Protocol
Risks
What can go wrong with Plumb, for borrowers, depositors and holders of PLMB. Read this before you put money in.
Plumb is software that holds collateral and issues a dollar on its own rules. Those rules are public and the same for everyone, and they can still lose you money. This page lists the ways we know of.
For borrowers
Liquidation
If JitoSOL's price falls far enough that your trove drops below 150%, anyone can liquidate it. You lose collateral worth about 10% of your debt, more if nobody acts until well below 150%, and your position is closed. Prices can move faster than you can respond. See Liquidations.
Redemption
When PLMB trades below $1, anyone can redeem it against the lowest-rate troves. If yours is among them, your debt and your JitoSOL shrink without your consent. Nothing is lost on paper, but you may end up holding less JitoSOL than you planned, at a time you didn't choose. See Redemptions.
Redistribution
If the stability pool can't cover a liquidation, the remaining debt and collateral are shared among the other troves. Your trove can take on debt at a ratio below 150% without doing anything.
For everyone
JitoSOL can fail
JitoSOL is the only collateral. A bug in the stake pool program, slashing of its validators, or a lasting discount on the market lowers the value of every trove at once, and there is no second collateral to lean on.
The price can stop
Plumb depends on Pyth's SOL/USD and JitoSOL/USD feeds and on the Jito stake pool being updated each epoch. If either stops, Plumb refuses to price JitoSOL, and borrowing, redemptions and liquidations stop with it. A long outage during a fall in prices could leave troves under-collateralized when liquidations resume. See Price oracle.
The peg is asymmetric
Redemptions put a hard floor at $1 minus the fee, which is never less than 0.5%. Above $1 only new borrowing pulls the price down, so PLMB can trade above $1 for longer than it trades below it.
Liquidity
PLMB is only as useful as the markets that take it. Thin trading makes the arbitrage that holds the peg slower, and makes it harder to buy PLMB back to repay or close a trove.
Smart contract risk
The Plumb program is new code, and it relies on the SPL Token program, the stake pool program and Pyth. A bug in any of them could lose funds. The program's test suite checks exact accounting across every instruction, but tests are not proof.
The program can change
The program is upgradeable. An upgrade could change any rule in these docs. Every upgrade is a public transaction on chain, and the upgrade authority is listed on the Addresses page.
Capacity
Each rate holds sixteen troves and the stability pool sixteen depositors. When a rate is full you have to pick another; when the pool is full you can't deposit until a seat frees up.
# Risks What can go wrong with Plumb, for borrowers, depositors and holders of PLMB. Read this before you put money in. Plumb is software that holds collateral and issues a dollar on its own rules. Those rules are public and the same for everyone, and they can still lose you money. This page lists the ways we know of. ## For borrowers ### Liquidation If JitoSOL's price falls far enough that your trove drops below 150%, anyone can liquidate it. You lose collateral worth about 10% of your debt, more if nobody acts until well below 150%, and your position is closed. Prices can move faster than you can respond. See [Liquidations](/docs/liquidations). ### Redemption When PLMB trades below $1, anyone can redeem it against the lowest-rate troves. If yours is among them, your debt and your JitoSOL shrink without your consent. Nothing is lost on paper, but you may end up holding less JitoSOL than you planned, at a time you didn't choose. See [Redemptions](/docs/redemptions). ### Redistribution If the stability pool can't cover a liquidation, the remaining debt and collateral are shared among the other troves. Your trove can take on debt at a ratio below 150% without doing anything. ## For everyone ### JitoSOL can fail JitoSOL is the only collateral. A bug in the stake pool program, slashing of its validators, or a lasting discount on the market lowers the value of every trove at once, and there is no second collateral to lean on. ### The price can stop Plumb depends on Pyth's SOL/USD and JitoSOL/USD feeds and on the Jito stake pool being updated each epoch. If either stops, Plumb refuses to price JitoSOL, and borrowing, redemptions and liquidations stop with it. A long outage during a fall in prices could leave troves under-collateralized when liquidations resume. See [Price oracle](/docs/price-oracle). ### The peg is asymmetric Redemptions put a hard floor at $1 minus the fee, which is never less than 0.5%. Above $1 only new borrowing pulls the price down, so PLMB can trade above $1 for longer than it trades below it. ### Liquidity PLMB is only as useful as the markets that take it. Thin trading makes the arbitrage that holds the peg slower, and makes it harder to buy PLMB back to repay or close a trove. ### Smart contract risk The Plumb program is new code, and it relies on the SPL Token program, the stake pool program and Pyth. A bug in any of them could lose funds. The program's test suite checks exact accounting across every instruction, but tests are not proof. ### The program can change The program is upgradeable. An upgrade could change any rule in these docs. Every upgrade is a public transaction on chain, and the upgrade authority is listed on the [Addresses](/docs/addresses) page. ### Capacity Each rate holds sixteen troves and the stability pool sixteen depositors. When a rate is full you have to pick another; when the pool is full you can't deposit until a seat frees up. > [!INFO] > There is no administrator who can move your collateral, change a price, or pause one person's trove. The parameters on the [Parameters](/docs/parameters) page are compiled into the program. That also means nobody can step in to fix a situation the rules didn't foresee, short of an upgrade.