RecheckableJito Network
jito.network · Infra · Solana · data checked 2026-10-20 13:06 (Stockholm)
Contact route: on-chain security.txt (program) ↗
Not claimed Automated from public data
Produced automatically from public data on 2026-10-20 (method v0.2.6). It shows how much of this project’s control structure, code and contact information could be checked from public sources. No person selected or adjusted it, and nothing a project does or pays changes it. It is not a security audit.
Beta: the method is still being calibrated, so this automated score may contain errors. Send a correction.
Transparency score, not a security audit. Scores are generated automatically from public data (Solana RPC, OtterSec build registry, GitHub, project websites). Projects are not involved unless a page is marked “Claimed”, and claiming never changes a score. Nothing here says a project is safe. How scores are made → · Corrections, right of reply & opt-out →
- Onchain: strongest Audits; weakest Team & contact; missing data in Contract control, Team & contact.
Something wrong on this page? Dispute a check or send a correction · opt-out. We re-run the check and correct the page.
What was checked: addresses & sources
T1pyyaTNZsKv2WcRAB8oVnk93mLJw2XzjtVYqCsaHqt(program) — source: https://jito-foundation.gitbook.io/mev/mev-payment-and-distribution/on-chain-addresses4R3gSG8BpU4t19KYj8CfnbtRpnT8gtk4dvTHxVRwc2r7(program) — source: https://jito-foundation.gitbook.io/mev/mev-payment-and-distribution/on-chain-addressesRestkWeAVL8fRGgzhfeoqFhsqKRchg6aa1XrcH96z4Q(program) — source: https://github.com/jito-foundation/restaking/blob/master/.cargo/config.tomlVau1t6sLNxnzB7ZDsef8TLbPLfyZMYXH8WTNqUdm9g8(program) — source: https://github.com/jito-foundation/restaking/blob/master/.cargo/config.tomlStewardf95sJbmtcZsyagb2dg4Mo8eVQho8gpECvLx8(program) — source: https://github.com/jito-foundation/stakenet/blob/master/programs/steward/src/lib.rsSPoo1Ku8WFXoNDMHPsrGSTSG1Y47rzgn41SLUNakuHy(program) — source: https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn(token mint) — source: https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/- JTO token mint: not found on an official page → not checked
Website jito.network · GitHub jito-foundation/stakenet. Addresses are used only if they appear verbatim on an official project page.
Own programs: tip payment, tip distribution, restaking, vault, steward (process v1, docs/program-discovery-process.md). JitoSOL also uses the shared SPL stake-pool program (security.txt → solana-program.com): listed for information, not scored.
Onchain track
Contract control weight 30 · 1 unknown · 1 not read6.8/30
- ◐ Partial (25 %)
Upgrade authority T1pyya…
Upgrade authority is 4ivLcnNLhe4cKdpV9b4jyEmxgbYWFgktHcTyyBvYavsD: SPL Governance (Realms-style) native treasury — governance account EA4eoKGv… of program jtogvBNH…, realm “Jito” (established by re-deriving the authority from that governance account, found in tx rAsVsvHv…). Upgrades need a passed proposal: community vote disabled, council vote 51 % yes votes, voting time 3 d, execution hold-up time 0. Council token CscwCYoM… total supply 7 (holder list not retrievable from the public RPC). Reduced credit (25 % instead of 50 %): a passed proposal can be executed immediately, with no hold-up time in which holders could react. The governance program is upgradable only through this same DAO. Address taken from official source: https://jito-foundation.gitbook.io/mev/mev-payment-and-distribution/on-chain-addressesjito-foundation.gitbook.io ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 a0466869c6ec…sha256 adab6c47b5be…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) T1pyya…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial (25 %)
Upgrade authority 4R3gSG…
