# Whitepaper *Keystone Finance · Whitepaper v1.0 · May 2026 · by Kamran Choudhry* *** **ksUSD is a bidirectional-carry dollar for Solana.** Its yield comes from carry that Solana's capital markets already generate — perp funding, staking yield, and lending spreads — not from token emissions or off-chain Treasury bills. ksUSD collects that carry in both directions and pays it through the share price, with every position verifiable on-chain. Deposit USDC, hold ksUSD. The share price drifts up as Drift SOL-PERP funding, jitoSOL staking, and Kamino USDC lending accrue into one Anchor vault — **one program · one vault · one share mint.** **Target \~11% net APY after fees and collateral haircuts.** The 51-month backtest runs to 15.7% gross. In dead-zone funding, yield floors near 4–5%. This is a model, not a promise. *** ## I. What ksUSD is Solana's markets generate carry continuously. A perp market pays funding from one side to the other every hour. A liquid-staking token (LST) like jitoSOL compounds every epoch. A lending market reprices credit every slot. The carry is real and ongoing, but it goes uncollected by the dollars parked on top of it. The few dollars that *do* pay yield source it externally — from token emissions or off-chain Treasury bills — not from the chain's own activity. ksUSD collects that carry, hedged so SOL price moves cancel, and pays it through the share price. One asset, one share class, three carry sources. ## II. How it works ksUSD is a rules-based engine that allocates capital across three regimes — NORMAL, REVERSE, and PARKED — based on the funding rate alone. No discretion, no manually-timed trades. A single signal drives the state, gross SOL exposure stays ≈ 0 in every regime, and transitions gate on a **7-day rolling funding mean** (the primary whipsaw filter), confirmed by a **12-hour minimum hold per mode.** ``` USDC deposit │ ▼ Keystone Finance │ ▼ Regime engine (funding-rate state machine) ┌────────────────┼────────────────┐ ▼ ▼ ▼ NORMAL PARKED REVERSE f ≥ +2% −12% < f < +2% f ≤ −12% short SOL-PERP USDC lending long SOL-PERP + jitoSOL (carry < cost) + Kamino borrow └────────────────┼────────────────┘ ▼ Carry accrual (funding + staking + lending) │ ▼ ksUSD NAV ↑ (share price) ``` | Regime | Trigger (*f*) | Collateral | Perp leg | Carry sources | | ----------- | ------------- | ---------------------------------------------- | ----------------------- | ----------------------------------------------------- | | **NORMAL** | ≥ +2% | *N* jitoSOL on Drift | Short *N* SOL-PERP @ 1× | jitoSOL staking + funding received | | **REVERSE** | ≤ −12% | USDC on Kamino → borrow *N · L* jitoSOL, sell | Long *N · L* SOL-PERP | USDC lending + funding received − jitoSOL borrow cost | | **PARKED** | otherwise | All capital in USDC lending (Kamino, Marginfi) | — | USDC lending only | *N* = SOL-equivalent notional. *L* = 0.45 = Kamino jitoSOL loan-to-value (LTV); *N · L* is the leveraged amount in **REVERSE**. Mode switches cost ≈ 20–40 bps round-trip (swap + perp open/close). **Triggers are cost-anchored, not tuned.** The **+2%** NORMAL threshold clears Drift's round-trip perp fee (\~10 bps) plus the amortized mode-switch cost before the basis pays. The **−12%** REVERSE threshold has to clear all of that *plus the reverse leg itself* — the jitoSOL borrow rate (the lender's foregone \~5.8% staking yield plus Kamino's spread), scaled by leverage *L* = 0.45, roughly 2–3% APR drag. That extra cost is why the negative threshold sits so much deeper than the positive one. Designs that ignore it work in only one regime. **The dead zone is a feature.** When funding sits between −12% and +2%, the basis trade doesn't clear its costs, so ksUSD doesn't run it — it parks in USDC lending and earns the floor. A protocol that forces the trade in every regime is choosing to lose money in some of them. *Refusing to trade is a position.* ### What happens, mode by mode **NORMAL.