stays economic. On Ethereum these don't line up. Gas makes rebalancing expensive, the deepest perps sit off-chain or on separate domains, and LST yield, funding and lending live apart from each other. The spot leg also earns more here. Solana staking plus MEV tips put jitoSOL near 7% against roughly 3% for Ethereum LSTs. Since the staking leg is where the return actually comes from, that gap matters more than the composability argument does. ## V. What the backtest shows Daily resolution, July 2024 to June 2026, spanning the 2025–26 funding compression. The v1 set, normal plus parked, compounded 12.4% net, turning $100 into $112.37, and sat parked on a third of days. | Variant | Net APY | Gross APY | $100 net → | Max DD | | ------------------------ | ----------- | --------- | ----------- | --------------------- | | **Normal + parked (v1)** | **\~6%** | \~7% | **$112.37** | **−0.3%** | | USDC lending benchmark | \~4% | — | — | flat floor | | sUSDe benchmark | \~5% recent | — | — | bleeds in low funding | The drawdown is the number worth reading. Holding a 0.3% peak-to-trough loss through a funding collapse says something about the design. The yield magnitude says something about a regime nobody controls. That 6% is fully loaded. It carries the performance fee, the margin-capital haircut where USDC posted as margin earns nothing, and trading costs. Against USDC lending it leaves a bit under 200 bps of edge in a thin-funding window, scaling toward 11% when funding runs rich. Phoenix launched in December 2025, so the series uses daily Binance SOL-perp funding as a proxy, taken at face value with no multiplier applied — Phoenix anchors its own funding to CEX price feeds, so it tracks the same prices. Mode classification uses a 7-day mean with a ±3% hysteresis band. The perp leg is deliberately over-margined, well inside the venue limit, so about 9% of NAV sits at zero yield. Costs are 5 bps perp fee and 10 bps slippage per side, 20–40 bps per switch. The proxy's weakness deserves stating. Even at face value it flatters the funding leg by a wide margin against what Phoenix has actually paid. The staking leg carries the result, which is the argument in §I, but it does mean the funding contribution should be read as a ceiling rather than a forecast. A single month under stress can also run worse than the modelled 0.3%. Detail: [historical-simulation.md](/reference/historical-simulation.md). ## VI. What can go wrong Share price is NAV divided by shares, marked from on-chain balances and oracle-priced legs. Keeper attestation is bounded by a per-hour change cap and an oracle sanity band, so it cannot mark NAV past what the chain shows. A 10%-of-NAV buffer covers normal redemptions instantly. Larger ones burn at the locked price and settle against realized unwind proceeds through a permissionless crank, which means a queued payout in stressed markets can come in below marked NAV. | Risk | Mitigation | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Smart-contract | Pre-mainnet audit scheduled; devnet only until then. | | **Hedge removed by the venue** | The one that matters most, per §I. A market halt, or auto-deleveraging that force-closes a profitable short to cover another trader's loss, ends the conversion while the vault still holds jitoSOL — leaving it long SOL until it can re-hedge or sell. On-chain settlement means the vault can see and act on this itself, and `emergency_close` can unwind the spot leg once the market is readable, but neither prevents an ADL. Sizing the short at a small fraction of open interest is the main defence, and it is why the deposit cap tracks the venue rather than demand. | | Perp-venue dependency | Phoenix is the only hedge venue, so an exploit, outage, or socialized loss hits ksUSD directly. Phoenix is in private beta, and trader onboarding needs an Ellipsis builder-access grant, which is a live external dependency. A second venue is the structural fix and is not in v1. | | Counterparty | Phoenix, Ember, Kamino, Jupiter, Jito. No single one holds all NAV. The reserve fund absorbs first loss **up to its size, which is small** — see below. | | Oracle | Pyth reads gated by 5-min staleness and 2% confidence; outages past that can still cause loss. | | Staking-rate compression | The primary yield risk. A lower Solana staking rate lowers the ceiling, and parking does not help. | | Funding compression | Secondary. The vault parks and earns \~4%; upside above that isn't guaranteed and is \~0 today. | | jitoSOL depeg | **Marked at market**, via the Pyth jitoSOL/USD feed — so a liquidity discount hits NAV and the share price immediately, not on sale. A discount of `lst_depeg_bps` against the Jito stake pool's redemption rate auto-pauses and arms `emergency_close`. Slashing is unhedgeable, and neither Jito nor any third party reimburses it. | | Liquidation | The short is over-margined and the keeper tops margin up actively. Both are needed: the jitoSOL sits in the vault while the margin sits at Phoenix, so the venue cannot see the collateral backing the short. | | Keeper outage | Buffer withdrawals stay open; rotation and queue processing pause until cranking resumes. Anyone can crank. | Fallbacks are built in. Funding compression parks the vault. Perp-venue trouble triggers an oracle-divergence auto-pause and a permissionless `emergency_close`. A depeg auto-pauses. Wind-down turns the vault into a pro-rata USDC claim. Redemption works whether or not the team is present. ## VII. Position | | Yield source | Behaviour when funding dies | Transparency | Venues | | -------------- | ------------------------------------- | -------------------------------- | ------------------------ | ------------------------------------- | | **ksUSD** | **Staking**, plus funding and lending | Parks at the lending floor | Fully on-chain | Phoenix, Kamino, Jito (Solana-native) | | Ethena (sUSDe) | Delta-hedged perp funding | Yield follows funding down | Off-chain CEX, attested | CEXs + custodians | | MakerDAO / Sky | Stability fees + RWA/savings | Unaffected; tracks rates instead | On-chain + off-chain RWA | RWA counterparties | | Perena (USD\*) | Swap fees + stable yields | Tracks volume instead | On-chain | Solana AMM/DEX | Ethena showed there is real demand for a yield-bearing dollar, and showed what happens when the one source of that yield compresses. The answer here isn't a better funding trade. It is a different engine, with funding as upside rather than foundation. The longer goal is a dollar whose yield comes from the market it lives on, and can be checked against it. *Simulated performance does not predict future results.* ¹ *Ethena figures are directional, per public dashboards from the backtest era.* *** [app.keystonefi.xyz](https://app.keystonefi.xyz) · [docs.keystonefi.xyz](https://docs.keystonefi.xyz) · *Simulated figures only. Not investment advice.*