{"investigation":{"slug":"sanctum","entity_name":"Sanctum","trust_score":72,"severity_base":null,"score_modifier":0,"confidence":0.55,"status":"published","content_type":"investigation","summary":"Sanctum is a Solana liquid-staking infrastructure protocol that lets users stake SOL into validator-specific liquid staking tokens (LSTs) and pool them in the multi-LST Infinity pool (INF). Its governance token, CLOUD, launched in July 2024 via Jupiter LFG. Multiple third-party audits of its programs are listed by the project, and this research found no confirmed exploit or loss event; reported TVL figures vary by source and date, and the requester's ~$1.95B validator-LST figure could not be reproduced exactly.","sections":[{"content":"Sanctum provides Solana liquid-staking infrastructure, including validator-specific LSTs built on the SPL stake pool program and the Infinity (INF) pool that aggregates liquidity across many LSTs. Solana Compass reported on 2026-08-28, citing DeFiLlama data, that Sanctum took the number one TVL position on Solana with about 18 million SOL staked, worth roughly $1.93B, and that Sanctum held 2.72% of circulating SOL. The same article reported 15.44 million SOL at the end of Q1 2026 and a 16.64 million SOL Q2 2026 peak, and Q2 2026 revenue of $880,000, down 39.7% quarter over quarter. A direct query of the DeFiLlama protocol API (undated in the response, retrieved during this investigation) returned approximately $2.07B TVL on Solana for the parent Sanctum entry. The requester's figure of about $1.95B for Sanctum validator LSTs could not be verified from a primary source: the DeFiLlama web page returned HTTP 403 and the sub-protocol breakdown was not read. USD TVL moves with the SOL price, so SOL-denominated figures are more comparable across dates.","heading":"Overview and TVL","sources":[{"url":"https://solanacompass.com/news/sanctum-claims-1-tvl-on-solana-with-18-million-sol-staked-surpassing-jupiter","name":"Solana Compass: Sanctum Claims #1 TVL on Solana","type":"news_article","credibility":2},{"url":"https://api.llama.fi/protocol/sanctum","name":"DeFiLlama API: Sanctum protocol","type":"on_chain","credibility":2}],"severity":"low"},{"content":"Per Sanctum's own announcement (originally dated 2024-06-05), CLOUD has a total supply of 1 billion tokens. Stated allocation: 20% launch liquidity (10% initial airdrop, 10% seeding the Jupiter LFG launch pool), 30% Community Reserve, 11% Strategic Reserve, 25% team, 13% investors (sold at $50M and $60M valuations, mostly in 2021), and 1% to Jupiter LFG. Team and investor tokens are stated to vest over three years with a one-year cliff (33% at one year, the remainder linearly over 24 months). The post states the launch curve was originally set to start at a $50M valuation and was later edited to start at $1M FDV; which applied at launch was not independently confirmed. Concentration risk: team and investor allocations total 38% and are subject to unlock schedules. Current CLOUD price, circulating supply and unlock status were not verified in this research.","heading":"CLOUD token","sources":[{"url":"https://sanctum.so/blog/introducing-cloud-sanctum-governance-token","name":"Sanctum: CLOUD, the Sanctum Governance Token","type":"official","credibility":2},{"url":"https://dlnews.com/articles/defi/solana-project-sanctum-reveals-cloud-token-airdrop-details","name":"DL News: Sanctum reveals CLOUD airdrop details","type":"news_article","credibility":2}],"severity":"medium"},{"content":"According to Sanctum's documentation, the Infinity program was audited by Neodyme, OtterSec and Sec3, and the Sanctum Reserve (unstake) program by Sec3 (2023-07-24 report file). Sanctum LSTs inherit the SPL stake pool program, listed with audits by Halborn, Kudelski, OtterSec, Neodyme and Quantstamp. A Neodyme report on Infinity is hosted on Neodyme's site (the PDF text could not be parsed here, so findings and resolution status were not verified). Program upgrade authority is described as held by a Sanctum multisig (an 11-member multisig for stake pool programs); the swSOL program's upgrade authority is listed as a single address whose type is not stated. Upgradeable programs controlled by a team multisig are a standing trust assumption. No bug bounty was found