Upgrade authority is 4ivLcnNLhe4cKdpV9b4jyEmxgbYWFgktHcTyyBvYavsD: SPL Governance (Realms-style) native treasury — governance account EA4eoKGv… of program jtogvBNH…, realm “Jito” (established by re-deriving the authority from that governance account, found in tx 3EAJ3AVj…). Upgrades need a passed proposal: community vote disabled, council vote 51 % yes votes, voting time 3 d, execution hold-up time 0. Council token CscwCYoM… total supply 7 (holder list not retrievable from the public RPC). Reduced credit (25 % instead of 50 %): a passed proposal can be executed immediately, with no hold-up time in which holders could react. The governance program is upgradable only through this same DAO. Address taken from official source: https://jito-foundation.gitbook.io/mev/mev-payment-and-distribution/on-chain-addressesjito-foundation.gitbook.io ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 487551581fb4…sha256 6c1c1e422657…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) 4R3gSG…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial (25 %)
Upgrade authority RestkW…
Upgrade authority is 5eosrve6LktMZgVNszYzebgmmC7BjLK8NoWyRQtcmGTF: SPL Governance (Realms-style) native treasury — governance account 8cEhMTsw… of program jtogvBNH…, realm “Jito” (established by re-deriving the authority from that governance account, found in tx N1SszeW7…). Upgrades need a passed proposal: community vote 1 % yes votes, council vote 51 % yes votes, voting time 5 d, execution hold-up time 0. Council token CscwCYoM… total supply 7 (holder list not retrievable from the public RPC). Reduced credit (25 % instead of 50 %): a passed proposal can be executed immediately, with no hold-up time in which holders could react. The governance program jtogvBNH… can itself be upgraded by 4ivLcnNL… (a native treasury of an SPL-Governance DAO). Address taken from official source: https://github.com/jito-foundation/restaking/blob/master/.cargo/config.tomlWhat would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) RestkW…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial (25 %)
Upgrade authority Vau1t6…
Upgrade authority is 5eosrve6LktMZgVNszYzebgmmC7BjLK8NoWyRQtcmGTF: SPL Governance (Realms-style) native treasury — governance account 8cEhMTsw… of program jtogvBNH…, realm “Jito” (established by re-deriving the authority from that governance account, found in tx 2i5aXyZW…). Upgrades need a passed proposal: community vote 1 % yes votes, council vote 51 % yes votes, voting time 5 d, execution hold-up time 0. Council token CscwCYoM… total supply 7 (holder list not retrievable from the public RPC). Reduced credit (25 % instead of 50 %): a passed proposal can be executed immediately, with no hold-up time in which holders could react. The governance program jtogvBNH… can itself be upgraded by 4ivLcnNL… (a native treasury of an SPL-Governance DAO). Address taken from official source: https://github.com/jito-foundation/restaking/blob/master/.cargo/config.tomlWhat would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) Vau1t6…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority Stewar…
Upgrade authority is 8EP3VommYzMRSdnSn88GnQpxjRwxg6nroTeUNJoqu9b8: Squads v4 multisig AJVQRHk9… with threshold 4 of 7 voting member(s) (7 total), time lock 0 s, config authority DG76d6Ak… (can change members without a vote) (established by re-deriving the vault address from the multisig; found in upgrade history tx 2MD7sFfB…). Member independence not established. Address taken from official source: https://github.com/jito-foundation/stakenet/blob/master/programs/steward/src/lib.rsWhat would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) Stewar…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- – N/A
Shared program SPoo1K… (SPL Stake Pool)
Shared program maintained by others (its on-chain security.txt points to https://www.solana-program.com/docs/stake-pool). Shown for information; not scored for Jito Network (program-discovery-process v1).Explorer ↗ checked 2026-10-20 - ? Unknown
Mint authority J1toso…
6iQKfEyhr3bZMotVkW6beNZz5CPAkiwvgV2CTje9pVSS: a program-derived address whose controller could not be established. The account is owned by the System Program with no data (a bare program-derived address: it holds SOL but stores nothing about who controls it). Scanned 25 transactions and 47 candidate accounts: no multisig, vault or governance account re-derives to this address.. Address taken from official source: https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/www.jito.network ↗Explorer ↗Explorer ↗RPC call (getAccountInfo) checked 2026-10-20sha256 232e493cb02f…sha256 eaf4098e7e3a…What would show up as met
- If no more tokens will ever be minted, revoke the mint authority. It then reads as met.
