Kamino Lend Security Review: Audits, Multisig, and Risk Profile

The Short Version

Kamino Lend is the largest money market on Solana, with about $1.05B in deposits and $916M borrowed as of July 24, 2026. When a Solana DeFi position quotes a lending rate, more often than not it is quoting Kamino.

Size is not safety. A protocol this large is also the biggest single honeypot on the chain, and the whole $1.05B sits behind the same set of contracts, oracles, and admin keys. So the question that matters is not "what does it pay," it is "what breaks it, and who can touch it."

yieldwire scores Kamino Lend at 79, Grade B, with HIGH confidence. That is a strong score, driven by an unusually deep audit history and a clean track record, held back from an A by governance surface area and the concentration risk that comes with being the default venue. Here is the full breakdown.

What You Are Actually Depositing Into

Kamino Lend is a pooled lending market. You supply an asset, borrowers post collateral and draw against it, and your supply rate floats with utilization. The contracts running today are the kamino-lend program, a mature codebase with years of live history and no recorded exploit.

Deposits split across separate markets. The Main market holds the blue-chip assets. Isolated markets wall off riskier or newer tokens so a long-tail asset cannot bleed into the core pool. This matters for a security read, because your risk is scoped to the market you are in, not the whole protocol. A depositor in the Main market USDC pool does not inherit the parameters of a memecoin isolated market.

Most of the TVL is collateral, not lending supply. The largest pools by size are assets like USDe, dSOL, and JLP that users post to borrow against, and those report near-zero supply APY because the yield lives in the token or the borrow demand is thin. The rates that matter to a lender sit in the stablecoin and SOL pools.

Rates pulled from on-chain data on July 24, 2026, and float continuously with utilization. Treat them as a snapshot.

The Audit History

This is where Kamino earns most of its score. Very few Solana protocols have an audit trail this deep, and Kamino publishes all of it in a public repository at github.com/Kamino-Finance/audits rather than citing reports nobody can read.

The reviews come from four independent angles. OtterSec ran manual review and, more importantly, formal verification of the lending program, mathematically proving that specific invariants hold rather than just reading the code for known bug patterns. Certora performed formal verification as well and caught a precision-loss issue in the interest math, the kind of rounding bug that stays invisible until it compounds into a real imbalance. Offside Labs audited Scope, the oracle layer that feeds prices into the protocol. Sec3 contributed automated and manual analysis with Solana-specific tooling.

Why four firms matters: each methodology catches a different class of bug. Manual review finds logic errors a fuzzer misses. Formal verification proves properties a manual reviewer cannot exhaustively check by hand. Automated analysis sweeps for known anti-patterns at scale. Kamino did not pick one and call it done, and the formal verification piece in particular is rare on Solana. yieldwire counts nine audits plus formal verification in its methodology, which is why the safety sub-score lands at 84.

The honest caveat: audits reduce risk, they do not remove it. Formal verification proves the code does what the spec says. It cannot prove the spec is what you wanted, and it cannot cover economic attacks that stay within the rules. A clean audit history is necessary, not sufficient.

The Oracle Stack

Every lending protocol lives or dies on its price feeds. If the oracle is wrong, healthy positions get liquidated and underwater positions do not, and the pool takes the loss either way. Oracle failure is the single most common way a well-audited money market still loses money.

Kamino prices collateral through Scope, its own oracle aggregator, which cross-references Pyth and Switchboard rather than trusting a single feed. On top of the raw prices it applies time-weighted and exponentially-weighted averaging, plus price bands that reject anomalous quotes that jump too far from the recent range. There are also staleness checks, so a feed that stops updating gets flagged instead of blindly trusted.

The design is defensive, and the fact that Offside Labs audited Scope separately is a good sign. The trade-off is worth naming: staleness protection prevents liquidations on bad prices, but it also freezes risk management during an oracle outage. If feeds go stale in a fast market, the protocol stops liquidating to avoid acting on bad data, which is the correct call, but it means risk sits unmanaged until prices resume. That is a deliberate choice, not a flaw, and it is the standard failure mode to understand before sizing a large position here.

