Skip to main content

​
The core innovation: collateral that never touches a smart contract

In standard on-chain DeFi lending, collateral is locked in a smart contract. The protocol enforces the loan because it physically controls the collateral — a borrower cannot withdraw pledged assets without first repaying. Off-Chain Collateral removes this constraint. The collateral (native SOL, staked SOL, BTC) stays in a regulated custodian account at Anchorage Digital Bank. It never moves on-chain. Three mechanisms replace the smart contract lock: This structure lets institutional borrowers access USDC liquidity against assets they cannot or choose not to put on-chain — native SOL staking positions, BTC held at qualified custodians, or large positions where moving on-chain introduces its own counterparty risk.
Chainlink’s oracle network reads Anchorage’s custody systems directly and publishes the actual collateral balance on-chain in real time. This is what allows Kamino’s smart contract to calculate LTV without the assets ever moving.
The PoR feed is the authoritative source for borrowing capacity — the smart contract trusts this figure, not any borrower-supplied input. What PoR attests:
  • The balance of specific assets in the borrower’s custodial account at Anchorage
What PoR does NOT attest:
  • Solvency of the custodian
  • Quality of custody operations
  • Protection against custodian counterparty failure
PoR is a balance attestation, not a security guarantee. It confirms that assets are present in the account — it says nothing about whether the custodian is operationally sound or solvent.
If the Chainlink feed goes stale, Kamino can pause the relevant market to prevent operations based on outdated data. Multiple independent node operators in the Chainlink network reduce the risk of a single reporting failure triggering a false positive or masking a real LTV breach.

​
Mirror tokens

A mirror token is a synthetic token representing a specific borrower’s custodied collateral. It is minted by Kamino and scoped to that borrower’s isolated market. Key properties:
  • Not traded on any market
  • Not transferable to other protocols or wallets
  • Has no independent value — it is a pure accounting unit
  • Scoped to a single borrower’s isolated Kamino market
When the Chainlink PoR feed attests $10M of SOL in custody, the mirror token represents exactly that $10M. The borrower deposits the mirror token into their isolated Kamino market and borrows USDC against it — up to the maximum 70% LTV. Lifecycle:
The mirror token is not burned at repayment. Once all collateral is withdrawn from Anchorage, the Chainlink PoR feed reports a balance of zero and the token becomes inert rather than destroyed.

​
The Account Control Agreement (ACA)

The ACA is the legal enforcement mechanism for Off-Chain Collateral. It is the functional equivalent of a smart contract lock — applied in the legal domain rather than the technical domain. It is a three-party contract between:
  • Borrower (pledgor) — the institutional entity pledging SOL or BTC
  • Anchorage Digital Bank (custodian) — holds the assets; neutral gatekeeper
  • Kamino / Collateral Agent (secured party) — holds first-priority security interest on behalf of lenders

​
Two operating modes

Under joint control, neither party can move assets unilaterally. The borrower cannot withdraw collateral without Kamino’s approval. Kamino cannot move collateral without cause. Exclusive control is triggered when a borrower breaches the loan agreement — specifically, when LTV exceeds the 75% liquidation threshold. Kamino (through the Collateral Agent, Anchorage Innovations, LLC) issues a Notice of Exclusive Control to Anchorage Digital Bank. From that moment, Anchorage accepts no instructions from the borrower and executes the liquidation under Kamino’s direction.
The ACA is governed under South Dakota law and structured under UCC Article 8, which treats the pledged collateral as a “financial asset” with Anchorage Digital Bank as the “securities intermediary.” This structure perfects Kamino’s first-priority security interest in the collateral.

​
Solana epoch mechanics (staked SOL)

A Solana epoch is the protocol’s ~2-day cycle between which staking rewards are distributed and staking/unstaking events settle. Staked SOL cannot be instantly liquidated. Unstaking requires waiting until the end of the current epoch — a maximum of approximately 2 days. This creates a gap between when a Notice of Exclusive Control is issued and when the collateral can be converted to USDC. Staked SOL liquidation sequence: The LTV parameters for staked SOL — 70% max LTV, 75% liquidation LTV — are set conservatively to account for this window. The 30%+ collateral buffer is intentional: it must absorb potential price movement during the unstaking period.
This is why the LTV for native SOL collateral (which settles instantly) differs from staked SOL (which requires epoch-end unstaking). The collateral type determines how quickly enforcement can complete, which determines how much buffer the protocol requires.
Recovery window: If collateral value recovers sufficiently before a trade is placed, the liquidation can be avoided. However, the SOL remains unstaked for the remainder of that epoch regardless — it cannot be re-staked mid-epoch. Once a trade is booked, it cannot be cancelled.

​
Rolling loans and 3-month terms

Off-Chain Collateral loans operate on fixed 3-month terms. This is structurally different from standard variable-rate DeFi lending. At the end of each 3-month term, the loan auto-renews unless the borrower fully repays or either party initiates termination. The interest rate is renegotiated at rollover. LTV monitoring and liquidation mechanics apply continuously across renewal periods — there is no grace period at the term boundary.

​
Segregated custody and rehypothecation prohibition

​
Segregated custody

The borrower’s collateral is held in a dedicated Pledgor Account at Anchorage Digital Bank. This account is legally and operationally distinct from:
  • Anchorage’s own balance sheet assets
  • Other clients’ custodied assets
Segregation means that if Anchorage were to face insolvency, the borrower’s collateral in the Pledgor Account would not be available to Anchorage’s general creditors. The assets belong to the borrower (subject to the ACA’s security interest), not to Anchorage.

​
Rehypothecation prohibition

Rehypothecation is the practice of a custodian re-using client collateral — lending it out, pledging it, or using it in financing activity. In traditional finance, this is routine and generates returns for custodians. Anchorage is contractually prohibited from:
  • Lending the pledged assets
  • Pledging or encumbering them in any form
  • Using them in any trading or financing activity
This prohibition holds regardless of market conditions or any instruction from the borrower. The collateral must remain inert in the Pledgor Account at all times while the ACA is in force.
Rehypothecation prohibition and segregated custody together mean the collateral has one purpose: backing the loan. It cannot be deployed, loaned, or encumbered elsewhere without breaching the ACA.