Security & audit

Hobba’s on-chain program has been independently audited by Ackee Blockchain, a security firm specializing in Solana and Anchor programs.

Read the report

The full audit report is publicly available:

Ackee Blockchain - Hobba audit report (PDF)

We recommend reading it before deploying significant capital or building an integration on top of the protocol.

What was audited

The audit covers the Hobba program - the on-chain contract that custodies positions, mediates deposits, borrows, repayments and withdrawals through the underlying lenders (Jupiter Lend and Kamino Lend), routes working capital into the yield vaults, and enforces the operator boundary that scopes what the automation can do.

Safeguards by construction

Beyond the audit, the protocol limits risk structurally:

• Users keep control of their funds. Sonnar transacts through operator-only methods that can manage the working borrow but can never withdraw collateral, close a position, or send funds anywhere except the lender, the approved vaults, or the user’s own wallet - enforced by the program, not by policy.
• Conservative LTV layering. User debt is capped at 50% LTV and the engine targets ~60-65%, both well below the lenders’ liquidation lines (75-90% depending on lender and asset).
• Atomic operations. Multi-step flows (like the unwind-then-release withdrawal) execute in a single transaction - they complete fully or revert, with no half-open state.
• Multisig-guarded upgrades. The program’s upgrade authority is held by a multisig, not a single key - no individual can ship a new version of the program alone. The authority is verifiable on-chain: 4nzz1LwY1WTK91axFpHzgQQXdqWrtzEdaxJZpm4gtLsx.
• Allowlist-gated access. Wallets are allowlisted before they can open positions.

Reporting an issue

If you discover a security issue, please disclose it responsibly by emailing security@hobba.io rather than opening it publicly.