How Liquidations Fire

Kamino uses partial liquidations. When a position breaches its liquidation threshold, on-chain liquidators can repay part of the debt and claim collateral at a bonus, rather than closing the entire position at once. The liquidation bonus runs roughly 3 to 6% depending on how risky the collateral asset is.

Partial liquidation is the depositor-friendlier design. It nudges a position back to health without dumping the full collateral into the market in one transaction, which softens the price impact and the cascade risk that took down older Solana lenders in stress events. The liquidation bonus is the incentive that keeps a competitive bot market watching positions around the clock, and a deep liquidator market is itself a safety feature, because the failure case for any lender is a position going underwater with nobody willing to liquidate it.

For a borrower, the practical read is that liquidation is not all-or-nothing, but it is not gentle either. A 3 to 6% haircut on the liquidated portion is real, and in a fast SOL move the oracle averaging that protects the pool can also mean your position is marked slightly behind spot.

Admin Keys and Governance

This is where the score comes down from an A. No matter how clean the code is, someone can change the parameters, and you need to know who and how fast.

Market administration is held by a Squads multisig, the standard institutional-grade setup on Solana, which removes the single-key risk that has rugged smaller protocols. Risk parameters like borrow caps and loan-to-value ratios are governed through the KMNO token and moved via published forum proposals, with per-asset parameters documented publicly.

Two things keep this from being perfect. First, the admin keys can adjust risk parameters, and a multisig is far better than a single signer but is still a trusted set of humans who can change the rules your deposit lives under. Second, public documentation on an enforced on-chain timelock, a mandatory delay between a parameter change being approved and taking effect, is thin. A timelock is the feature that gives depositors a window to exit before a change lands, and its absence or ambiguity is exactly the kind of governance surface area that caps a score in the B range rather than the A range. If you are running size here, this is the item to verify against the live on-chain config yourself.

The yieldwire Security Score

Putting it together, here is how the score is built.

The composite of 79 puts Kamino near the top of the Solana lending set, above Jupiter Lend at 75 and well clear of the auto-scored long tail. The HIGH confidence tag matters as much as the number: it means the score rests on verifiable audits and years of on-chain history, not on an automated estimate.

The one risk the number does not fully capture is concentration. Kamino being the default lender means a disproportionate share of Solana DeFi routes through these contracts. A problem here is not contained to Kamino depositors, it ripples through every protocol that composes on top. That is a systemic point about the chain, not a knock on the code, but it belongs in any honest read of what you are exposed to.

Bottom Line

Kamino Lend is about as safe as a large on-chain money market gets on Solana today. The audit history is deep and public, the oracle stack is layered and defensively designed, liquidations are partial and depositor-friendly, and control sits behind a Squads multisig instead of a single key. That is the case for the Grade B and the HIGH confidence.

The reasons it is a B and not an A are governance and concentration, not code quality. Admin keys can move risk parameters, on-chain timelock protection is not clearly documented, and the protocol's size makes it the chain's single biggest point of failure. None of that is a reason to avoid it. All of it is a reason to size positions with eyes open and verify the live parameters before committing real capital.

See the full breakdown on the Kamino Lend protocol page, compare live rates on the yields page, read how every grade is built on our security methodology, and size any position with the calculator.

---

TVL ($1.05B) and borrow ($916M) figures pulled from DeFiLlama on-chain data as of July 24, 2026. Supply APYs pulled from on-chain lending data the same day and float continuously with utilization. Audit history sourced from Kamino's public audit repository and verified against the auditing firms' published reports. Security scores derived from yieldwire's scoring methodology. Governance and oracle details reflect published documentation and may change through governance; verify live on-chain configuration before sizing a position. This is not financial advice.