- If minting must stay possible, move the authority to a multisig (threshold 2 or more, time lock) or a DAO and publish that address on your site.
How we check: We read the mint account on Solana (public RPC). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✓ Met
Freeze authority J1toso…
Revoked. Address taken from official source: https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/www.jito.network ↗Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress) checked 2026-10-20sha256 232e493cb02f…sha256 eaf4098e7e3a… - ⊘ Not read
Mint/freeze authority (JTO token mint)
Not read: JTO token mint — no official page stating the address could be machine-confirmed, so the address was not used. This is not a finding about the project (method 0.2.4: an unreadable mint is Not read, no points lost, lower coverage). (reason: mint_unconfirmed)source: calculated from the other checks checked 2026-10-20What would show up as met
Nothing for the project to do. Our checker could not read the source this time, so the check is “Not read”: no points are lost. It is tried again at the next run. If you think the data behind it is wrong, send a correction.
Audits weight 1515/15
- ✓ Met
Linked audit
Document reachable; mentions the submitted program ID. Date vs. last upgrade not checked. Quality not assessed.
Code openness weight 1515/15
- ✓ Met
Public repository
jito-foundation/stakenet public, created 2023-12-15, 11 contributor(s) (count only).GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20sha256 176f4d235745…sha256 3720dfd44cd0… - ✓ Met
Licence
SPDX: Apache-2.0.GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20sha256 176f4d235745…sha256 3720dfd44cd0… - ✓ Met
Activity last 90 days
Last push 2026-10-19 (0 d ago).GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20sha256 176f4d235745…sha256 3720dfd44cd0… - ✓ Met
On-chain program source public
5/5 own program ID(s) found in public source: 4R3gSG… in https://github.com/jito-foundation/stakenet; Stewar… in https://github.com/jito-foundation/stakenet; T1pyya… in https://github.com/jito-foundation/jito-programs; RestkW… in https://github.com/jito-foundation/restaking; Vau1t6… in https://github.com/jito-foundation/restaking. Repos searched (shallow clone, text search for the program ID): https://github.com/jito-foundation/stakenet, https://github.com/jito-foundation/jito-programs, https://github.com/jito-foundation/restaking. Does not prove the deployed binary matches (see the build check).
Onchain history weight 109/10
- ✓ Met
Last deploy T1pyya…
Last deploy 2025-05-02 (535 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 a0466869c6ec…sha256 adab6c47b5be… - ○ Not built
Program age / upgrade count T1pyya…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 a0466869c6ec…sha256 adab6c47b5be… - ✓ Met
Last deploy 4R3gSG…
Last deploy 2026-03-01 (232 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 487551581fb4…sha256 6c1c1e422657… - ○ Not built
Program age / upgrade count 4R3gSG…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 487551581fb4…sha256 6c1c1e422657… - ✓ Met
Last deploy RestkW…
Last deploy 2025-01-27 (630 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 8fef47cde1e7…sha256 28f903c35eee… - ○ Not built
Program age / upgrade count RestkW…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 8fef47cde1e7…sha256 28f903c35eee… - ✓ Met
Last deploy Vau1t6…
Last deploy 2025-04-17 (551 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 65581818ff7a…sha256 a6869a02227f… - ○ Not built
Program age / upgrade count Vau1t6…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 65581818ff7a…sha256 a6869a02227f… - ◐ Partial
Last deploy Stewar…
Last deploy 2026-10-19 (0 d ago). Upgraded within the last 30 days.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 e2a804846b69…sha256 5fec3b4ec9e1…What would show up as met
- Nothing to configure: a deploy more than 30 days ago reads as met, a more recent deploy as partial because the code changed recently.
