Risks

Yield comes from somebody taking risk. Aqueduct spreads and caps that risk; it does not remove it. On devnet the tokens are worthless, so none of this can cost you anything today, but it is what a mainnet version would carry.

On this page

Smart contract risk
Admin key risk
Keeper risk
Venue risk
Depeg risk
Credit and real-world-asset risk
Bridge risk
Rate and oracle risk
Withdrawal timing
Devnet-specific caveats

Smart contract risk#

A bug in the Aqueduct program could let someone take or lock funds, or misprice shares.

What Aqueduct does: Small, single-purpose program; checked arithmetic; strict account validation; an inflation-attack offset; automated reviews of the code.
What remains: No independent audit. The program is upgradeable, so a new version could also introduce bugs. See audit status.

Admin key risk#

One key is both the admin and the program's upgrade authority. Whoever controls it can upgrade the program and so take every vault's funds.

What Aqueduct does: Admin instructions cannot move user funds and are bounded (fee and cap limits). A two-step admin handover is built for the next program version.
What remains: No multisig or timelock. You are trusting the key holder and how the key is stored. See Admin powers.

Keeper risk#

The keeper decides where funds go. A bug, an outage or a stolen key could leave funds in poor or failing venues, or burn bridge fees.

What Aqueduct does: The program limits the keeper to idle and whitelisted strategies within hard caps; it can never withdraw. Withdrawals do not need the keeper.
What remains: While the keeper is down, nobody exits a failing venue. The program has no on-chain rate limit on keeper moves.

Venue risk#

A lending venue can be exploited, take bad debt when collateral crashes, or freeze withdrawals when fully utilised. The vault's position in it would lose value or become stuck.

What Aqueduct does: Whitelisted venues only, risk scores in the optimizer, per-venue caps of 20% to 40% on-chain and 35% in the keeper, and a sentinel that exits on high utilisation, TVL flight, rate spikes and known incidents.
What remains: A sudden exploit can happen between two cycles, and a venue that is fully utilised cannot be exited at all until borrowers repay.

Depeg risk#

Everything is denominated in USDC. If USDC loses its peg, so does the vault. Rapids also holds dollar-like tokens (Perena USD*, Solstice eUSX, Exponent PTs) that can trade below their backing, or below par before maturity.

What Aqueduct does: Bedrock holds only USDC lending positions. Rapids caps each dollar-like token at 20% of the vault.
What remains: USDC issuer risk is not diversified at all. A NAV drawdown rule for the dollar-like tokens arrives with the next keeper release.

Credit and real-world-asset risk#

Kamino RWA lends against tokenised real-world assets and Maple lends to institutions. A borrower default or a problem with the off-chain asset can reach the vault.

What Aqueduct does: Rapids only, risk score 5, capped at 25% each, and disclosed in the tier description.
What remains: Recovery from a real-world default can take a long time and depends on legal processes outside the chain.

Bridge risk#

Cross-chain venues (Aave on Base, Morpho and Maple on Ethereum) are reached through Circle CCTP. A CCTP failure or a destination-chain problem could delay or lose those funds.

What Aqueduct does: CCTP burns and mints native USDC, with no wrapped token or pool. Each chain is capped at 50% of a vault, and withdrawals use Solana venues first. Every cross-chain move must clear a 5 USDC plus 2 bp cost bar at twice its expected value.
What remains: Cross-chain positions cannot be exited instantly. On devnet the bridge is simulated, so this path has never moved real funds.

Rate and oracle risk#

The keeper allocates on rates from venue APIs and DefiLlama. Wrong or manipulated numbers could steer funds to a worse venue or trigger a needless exit.

What Aqueduct does: Implausible rates (outside 0% to 200%) are rejected, rates are smoothed with a clamp on outliers, and the sentinel flags spikes and collapses.
What remains: Rates are not cross-checked across sources, and the on-chain caps are the only hard limit on what bad data can cause.

Withdrawal timing#

Deposits and withdrawals have no minimum-output parameter today, so the share price is whatever it is when your transaction lands.

What Aqueduct does: The share price only moves with accrued interest and fees, so it cannot be pushed around within a block by trading.
What remains: A venue loss between signing and landing would reduce what you receive. Slippage-bounded instructions need the next program upgrade.

Devnet-specific caveats#

Test USDC has no value and can be minted by anyone, up to 10,000 per request.
Devnet itself can be reset or degraded by Solana, and public devnet RPCs rate-limit heavily.
Simulated reserves cannot fail the way real venues can, so devnet results overstate how smooth a mainnet version would be.

Written against programs/aqueduct/src, apps/keeper/src/sentinel/rules.ts and packages/sdk/src/registry.ts. If the code and this page disagree, the code wins.