Aqueduct documentation
Aqueduct is a Solana-native stablecoin yield router. You deposit USDC into a risk tier and receive vault shares. A keeper spreads the vault across whitelisted lending venues on Solana and, through Circle CCTP, other chains, and moves funds only when the expected gain clearly beats the cost. These docs explain how it works, what it can and cannot do with your funds, and how to build on it.
On this page
Status: devnet, not audited#
Aqueduct runs on Solana devnet with a test USDC token that has no value. The program has not been audited, and it is upgradeable by its admin key. Devnet yields are real mainnet rates mirrored into simulated reserves; they are not an offer or a promise of future returns.
Lending venues such as Kamino and Jupiter Lend are not deployed on devnet. Each strategy therefore points at a simulated reserve inside the Aqueduct program that holds real devnet tokens and accrues interest at the venue's live mainnet APY, which the keeper mirrors every cycle. Devnet and mainnet explains exactly what is simulated.
How it works in one minute#
- Deposit
You send USDC to a vault, Bedrock or Rapids, and receive vault shares at the current share price. Shares are an ordinary SPL token in your wallet.
- The keeper allocates
An off-chain keeper moves the vault's USDC between its idle account and whitelisted strategies. The program enforces each strategy's hard cap, and the keeper has no instruction that sends funds anywhere else.
- Yield accrues to the share price
Interest earned by the strategies raises the value of every share. A performance fee of 5% (Bedrock) or 10% (Rapids) is taken only from new gains above the vault's high-water mark. See Fees.
- Withdraw any time
Burning shares returns USDC at the current share price in one transaction. If the idle account is short, the program pulls the rest from strategies in the same transaction. Withdrawals work even while the protocol is paused.
What the program guarantees#
- The keeper can only move a vault's USDC between its idle account and its whitelisted strategies. No instruction lets it withdraw or send funds to any other account, and it cannot touch your shares.
- Each strategy has a cap in basis points of the vault, checked on-chain on every allocation.
- Only the holder of vault shares can redeem them, and redemption is never blocked by the pause switch.
- Fees come out of yield only, above a high-water mark, so a drawdown is never charged twice. There are no deposit, withdrawal or management fees.
What it does not guarantee#
- Any particular yield. Rates come from the venues and change constantly.
- The solvency of the venues. On mainnet a venue exploit or bad debt would reduce the value of the vault's position. See Risks.
- Good judgement by the keeper. Its policy is deterministic and published, but it runs off-chain and the program only bounds it.
- Immutability. The admin can change caps and fees within hard limits, and can upgrade the program. See Security and trust model.
Where to go next#
Live deployment#
The app is at aqueduct.justus.sh and the keeper API at keeper-production-199f.up.railway.app. The on-chain accounts:
| Account | Devnet address |
|---|---|
| Program | BweEZpNS6bhcwjxgEgScgZSWRSkKC9tqmC2PpfZdFbhm |
| Test USDC mint | 3VKJmjmaqvBphZz3zAjUp3kpTQ2dvhqywpSWdt4K1BeL |
| Bedrock vault | AvFAsSxZC55qX65t4Ubzv8yUQmE69YMvzUN9de3mcggt |
| Rapids vault | 9Wu98SsAKvo2JJS8k581zfB31j4NgzZMxFBxSNvhCbXC |
| Config | DyhVHoYVc5W295ukYsyS5bN9iT8E5cDDkj1qfvVTkqmJ |
| Admin | DDVtiUetxxks7LfFUxngLj1jD5huPxmJ9urNCVUKQpvq |
| Keeper | AdnZLxWGSWRVQvfABaF4dBQjzZy25euMYEsDFXYKzaZy |
| Treasury | Hs4RLeoYBs8YtUirjjE8BYaqG596koUWyYMxuJ2GgfEd |
README.md, programs/aqueduct/src/lib.rs and packages/sdk/src/deployments/devnet.json. If the code and this page disagree, the code wins.