Solve3 risk

Risk and admin roles

Last verified on-chain: October 5, 2026 (Devnet).

Solve3 is running on Solana devnet. Test tokens have no monetary value. This page will be re-verified and updated before any mainnet launch.

Contact: admin@solve3.fi

Who can change what

These are the keys that can affect the protocol today. You can check each one yourself: the program upgrade authority is shown on any Solana explorer under the program account, and the token authorities under the SOLV3 mint.

Program upgrade authority (all three programs)

Held by: 4j3VFftvWC4R2KxbF4R8bJKz2Mxk3m6a2RjkEu8ySVPs, a single team-held key

Can: Replace the code of the SOLV3 token, vesolve (governance) and solve (DEX) programs at any time, with no delay.

Cannot: Nothing on-chain limits it today. This is the largest trust assumption. A 24-hour upgrade timelock is built into vesolve and has been tested, but control has not been handed to it yet.

Protocol admin and DEX fee authorities

Held by: HGUPXpPUhD6PiTSWexebRSsgCT1uDAgiKk2DvdRHsq6o (the epoch keeper's server key)

Can: Advance epochs, route pool fees to gauges, fund emissions, set the emission rate and change pool fee policy.

Cannot: Mint SOLV3 outside the program's rules or upgrade programs. The keeper stops without acting if its authority checks fail.

DEX reward-emissions super authority

Held by: 4j3VFftvWC4R2KxbF4R8bJKz2Mxk3m6a2RjkEu8ySVPs

Can: Control which pools carry SOLV3 reward emissions on the DEX.

Cannot: Change the weekly budget or take earned rewards from LPs.

SOLV3 mint and freeze authority

Held by: Program-derived accounts. No private key exists for either.

Can: Mint only through the token program's rules.

Cannot: Be used by a person to freeze a wallet or mint arbitrarily.

What the audit covers

LedgerOps assessed the ve(3,3) governance programs (the SOLVE token, the core ve(3,3) logic and the veSOLVE vote-escrow NFT) between February 16 and February 27, 2026, and validated the fixes on May 13, 2026. All eight findings (four high, two medium, one low, one informational) are marked closed. Read the report.

It does not cover the swap program. That program is a fork of Orca Whirlpools under Apache 2.0. Orca's audits cover Orca's code. Solve3's additions to it (gauge emissions, activity gates, trading pauses and position events) have not been independently audited. The off-chain keeper and this website were also out of scope.

Known risks

  • Upgrade key: a single key can replace program code until control moves to the timelock.
  • Keeper key: epoch settlement depends on an off-chain server key. If it is offline, epochs and fee routing pause. If it were stolen, the attacker could run the admin actions listed above. The audit recommended secure key storage and multisignature authority for these actions.
  • Unaudited DEX changes: bugs in Solve3's additions to the swap program could affect pools, fees or emissions.
  • Liquidity: positions can lose value against simply holding the tokens and stop earning fees when the price leaves their range. A price range that nobody has used yet needs new tick arrays, a one-time rent of about 0.05 SOL each.
  • Programs are upgradeable and the protocol is new. Do not deposit more than you can afford to lose.

Reporting a problem

Email admin@solve3.fi. Please do not disclose vulnerabilities publicly before we have had a chance to fix them.