Solana DeFi
Status: live — the protocol bindings behind the HARVEST accumulation module, all fronted by the nexus-solana venue service. Nexus itself never talks to a chain directly; the AI desk decides, deterministic code caps and simulates, and only the exec plane signs.
| Protocol | Role | As built |
|---|---|---|
| Squads v4 | multisig program | VAULT custody (1-of-2, owner hardware wallets). The exec plane builds ceremonies (spending limit, vault lending, vault stake) and relays owner-signed transactions; no spending limit exists yet, so VAULT↔EXEC moves are owner-signed. |
| Kamino Lend | lending market | USDC supply-only (cTokens, no obligation) on the main and JLP reserves; reserves discovered on-chain and scored; since 2026-09-05 the confirmed hygiene of the owner lending policy — recall at 95 % utilization or liquidity below 10× our position on two sweeps (98.5 % once), repark under 88 %, rotation only on a 2 pp spread sustained ≈ 24 h with a 7-day cooldown (before: single-read 92 / 88 %, rotation ≥ 150 bps). |
| MarginFi | lending market | read + withdraw only — the deposit builder failed on mainnet; not a repark destination until simulation-verified. |
| Jupiter Metis (self-hosted) | swap API on owned LAN infrastructure | quotes and swap transactions for ladder fills, fallback DCA and the SOL↔JitoSOL swap route; signed locally, submitted through the dedicated node. |
| Jupiter Trigger | on-chain limit orders | the desk's resting buys/sells: escrow in an order account owned by EXEC, keeper-filled, re-verified against our node; the sleeve fill-watcher places paired exits automatically. |
| Pyth (PriceUpdateV2 accounts) | oracle | primary SOL/USD and BTC/USD legs, read on the dedicated node; Metis and Coinbase legs feed a quorum/outlier/divergence guard that gates the index. |
| Jito stake pool (SPL stake-pool program) | liquid staking | Tier 0 home for idle SOL. stake_sol/unstake_sol quote DepositSol / instant WithdrawSol against the pool and a Metis swap, and take the better fill. |
| Orca Whirlpools | CLMM | LP positions on coin/USDC pools via the vendored official Rust SDK; open / increase / decrease / collect / close; on-chain fee-growth APR measured over a rolling ~24 h window. |
| Meteora DLMM | CLMM (bins) | LP positions on coin/USDC pools via an anchor-free codama client and a hand-written position layer; venue stats API is down, pools are on-chain-verified but unranked. |
| Meteora dynamic vaults | single-asset vaults | catalogued and scored from virtual price; no executor — vault proposals stay operator-only. |
| Raydium CLMM | — | not integrated. |
Design stance
- One signing process. Of nexus-solana's two deployables, only
nexus-solana-execmounts a key — the EXEC hot wallet. The VAULT is a Squads multisig signed by humans. Under the automation-first custody model EXEC holds the working treasury (float, lending receipts, JitoSOL, LP positions, order escrows); the blast radius of an EXEC-key compromise is the EXEC-side book, which is why a Squads spending limit and an EXEC→VAULT sweep remain the top custody gaps. - Every mutation is simulated first on the owned Solana node; a
simulation error refuses the send — and since 2026-09-05 (
0913342) passes the pre-sign policy gate (pause/kill, USDC depeg, supply-only, slippage, below-basis, per-action / daily USD caps; audit H1). There is no LiteSVM pre-flight — and still no semantic validation of externally built (Metis / Jupiter) transactions before signing, nor any caller authentication on the exec API (audit 2026-09-05 S1, in progress). Network containment of:8091is the union of the chart's NetworkPolicies; the intended callers are worker, core, telegram and ui, but the monitoring namespace could also reach it until thenexus-allow-monitoringpolicy was narrowed on 2026-09-05 (audit S2; see Security → Signer ingress). - Coin/USDC only. LP pairs are SOL/USDC and cbBTC/USDC: a coin/USDC LP
is an automated swing, and since the owner policy of 2026-09-09 it is
budgeted against the LP's own 40% share of NAV (
limits.lp_total_frac), not the desk's 20% swing sleeve — the USDC leg included; the executor enforces only a per-transaction cap, not a cumulative one (audit H5). Five Orca SOL/USDC positions are open as of 2026-09-09 ($17,823, all in range). Non-treasury mints (and therefore Token-2022 transfer hooks) are refused. - Existing code first, official SDKs second. The lending family came
from
prochain-amm-server; the CLMM stack is the official Orca SDK plus a codama Meteora client, both vendored with their provenance recorded. - The platform stays chain-free.
nexus-platformreaches the oracle and exec planes over HTTP from worker jobs; the Telegram approval gate (/approve,/reject,/basis) is the platform's half of execution.