Transfer Ownership to a Multisig

Every production market should be owned by a multisig. The recommended setup is Squads v4 with a hardware-wallet signer set and a timelock. Transfer is a deliberate two-step on-chain process designed to prevent typos from locking you out.

All Kamino-deployed markets use Squads v4 with a 12-hour timelock on SOL/BTC Market and shorter timelocks on satellite markets. Curator markets should match this posture before opening to external users.

How the transfer works

The LendingMarket account has two owner-related fields:

Field	Role
`lending_market_owner`	The active owner. Authorized to update the market and reserves.
`lending_market_owner_cached`	A staging slot. The current owner sets it; only that cached pubkey can finalize the swap.

The transfer runs in two steps. First, the current owner sets lending_market_owner_cached to the multisig pubkey. The active owner doesn’t change yet; only the staging slot moves. Second, a signer at the new owner address (the multisig itself) calls update-lending-market-owner, which copies the cached value into the live lending_market_owner and finalizes the transfer. The split exists so a typo in the cached pubkey is recoverable: the current owner can re-set the cached field as many times as needed before promotion. Only the second step is irreversible from your side.

SDK
API
Kamino CLI

Transfer ownership via SDK

The SDK exposes updatePendingLendingMarketAdminIx for step 1 and updateLendingMarketOwnerIxs for step 2.

Initialize KaminoManager and fetch the market

import {
  createSolanaRpc,
  createSolanaRpcSubscriptions,
  address,
  generateKeyPairSigner,
  pipe,
  createTransactionMessage,
  setTransactionMessageFeePayerSigner,
  setTransactionMessageLifetimeUsingBlockhash,
  appendTransactionMessageInstructions,
  signTransactionMessageWithSigners,
  sendAndConfirmTransactionFactory,
} from '@solana/kit';
import {
  KaminoManager,
  DEFAULT_RECENT_SLOT_DURATION_MS,
  PROGRAM_ID,
  MarketWithAddress,
  noopSigner,
} from '@kamino-finance/klend-sdk';
import { LendingMarket } from '@kamino-finance/klend-sdk/dist/@codegen/klend/accounts';
import { parseKeypairFile } from '@kamino-finance/klend-sdk/dist/utils/signer.js';

const initialAdmin = await parseKeypairFile('/path/to/current-owner.json');

const rpc = createSolanaRpc('https://api.mainnet-beta.solana.com');
const rpcSubscriptions = createSolanaRpcSubscriptions('wss://api.mainnet-beta.solana.com');

const kaminoManager = new KaminoManager(rpc, DEFAULT_RECENT_SLOT_DURATION_MS, PROGRAM_ID);

const marketAddress = address('<MARKET_ADDRESS>');
const newOwnerAddress = address('<SQUADS_MULTISIG_PUBKEY>');

const marketState = await LendingMarket.fetch(rpc, marketAddress);
if (!marketState) throw new Error('Market not found');
const marketWithAddress: MarketWithAddress = { address: marketAddress, state: marketState };

Step 1 — cache the new owner

const ix1 = kaminoManager.updatePendingLendingMarketAdminIx(
  initialAdmin,
  marketWithAddress,
  newOwnerAddress,
);

async function buildAndSendTx(signer: any, ixs: any[]) {
  const { value: blockhash } = await rpc.getLatestBlockhash({ commitment: 'finalized' }).send();
  const signed = await signTransactionMessageWithSigners(
    pipe(
      createTransactionMessage({ version: 0 }),
      (tx) => setTransactionMessageFeePayerSigner(signer, tx),
      (tx) => setTransactionMessageLifetimeUsingBlockhash(blockhash, tx),
      (tx) => appendTransactionMessageInstructions(ixs, tx)
    )
  );
  await sendAndConfirmTransactionFactory({ rpc, rpcSubscriptions })(signed, {
    commitment: 'confirmed',
  });
}

await buildAndSendTx(initialAdmin, [ix1]);
console.log('Pending admin set to', newOwnerAddress);

Step 2 — promote the cached owner

This step must be signed by the new owner (the multisig). For a multisig, build the transaction with noopSigner(newOwnerAddress) and submit it as a Squads proposal.

// Re-fetch the market state — its lending_market_owner_cached is now the new owner
const updatedMarketState = await LendingMarket.fetch(rpc, marketAddress);
if (!updatedMarketState) throw new Error('Market not found');
marketWithAddress.state = updatedMarketState;

const newOwnerSigner = noopSigner(newOwnerAddress);
const ix2 = kaminoManager.updateLendingMarketOwnerIxs(marketWithAddress, newOwnerSigner);

// For a hot-wallet test (e.g., on staging), if the new owner is a real keypair,
// load it as a signer and submit directly:
// const newOwnerKp = await parseKeypairFile('/path/to/new-owner.json');
// await buildAndSendTx(newOwnerKp, [ix2]);

// For a Squads multisig, encode the transaction as base58 and submit it as a proposal.