in the portion of the documentation read. Audits reduce but do not eliminate smart contract risk.","heading":"Audits and security controls","sources":[{"url":"https://learn.sanctum.so/docs/llms-full.txt","name":"Sanctum documentation (full export)","type":"official","credibility":2},{"url":"https://www.neodyme.io/reports/Sanctum-Infinity.pdf","name":"Neodyme: Sanctum Infinity audit report","type":"research","credibility":2}],"severity":"medium"},{"content":"No confirmed exploit, loss of funds, or LST depeg attributable to Sanctum was found in searches. One search result titled as a Sanctum security breach concerned an Astroport/Terra-related event and could not be tied to this Solana protocol, so it is not treated as an incident here. Absence of reports is not proof of absence; DeFiLlama's hack listing was not fully read. General risks of the category apply: LST depegs under liquidity stress, validator slashing or underperformance, and smart contract risk.","heading":"Incidents","sources":[{"url":"https://solanacompass.com/news/sanctum-claims-1-tvl-on-solana-with-18-million-sol-staked-surpassing-jupiter","name":"Solana Compass coverage of Sanctum (no incident reported)","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2024-06-05","event":"Sanctum publishes the CLOUD governance token announcement.","source":"Sanctum blog","source_url":"https://sanctum.so/blog/introducing-cloud-sanctum-governance-token","date_evidence":"The original post was dated June 5, 2024"},{"date":"2024-07","event":"CLOUD launches via Jupiter LFG with airdrop claims (sources cite 16-18 July 2024).","source":"DL News","source_url":"https://dlnews.com/articles/defi/solana-project-sanctum-reveals-cloud-token-airdrop-details"},{"date":"2026-08-28","event":"Sanctum reported as number one Solana protocol by TVL, about 18M SOL (~$1.93B).","source":"Solana Compass","source_url":"https://solanacompass.com/news/sanctum-claims-1-tvl-on-solana-with-18-million-sol-staked-surpassing-jupiter","date_evidence":"according to DeFiLlama data from August 28, 2026"}],"sources_used":[{"url":"https://solanacompass.com/news/sanctum-claims-1-tvl-on-solana-with-18-million-sol-staked-surpassing-jupiter","name":"Solana Compass: Sanctum Claims #1 TVL on Solana","type":"news_article","archive_url":"https://web.archive.org/web/20261013092717/https://solanacompass.com/news/sanctum-claims-1-tvl-on-solana-with-18-million-sol-staked-surpassing-jupiter","credibility":2,"archive_timestamp":"2026-10-13T09:27:17+00:00"},{"url":"https://api.llama.fi/protocol/sanctum","name":"DeFiLlama API: Sanctum protocol","type":"on_chain","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://sanctum.so/blog/introducing-cloud-sanctum-governance-token","name":"Sanctum: CLOUD, the Sanctum Governance Token","type":"official","archive_url":"http://web.archive.org/web/20260420121543/https://sanctum.so/blog/introducing-cloud-sanctum-governance-token","credibility":2,"archive_timestamp":"2026-04-20T12:15:43+00:00"},{"url":"https://dlnews.com/articles/defi/solana-project-sanctum-reveals-cloud-token-airdrop-details","name":"DL News: Sanctum reveals CLOUD airdrop details","type":"news_article","archive_url":"http://web.archive.org/web/20260624195640/https://www.dlnews.com/articles/defi/solana-project-sanctum-reveals-cloud-token-airdrop-details/","credibility":2,"archive_timestamp":"2026-06-24T19:56:40+00:00"},{"url":"https://learn.sanctum.so/docs/llms-full.txt","name":"Sanctum documentation (full export)","type":"official","archive_url":"http://web.archive.org/web/20260718170011/https://learn.sanctum.so/docs/llms-full.txt","credibility":2,"archive_timestamp":"2026-07-18T17:00:11+00:00"},{"url":"https://www.neodyme.io/reports/Sanctum-Infinity.pdf","name":"Neodyme: Sanctum Infinity audit report","type":"research","archive_url":"http://web.archive.org/web/20260117093637/https://neodyme.io/reports/Sanctum-Infinity.pdf","credibility":2,"archive_timestamp":"2026-01-17T09:36:37+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-13T05:18:56.893616+00:00","updated_at":"2026-10-13T09:30:36.259132+00:00"},"source_quality":{"total":6,"tier1":0,"tier2":1,"tier3":0,"unrated":5},"follower_count":null,"content_updated_at":"2026-10-13T05:18:57.126Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}