Jupiter is the largest DeFi application on Solana, and it has spent the past year expanding far beyond swaps. Guardian has reviewed that expansion as it shipped: nine engagements in ten months across the JupUSD stablecoin, the Offerbook lending market and the Yield Store vault system.
Each of Jupiter’s new product lines has come to Guardian as it was built: a reserve-backed stablecoin, a peer-to-peer lending market, a curated vault system and a referral program for Jupiter Lend. All of it is Solana-native, and each brings failure modes of its own.
Every Jupiter engagement ran the Guardian Standard: three independent passes over the same codebase. Two competing teams battle-test the same scope in parallel, one focused on expert manual review and one driving billions of frontier AI tokens, while an exhaustive invariant suite fuzzes underneath both.
Seven engagements between November 2025 and September 2026 are on the timeline below, with more under way.
jup-stablecoin Solana program · 2,101 source lines · 4 auditors
The JupUSD program end to end, every module from the vault to the oracle. Nine Lows and nine Informational, no Criticals, Highs or Mediums, and Guardian’s highest confidence ranking, 5 out of 5.
Changes to the jup-stablecoin program since the main review
A two-day diff review after remediation: two Lows and two Informational, both Lows resolved.
Diff review · 2 auditors
The second round of stablecoin changes: eleven Informational findings, nothing at Low or above, and a second consecutive 5-out-of-5 confidence ranking.
Peer-to-peer Solana lending · NFT and token collateral · 6,691 source lines
Offerbook is peer-to-peer lending on Solana against NFT and token collateral. Thirty findings on the main review, three of them Medium.
Curated-vault program · 5,694 source lines · two competing teams plus a fuzzing engineer
Jupiter’s curated vault system, with delegates, NAV maths, subscribe and redeem queues, and adapters into Lend, Swap and Offerbook. The largest Jupiter scope, reviewed by two independent teams and a fuzzing engineer.
Severities are still being finalised with Jupiter, so no counts are shown.
Read the report →Referral Solana program · dedicated fuzzing suite
Completed in August: Low and informational findings only, a fuzzing suite with full coverage of the program, and a top-of-the-scale confidence assessment.
Main review · changes since the July engagement
The current engagement: a further three to four weeks of Yield Store changes, in main review now. Nothing is reported yet.
Jupiter names Guardian in its own documentation and hosts the report on its own product domain. Every link below was fetched and verified.
We work closely with our partners to address their most critical security needs: every update reviewed as it ships, every deployment checked before it goes live, by a team that already knows the codebase. Tell us what you’re building and we’ll scope a long-term partnership around it.
Get a quoteWork with Guardian