How we check: We read the last deploy time on Solana. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ○ Not built
Program age / upgrade count Stewar…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 e2a804846b69…sha256 5fec3b4ec9e1…
Team & contact weight 15 · 1 unknown2.5/15
- ✕ Not met
Security contact (security.txt)
No valid security.txt at /.well-known/security.txt or /security.txt (404).What would show up as met
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
Contact:line, for exampleContact: mailto:security@your-domain. - RFC 9116 also asks for an
Expires:line. We look only forContact:, but addExpires:too so the file stays correct.
How we check: We fetch the two standard locations over HTTPS. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
- ? Unknown
Bug bounty programme linked
No bug-bounty link found on homepage (raw + rendered), sitemap or security.txt. Not checked deeper (docs sites, Immunefi search) — counted as unknown, not as missing. Also checked: Immunefi public list: no active programme matched; T1pyya… security.txt policy https://github.com/jito-foundation/jito-programs mentions no bounty, contacts: email:support@jito.network; 4R3gSG… security.txt policy https://github.com/jito-foundation/jito-programs mentions no bounty, contacts: email:support@jito.network; RestkW… security.txt policy https://github.com/jito-foundation/restaking mentions no bounty, contacts: email:team@jito.network; Vau1t6… security.txt policy https://github.com/jito-foundation/restaking mentions no bounty, contacts: email:team@jito.network; no on-chain security.txt in Stewar….jito.network ↗jito.network ↗jito.network ↗jito.network ↗ checked 2026-10-20sha256 2cb4bbc25482…sha256 e662fc915908…What would show up as met
- Link your bug bounty (for example an Immunefi, HackerOne or Cantina page, or a /bug-bounty page of your own) from the homepage, the sitemap or your security.txt.
- “Unknown” here means we found no link. It does not mean you have no programme.
How we check: We look at the homepage links (also as rendered in a browser), sitemap.xml and security.txt, and at Immunefi’s public list for on-chain security.txt names. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ℹ Status only
Claimed / not claimed
Status only, not scored: claiming proves control of an authority, domain or GitHub organisation and never changes a score. The status is shown in the page header.source: calculated from the other checks checked 2026-10-20 - ○ Not built
Team declared (voluntary, with consent)
Team declaration + consent flow not built — excluded.source: calculated from the other checks checked 2026-10-20 - ℹ Status only
Components declared complete by the project
Status only, not scored (it used to be scored, which made pages that are not claimed systematically lower; removed 2026-10-15). Other programs/packages may exist that were not submitted.source: calculated from the other checks checked 2026-10-20 - – N/A
Shared program bounty (informational)
Shared program bounty — no points: SPoo1K… is the shared program 'SPL Stake Pool' (https://www.solana-program.com/docs/stake-pool); its security policy (https://github.com/solana-program/stake-pool/blob/master/SECURITY.md) belongs to that program's maintainers, not to Jito Network.GitHub ↗ checked 2026-10-20 - ◐ Partial
Program embeds security.txt
4/5 own program(s) embed a solana-security-txt block with contacts (T1pyya…, 4R3gSG…, RestkW…, Vau1t6…). Shared programs excluded: SPoo1K….What would show up as met
- Embed a security.txt block in the program with the
solana-security-txtcrate: name, project_url, contacts and policy. Redeploy to publish it. - This also tells us which programs belong to you, and which are shared programs that do not.