** Deposit comes in; the vault swaps USDC → jitoSOL, posts it as Drift collateral, opens a SOL-PERP short at 1× notional. Funding accrues to the short hourly; jitoSOL staking accrues to the collateral every epoch. Gross SOL exposure ≈ 0. NAV rises. **REVERSE.** Vault posts USDC on Kamino, borrows jitoSOL against it at 0.45 LTV, sells the jitoSOL, and opens a SOL-PERP long on the leveraged notional. With funding negative, the long *receives* funding. Net carry = funding received + USDC lending − jitoSOL borrow cost. NAV rises when that net clears costs; otherwise the engine falls back to PARKED. **PARKED.** All capital sits in USDC lending at \~4–5% APR until funding clears its costs again. ## III. The ksUSD share **ksUSD is** a non-rebasing share token — your balance is constant; the share *price* rises as carry accrues. Redeemable against vault NAV: instant from the liquidity buffer, queued for larger size. Backed by carry from Solana market structure, every position verifiable on-chain. **ksUSD is not** a $1-pegged stablecoin · a fixed-yield product · a Treasury-bill or RWA wrapper · an emission-subsidized token · a fiat-backed bank deposit · a directional bet on SOL. The architecture is small on purpose — one program, one vault, a rule set you can read in an afternoon. Every dollar of attack surface is a dollar you have to defend; every discretionary lever is a place a human can be wrong or compromised. Complexity belongs in the market structure, not the protocol. ### Yield sources & fees Fees hit net-new gains above the high-water mark only — capital pays no rent, exits pay no toll. | Source | Active when | Contribution | | --------------- | ------------------------- | ------------ | | Drift funding | Normal & reverse modes | 5–15% APR | | jitoSOL staking | Normal mode collateral | \~5.8% APR | | USDC lending | Buffer + reserve + parked | \~4–5% APR | | Fee | Rate | Notes | | ------------ | ----------------- | ---------------------- | | Management | **0%** | Capital pays no rent. | | Performance | **20% above HWM** | Net-new gains only. | | Reserve skim | **5% of perf** | On-chain reserve fund. | | Withdrawal | **0%** | Instant or queued. | ## IV. Why this works on Solana, and only on Solana The design needs five things to sit on the same chain at once. Solana is the only chain where they all do. * **Integrated capital markets in one composability domain.** A deep perp market (Drift), an LST accepted as collateral (jitoSOL), and a lending market against the same asset (Kamino) — all callable atomically from one on-chain program. The hedge opens, the collateral posts, and the borrow settles in a single transaction. * **Real funding-rate perps.** Drift settles funding on-venue, on-chain — a genuine two-sided funding stream you *receive*, not a pool borrow-fee you *pay*. * **Borrowable LST liquidity.** jitoSOL is both collateral and borrowable on Kamino — the precondition for the reverse leg. * **Low-cost rebalancing.** Per-transaction fees are fractions of a cent, so frequent, disciplined hedging is economic. * **Composability speed.** Atomic on-chain settlement means the whole position can be reasoned about and unwound in one place. **Ethereum and L2s are structurally weaker here:** gas makes frequent rebalancing uneconomic; the deepest perp venues are off-chain-matched or live on separate domains, so they aren't atomically composable from a single contract; and LST collateral, perp funding, and lending are not co-located. The edge is the co-location — and it is Solana-specific. ## V. Performance — V2 daily backtest (Feb 2022 – Apr 2026, 51 months) | Variant | Gross APY | Net APY | Modeled max DD | | ------------------------------------------ | --------- | ---------- | -------------------------------- | | V2 standard-only (V1 product scope) | 19.82% | **15.57%** | −0.57% | | V2 bidirectional | 20.04% | **15.73%** | −0.96% | | Public conservative claim (after haircuts) | — | **\~11%** | — | | sUSDe benchmark | 6.7% | 5.4% | bleeds in low-funding | | USDC lending benchmark | — | \~4% | flat floor (capital alternative) | The model nets the 20% performance fee. The **\~11% public claim** further deducts jitoSOL's \~80% Drift collateral haircut and execution friction not in the model. USDC lending is the relevant comparison — the actual alternative for the same capital — and ksUSD's parked floor is roughly that rate. **Reverse adds only \~16 bps in backtest** because it fires on just 2–4% of days; its value is regime coverage, not headline alpha. The sUSDe figure is a directional benchmark from public dashboards, not a like-for-like backtest. **Methodology:** * *Funding data.