The full working example lives at klend-sdk/examples/klend-examples/example_change_market_admin.ts.

Ownership transfer is not available via the REST API. The Kamino API supports reading admin metadata; ownership transfer is an admin operation available through the SDK or Kamino CLI.

To transfer ownership, use the SDK or Kamino CLI tabs.To inspect current ownership, query the on-chain LendingMarket account directly or use:

yarn kamino-manager get-market-or-vault-admin-info --address <MARKET_ADDRESS>

Transfer ownership via CLI

Step 1 — cache the new owner

yarn kamino-manager download-lending-market-config \
  --lending-market <MARKET_ADDRESS>

Edit the downloaded config at ./configs/<MARKET_ADDRESS>/market-<MARKET_ADDRESS>.json, set:

{
  "lending_market_owner_cached": "<SQUADS_MULTISIG_PUBKEY>"
}

Inspect, then apply:

yarn kamino-manager update-lending-market-from-config \
  --lending-market <MARKET_ADDRESS> \
  --lending-market-config-path ./configs/<MARKET_ADDRESS>/market-<MARKET_ADDRESS>.json \
  --mode inspect

yarn kamino-manager update-lending-market-from-config \
  --lending-market <MARKET_ADDRESS> \
  --lending-market-config-path ./configs/<MARKET_ADDRESS>/market-<MARKET_ADDRESS>.json \
  --mode execute

Step 2 — promote the cached owner

This step must be signed by the multisig (the address you cached in Step 1). From the multisig, propose a transaction that calls update-lending-market-owner:

yarn kamino-manager update-lending-market-owner \
  --lending-market <MARKET_ADDRESS> \
  --mode multisig \
  --multisig <SQUADS_MULTISIG_PUBKEY>

The CLI prints a base58 transaction. Submit it as a Squads proposal, collect signatures, execute. After execution, lending_market_owner equals your multisig.

After Step 2 completes, the original hot wallet has no authority over the market. Verify the multisig signer set, the threshold, and the timelock before promoting. The program does not enforce a recovery path if you lose access to the multisig.

All subsequent operations use multisig mode

yarn kamino-manager update-reserve-config \
  --reserve <RESERVE_ADDRESS> \
  --reserve-config-path ./configs/config.json \
  --mode multisig \
  --multisig <SQUADS_MULTISIG_PUBKEY>

The CLI returns the base58 transaction. Submit, sign, wait out the timelock, execute.

Setting up the Squads multisig

A short walkthrough; full documentation lives at Squads docs.

Create the Squad

On squads.so, create a new Squad. Choose your signer set (hardware wallets recommended for production) and a signature threshold (e.g., 3-of-5).

Configure a timelock

In Squad settings, enable a transaction timelock. Kamino’s reference is 12h for SOL/BTC Market, 4h for satellite markets. Pick the value that fits your operational tempo and incident-response posture.

Fund the Squad

Send a small amount of SOL to the Squad’s vault address to cover transaction fees on proposals.

Note the Squad pubkey

Use the Squad’s vault address as the multisig pubkey passed to the SDK / CLI.

Verifying transactions before signing

A common pattern among security-conscious curators is to recompute the transaction locally and compare its hash to the proposal in Squads. Before signing a proposal:

Re-run the same SDK code (or CLI command with --mode multisig)
Compare the printed base58 transaction to what’s surfaced in the Squads UI
Sign only if the bytes match exactly

This guards against compromised proposals.

Rotating the multisig later

To move ownership to a new multisig after the first transfer is complete, repeat the two-step flow:

The current multisig submits a proposal that updates lending_market_owner_cached to the new multisig.
The new multisig submits a proposal that calls update-lending-market-owner.

The same protections apply: you can re-set the cached field as many times as you want before the second step finalizes.

Reference

Market settings — the broader market-level config flow
Market config reference — lending_market_owner and lending_market_owner_cached fields
market-operations CLI reference — full CLI flag detail
Squads docs

Get started

Market setup

Reserve setup

Optional features

Day-2 operations

Data & integration

Reference

Transfer Ownership to a Multisig

How the transfer works

Transfer ownership via SDK

Transfer ownership via CLI

Step 1 — cache the new owner

Step 2 — promote the cached owner

All subsequent operations use multisig mode

Setting up the Squads multisig

Verifying transactions before signing

Rotating the multisig later

Reference

​How the transfer works

​Transfer ownership via SDK

​Transfer ownership via CLI

​Step 1 — cache the new owner

​Step 2 — promote the cached owner

​All subsequent operations use multisig mode

​Setting up the Squads multisig

​Verifying transactions before signing

​Rotating the multisig later

​Reference

How the transfer works

Transfer ownership via SDK

Transfer ownership via CLI

Step 1 — cache the new owner

Step 2 — promote the cached owner

All subsequent operations use multisig mode

Setting up the Squads multisig

Verifying transactions before signing

Rotating the multisig later

Reference