How we check: We read the program account on Solana (public RPC). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Embed a security.txt block in the program with the
- ✕ Not met
Official program address list
T1pyya… published on third-party page (https://jito-foundation.gitbook.io/mev/mev-payment-and-distribution/on-chain-addresses); 4R3gSG… published on third-party page (https://jito-foundation.gitbook.io/mev/mev-payment-and-distribution/on-chain-addresses); RestkW… published on project GitHub only (https://github.com/jito-foundation/restaking/blob/master/.cargo/config.toml); Vau1t6… published on project GitHub only (https://github.com/jito-foundation/restaking/blob/master/.cargo/config.toml); Stewar… published on project GitHub only (https://github.com/jito-foundation/stakenet/blob/master/programs/steward/src/lib.rs); SPoo1K… published on project domain (https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/).GitHub ↗GitHub ↗jito-foundation.gitbook.io ↗www.jito.network ↗ checked 2026-10-20sha256 0cd979e3c762…sha256 0aba668e8e1d…What would show up as met
- List your official program addresses on a page of your own domain (for example a docs page called “Addresses”). A list only on GitHub reads as partial, and one only on a third-party page as not met.
How we check: We use the pages the project itself publishes. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
Legal documents weight 1010/10
- ✓ Met
Terms & privacy policy present
Terms: https://jito.network/docs/jitosol/resources/terms-of-use/; privacy: https://jito.network/docs/jitosol/resources/privacy-policy/ (homepage links, sitemap.xml, common paths). Content not assessed.jito.network ↗jito.network ↗jito.network ↗jito.network ↗ checked 2026-10-20sha256 2cb4bbc25482…sha256 e662fc915908… - ○ Not built
Registered legal entity
Not stated.source: calculated from the other checks checked 2026-10-20 - ✓ Met
Legal entity named in terms
Terms/privacy text names “Jito Foundation” (https://jito.network/docs/jitosol/resources/terms-of-use/). Not checked against a company registry.
Domain weight 55/5
- ✓ Met
HTTPS
https://jito.network answered HTTP 200 over TLS.jito.network ↗jito.network ↗jito.network ↗jito.network ↗ checked 2026-10-20sha256 2cb4bbc25482…sha256 e662fc915908… - ✓ Met
Security headers
Present: HSTS, CSP, X-Content-Type-Options, X-Frame-Options. Missing: none.jito.network ↗jito.network ↗jito.network ↗jito.network ↗ checked 2026-10-20sha256 2cb4bbc25482…sha256 e662fc915908… - ✓ Met
Domain age
Registered 2021-07-13 (~1925 d), source: RDAP (rdap.org). Registrant data ignored. - ✓ Met
Domain ↔ components consistency
Linked: address SPoo1K… published on jito.network (https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/); address J1toso… published on jito.network (https://www.jito.network/docs/jitosol/jitosol-liquid-staking/security/deployed-programs/); GitHub org name matches domain (weak)source: calculated from the other checks checked 2026-10-20
Snapshot hash of monitored fields: da2b9918315c097f
AI summaries
Generated with Grok 4.7 (xAI), Claude sonnet-5-5 (Anthropic) and GPT-6.1-sol (OpenAI) via their APIs. xAI, Anthropic and OpenAI have not reviewed, approved or sponsored Recheckable. AI-generated text; models see only extracted check results, never project-supplied text or personal names. They do not affect the score. Some text on this site (summaries and reports) is AI-generated and labelled where it appears. Scores and check results come from fixed code, not from AI. Scores are produced automatically from public data and are not reviewed by hand before they are shown; cases that the automatic checks flag are held for a person.
Template summary (deterministic)
Onchain track: band C (60/100, coverage 91 %, onchain v0.2.6). Strongest: Audits, Code openness, Onchain history, Legal documents, Domain. Weakest: Contract control, Team & contact. 2 check(s) unknown (each costs 1.5 points); 1 not read (no points lost, lowers coverage); 7 not built yet (excluded).
Grok (xAI)
Placeholder — no API key configured for this model in the PoC.
Claude (Anthropic)
Placeholder — no API key configured for this model in the PoC.
GPT (OpenAI)
Placeholder — no API key configured for this model in the PoC.
Regulatory information
The project has not declared any regulated-activity types, so no rules are listed.