* Drift's public S3 archive for 793 of 1550 days (Nov 2022 – Jan 2025, on-venue); Binance SOL-USDT × empirical 2.37×/0.10× ratio elsewhere (calibrated on 22 overlap months). * *Mode classification.* 7-day rolling mean — the primary whipsaw filter. * *Costs.* Per-side perp fee 5 bps + 10 bps slippage; tiered 20–40 bps mode-switch cost — Drift's actual fees plus empirical slippage. * *Drawdown caveat.* Modeled max DD is funding-only and excludes perp-leg price impact. Realistic worst month under stressed slippage is **−2% to −5%** — the honest tail, not the model's ≈ −0.6%. Full ladder + bidirectional comparison: [historical-simulation.md](/reference/historical-simulation.md). ## VI. Resilience — redemption, risks, the worst day A serious allocator's first question is "how do I get out." The second is "what happens when the world breaks." This section answers both, in that order. Nothing is left out because it looks bad. ### Redemption * **NAV accounting.** Share price = vault NAV ÷ shares outstanding. NAV marks from on-chain balances plus oracle-priced collateral. Keeper-attested position legs are bounded by a per-hour change cap and an oracle-derived sanity band — the keeper cannot mark NAV past what the chain can prove. * **Instant path.** A 10%-of-NAV liquidity buffer absorbs the typical redemption in one transaction at the live share price. * **Queued path.** Larger redemptions burn shares immediately at the locked share price; a permissionless crank then unwinds the position, pays out USDC, closes the request PDA, and refunds rent. * **Stressed-market slippage.** Queued payouts settle against realized unwind proceeds. In stressed markets, perp-leg price impact and swap slippage can reduce the realized payout versus the marked NAV. Disclosed, not hidden. ### Risks | Risk | Mitigation | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Smart-contract | Pre-mainnet audit (OtterSec / Sec3 / Neodyme) scheduled. Devnet only until audit complete. Do not deploy significant capital pre-audit. | | Perp-venue dependency | Drift is the only Solana perp venue that supports this design. A Drift exploit, outage, or socialized-loss event hits ksUSD directly. This single-venue dependency is our edge and our risk. We own it. | | Swap router | Jupiter V6 routes every USDC↔jitoSOL swap. Slippage is bounded on-chain. An outage stalls mode rotation; buffer redemptions stay open. | | Counterparty | Drift, Kamino, Marginfi, Jupiter, Jito. Position-mode design bounds exposure — no single counterparty holds all NAV at once. Reserve fund absorbs first-loss within its size. | | Oracle | Pyth SOL/USD reads gated by 5-minute staleness and 2% confidence checks. Outage past those bounds can still cause loss. | | Funding compression | Parked regime earns only \~4–5% USDC APR — still positive, below headline target. The \~11% target is not guaranteed in dead-zone regimes. | | Liquidity withdrawal | Buffer + queue absorb normal flow; an extended liquidity drought lengthens the queue and widens unwind slippage. | | Redemption queue | Queued redemptions settle against realized unwind proceeds, not marked NAV — stressed markets can reduce the payout. | | jitoSOL depeg | NAV marks jitoSOL at the stake-pool rate — depeg hits NAV only on realized sales. A 5% depeg triggers auto-pause, arming permissionless `emergency_close`; the 5% reserve fund absorbs typical depeg losses (\~50–150 bps). Jito slashing risk is unhedgeable — we accept it as structural. | | Borrow-rate spike | A jitoSOL borrow-rate spike compresses or inverts REVERSE economics; the engine falls back to PARKED rather than running a negative-carry leg. | | Liquidation | Drift leverage and Kamino LTV carry liquidation risk in extreme rapid moves. Continuous health monitoring, auto-deleverage, and the drawdown guard cap but do not eliminate the tail. | | Regime-transition | Mode switches cost 20–40 bps and can mistime fast funding flips; the 7-day mean + 12-hour minimum hold trade a little latency for far less whipsaw. | | Keeper outage | Buffer withdrawals stay open; mode rotation and queue processing halt until cranking resumes. Any wallet can step in as keeper. | ### Failure modes — engineered fallbacks, not hope * **Extended funding compression** → engine sits in **PARKED**, earning the \~4–5% USDC floor until carry clears costs. No forced trade. * **Perp-venue instability** → auto-pause on oracle divergence; permissionless `emergency_close` unwinds the position; buffer redemptions stay open. * **Liquidity fragmentation** → instant buffer for normal flow, queued crank for the rest; payouts track realized proceeds. * **Collateral impairment (jitoSOL)** → depeg auto-pause past the 5% threshold; reserve skim absorbs realistic losses; realized-only NAV impact. * **Sustained negative carry** → REVERSE while it clears costs, else PARKED. Never a negative-carry leg held for its own sake. * **Terminal: wind-down.** Positions unwind in order; the vault becomes a pro-rata USDC claim at the locked share price. Redemption works **independent of the team being present or solvent.** You exit on day one or day worst. ## VII. Position and outlook | | Collateral | Yield source | Regime coverage | Transparency | Venue dependencies | | -------------- | ----------------- | -------------------------------------- | ---------------------------- | ----------------------------------------- | --------------------------------- | | **ksUSD** | jitoSOL / USDC | Perp funding + staking + lending carry | Bidirectional + parked floor | Fully on-chain, every position verifiable | Drift, Kamino, Jito — Solana-only | | Ethena (sUSDe) | ETH/BTC + stables | Delta-hedged perp funding + staking | Long-basis only | Off-chain CEX positions, attested | Multiple CEXs + custodians | | MakerDAO (DAI) | Crypto + RWA | Stability fees + RWA / savings rate | n/a (not a carry product) | On-chain + off-chain RWA | RWA counterparties | | Sky (USDS) | Crypto + RWA | Sky savings rate (RWA / T-bills) | n/a (not a carry product) | On-chain + off-chain RWA | RWA, multichain | | Perena (USD\*) | Stablecoin basket | Swap fees + underlying stable yields | n/a (not a carry product) | On-chain | Solana AMM/DEX | Ethena proved the demand for a yield-bearing dollar — and exposed the limit of a one-directional design. Through 2025, sUSDe rode positive funding to \~15% yields; as funding compressed, supply fell from roughly $15B to $5.4B and yield to \~3.7%.¹ Long-basis carry is real but cyclical: it pays in a bull and starves in the flat. ksUSD runs both ways and earns the floor when neither pays. The longer arc is monetary infrastructure: a dollar whose yield is sourced from, and verifiable against, the market structure of the chain it lives on. Keystone Finance makes that carry collectible; ksUSD is the asset that earns it. ksUSD is productive collateral for Solana — other protocols hold it, lend against it, build on it. > **Stablecoins optimize for settlement. ksUSD optimizes for carry coordination.** > > **Keystone turns Solana market structure into a monetary asset.** *Simulated performance does not predict future results.* ¹ *Ethena figures are directional, per public dashboards from the same era as the backtest window.* *** [app.keystonefi.xyz](https://app.keystonefi.xyz) · [docs.keystonefi.xyz](https://docs.keystonefi.xyz) · *Simulated figures only — not investment advice.* --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.keystonefi.xyz/reference/whitepaper.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.