A tool for one half of
Confide — the collateral half, which waits on a lending market that can
price a balance it cannot read. The trade does not wait on anyone.
$21 million of tokenized stock is sitting in Kamino reserves
right now, and their caps authorise $81 million of borrowing against it.
Every one of those positions is public, because Kamino's own program refuses a deposit from
an account carrying confidential value. Pick any of the 1,992 tokenized stocks below.
The chain reading is made by your browser, now.
The ordinary deposit path refuses a token account that can hold value
confidentially — and it checks the account the tokens come from, which is the holder's,
not Kamino's vault. Collateral that cannot get in cannot be borrowed against or liquidated either;
that follows from the deposit refusal rather than from separate checks, and it is worth saying
which. Borrow checks the account receiving the borrowed asset; liquidation
checks the liquidator's accounts; flash_repay does not check at all.
klend
the condition
what it refuses
constraints.rs:187
allow_confidential_credits == false
an account that can receive value confidentially
constraints.rs:194
allow_non_confidential_credits == true
an account that can only be paid confidentially
constraints.rs:201
closable() succeeds
an account holding any confidential balance
constraints.rs:131
auto_approve_new_accounts == false
a mint anyone can open a confidential account on
klend a087609,
release/v1.25.0, 2026-08-18 · re-checked by ./scripts/kamino-verdict.sh, which fails if any of these lines moves
Refusing what you cannot value is correct underwriting, not an oversight. This
page is not an argument that Kamino is wrong. It is an answer to what would it take.
The last line is a pincer, and it closes on every mint
constraints.rs:131 reads differently from the other three. The
first three refuse an account. This one refuses a mint — and it refuses the
mint that would let anyone open a confidential account without asking the issuer.
So the flag Kamino requires is the flag that puts the issuer in the
path. They are the same field, read from two sides.
autoApproveNewAccounts
issuer must approve each escrow
Kamino accepts the mint
false
yes
✓
true
no
refused at constraints.rs:131
Measured across every tokenized-equity mint in mints.json by
./scripts/slot-scan.sh, which fails if any mint ever auto-approves:
1,992 of 1,992 set it false — Backed 828, Backpack 1,156, PreStocks 8. Zero auto-approve.
There is no mint in the population on the ungated side, so this is not
solved by choosing a different ticker. The $0 below is not a property of
an asset, a reserve or a parameter — it is a property of the configuration the whole market
shares. No engineering on Confide's side removes it: the floor can be proved, the
collateral locked and the default settled without the holder, and the position still cannot exist,
because the account it would live in cannot be opened without the issuer.
How many, of all of them
The 1,992 is incidence — how many tokenized stocks have
confidential transfers switched on. It is not the number a lender cares about, and until this page
they were the same number here. These are two questions with two answers.
borrowing those caps and LTVs already authorise
—
cap × LTV × the reserve's own price
of it reachable while your position stays confidential
$0
the deposit path refuses the account — constraints.rs:187
tokenized stocks Kamino already lends against
—
live reserves, LTVs chosen by their market owners
of those positions, held confidentially
0
every position in them is visible to anyone who looks
mints that pass klend's mint-extension check
—
one gate of several — not oracle, liquidity, eligibility, or whether anyone would supply it
of those, usable while the position is confidential
0
no holder can satisfy constraints.rs:187 and :201 — that is what the rule says
Generated by ./scripts/kamino-admissible.sh against
klend —. The per-mint reading below is live and does not come
from this file.
Pick a mint
What it would take
A reserve that can value a balance it cannot read needs two things. Confide has
parts of both, and the parts it does not have are named here rather than skipped.
needed
state
A floor, proved — not the balance, a lower bound on it, so a reserve can value the position at q_min × price and ignore the rest
runs
Solana's ZK program checks it; the escrow's own ciphertext is bound in
Custody that survives the holder — a proved floor is worthless if the holder can withdraw below it afterwards
runs
origination verifies the escrow's owner is the loan PDA before recording anything
Re-proving — a floor proved once is a floor at one moment, and a reserve marks continuously
not built
either on a schedule the reserve enforces, or the trigger absorbs the staleness
Liquidation hand-off — the seizure has to fit inside Kamino's liquidation instruction, not beside it
not built
de-shielding is disabled; finishing it is not the work, reaching a liquidator is
An exemption — the escrow is PDA-owned and confidential, so it fails :187 and :201 by design
Kamino's call
the alternative is making the value public at deposit, which gives up the point
Nobody at Kamino has been asked. Nothing on this page implies otherwise.