Law firms (free listing, alphabetical, no ranking)
- Delphi — Stockholm, Blockchain law (self-described)
- Gernandt & Danielsson — Stockholm, Fintech (self-described)
- Magnusson — Stockholm, Fintech (self-described)
- Mannheimer Swartling — Stockholm, Fintech (own practice page to be confirmed) (self-described)
- Setterwalls — Stockholm, Fintech (self-described)
- Vinge — Stockholm, MiCA (own practice page to be confirmed) (self-described)
Recheckable has no financial relationship with the listed firms and receives no fee per contact. Paid placements, if ever introduced, are marked “Ad” and never shown next to low scores.
Score history
Automated score at each published review, newest on the right. The line steps at the date of a review; between reviews the score is unchanged.
◆ 2026-10-19: the scoring method changed from v0.2.5 to v0.2.6. A score change at that point can come from the method and not from the project.
Data table
| Review | Track | Score | Grade | Coverage | Method |
|---|---|---|---|---|---|
| 2026-10-15 | onchain | 61/100 | C | 91 % | v0.2.5 |
| 2026-10-19 | onchain | 61/100 | C | 91 % | v0.2.6 |
| 2026-10-20 | onchain | 60/100 | C | 91 % | v0.2.6 |
Check changes between reviews
- 2026-10-20 · onchain Upgrade authority T1pyya…: N/A → Partial jito-foundation.gitbook.io ↗ Explorer ↗
- 2026-10-20 · onchain Upgrade authority 4R3gSG…: N/A → Partial jito-foundation.gitbook.io ↗ Explorer ↗
- 2026-10-20 · onchain Upgrade authority RestkW…: N/A → Partial GitHub ↗ Explorer ↗
- 2026-10-20 · onchain Upgrade authority Vau1t6…: N/A → Partial GitHub ↗ Explorer ↗
- 2026-10-20 · onchain Upgrade authority Stewar…: N/A → Partial GitHub ↗ Explorer ↗
- 2026-10-20 · onchain Last deploy Stewar…: Met → Partial Explorer ↗
- 2026-10-19 · onchain Upgrade authority T1pyya…: N/A → Partial method changed jito-foundation.gitbook.io ↗ Explorer ↗
- 2026-10-19 · onchain Upgrade authority 4R3gSG…: N/A → Partial method changed jito-foundation.gitbook.io ↗ Explorer ↗
- 2026-10-19 · onchain Upgrade authority RestkW…: N/A → Partial method changed GitHub ↗ Explorer ↗
- 2026-10-19 · onchain Upgrade authority Vau1t6…: N/A → Partial method changed GitHub ↗ Explorer ↗
- 2026-10-19 · onchain Upgrade authority Stewar…: N/A → Partial method changed GitHub ↗ Explorer ↗
History
- 2026-10-20 13:06Nightly re-run: onchain C (60, coverage 91 %)
- 2026-10-19 12:47Forced fresh run (same result; fresh evidence snapshots): onchain C (61, coverage 91 %)
- 2026-10-18 08:10Method 0.2.4: audits by 2+ distinct firms at official sources count as Met; an unreadable token mint is Not read. Re-scored from the stored checks, no new data.
- 2026-10-15 10:16Method 0.2.1: the scope declaration and claim status are status-only (never scored). Re-scored from the stored checks, no new fetch. Before: C 58 (cov 88 %); after: C 60 (cov 91 %).
- 2026-10-15 07:33Initial review (operator-run): onchain C (58, coverage 88 %)
Project's own statements and reply
Does your team control the upgrade authority, official domain or GitHub organisation of this project? Claim this page (free, about a minute; it never changes a score).
For project owners: badge
Status: Active. The badge says “no changes since review”, never “safe”.
Badges are for claimed projects. The embed code is available after the page has been claimed (free, about a minute; claiming never changes the score). Claim this page
Re-checks are rate-limited (once per 10 minutes). Restoring a grey badge requires a full review.