Security and Protocol Controls

This page lists controls in source. It does not certify a firm audit or a bounty.

Program controls

Control	Scope
PDA seeds + bumps	Every protocol account
Two-step admin	`propose` / `accept`
Operating modes	Pause borrows or halt
Measured transfers	Never trust the requested amount alone
Accounted reserve cash	Donations do not inflate vTokens
Full-set health scan	Borrow, withdraw, swap, Lite, liquidate
Pyth gates	Feed id, age, confidence, owner
Share rounding	Against the taker (lender down, borrower up)
1.10 threshold	Strict inequality
Lite allowlist	Only admin-registered Kamino accounts
Token-2022 fees	Deltas, not requested amounts
Close factor 50%	Partial liquidation

Wallet adapter / Privy signs. Faucet and fork oracle refresh are demo privileges. Do not ship those cheatcodes on public mainnet RPC.