[ARFC] Deploy Aave v3 on X Layer

[LlamaRisk]

xSOL Asset Review

Summary

LlamaRisk supports onboarding xSOL to the Aave V3 X Layer instance. The SOL wrapper is managed centrally by OKX, with underlying SOL custodied in a locked reserve address. Key access control roles are assigned to MPCs managed by the X Layer team. Withdrawals are facilitated by OKX, introducing permissioned barriers for redemptions.

Onchain supply is currently worth $1.5M, with 2 pools supplying the only sources of DEX liquidity. As with other xAssets, liquidity will be bootstrapped to support the onboarding, with modest initial supply caps intended to introduce the Solana-native asset.

The asset’s recent deployment offers little insight into its volatility or growth, and lacks a Chainlink price feed. The X Layer team has informed us that a Chainlink SOL/USD price feed is still under development. We therefore recommend onboarding contingent on the price feed being deployed to support efficient pricing.

Full Asset Evaluation

1. Asset Fundamental Characteristics

1.1 Asset

xSOL is a cross-chain wrapped SOL representation, backed 1:1 by native SOL, custodied by OKX. xSOL is minted when users send SOL to the designated xSOL reserve address or when a user withdraws SOL from their OKX account to a supported network address (currently only deployed on X Layer). Underlying SOL is redeemed back into user accounts when xSOL is deposited on the OKX Exchange.

1.2 Architecture

xSOL minting, burning, and transferring are controlled through OKX’s MPC system. SOL deposits are held in OKX’s SOL reserve address, which consists of SOL secured for xSOL. The reserve holding underlying SOL can be viewed through Solana explorers, like Solscan, and via a public dashboard. The reserve is a locked address that is controlled, which strictly stores segregated SOL.

The core components of xSOL include:

• xSOL: an ERC-20 contract for X Layer wrapped SOL. Inherits from xToken contract.
• Reserve Address: Solana-based address that stores underlying xSOL.
• Mint & Burn Controller: MPC that controls xSOL minting and burning operations.
• TimelockController: Manages sensitive admin functions.
• Authorized Receiver: Dedicated address that receives newly minted xSOL
• Admin: MPC that manages updates and controls transfer restrictions/blacklisting.
• ProxyAdmin: Can modify contract parameters or implement xSOL upgrade.

An internal verification engine monitors and enforces the minting and burning of 1:1 SOL from OKX exchange addresses.

A Chainlink PoR is planned to support reserve attestations, which will reference the public reserve address linked above. The X Layer team indicated that this initial setup is planned to be updated in the future to incorporate a 3rd party auditor.

1.3 Tokenomics

A mint and burn mechanism is used on X Layer for xSOL with a corresponding deposit and withdrawal messaging system on Solana for SOL. No supply cap is in place for xSOL on X Layer. Given that minting is facilitated by OKX, liquidity and supply for xSOL are dependent on SOL availability on OKX or user deposits into the controlled reserve.

Source: X Layer Internal Documentation, February 13th, 2026

xSOL follows established wrapper patterns, with permissioned minting and burning.

1.3.1 Token Holder Concentration

Current supply is 18,843 ($1.5M) with 547 holders. Supply is concentrated on 3 accounts, which hold over 96% of xSOL on X Layer:

• OKX. Deposit_1 EOA: 48.89%
• Uniswap xSOL/USDT0: 29.28%
• Uniswap xSOL/xOKSOL: 18.57%

2. Market Risk

2.1 Liquidity

Source: xSOL swap USDT0, Uniswap, February 13th, 2026

Meaningful liquidity is currently lacking. Additional liquidity has been committed to support onboarding, with $1M and $2M allocated to the xOKSOL/xSOL and xSOL/USDT0 pools, respectively.

2.1.1 Liquidity Venue Concentration

As shown in section 1.3.1, Uniswap represents the sole venue for xSOL liquidity. As of February 13th, liquidity in each pool amounted to $789K in the xSOL/USDT0 pool and $551K in the xSOL/xOKSOL pool.

2.1.2 DEX LP Concentration

Source: xSOL/USDT0 LPs, Debank, February 13th, 2026

Source: xSOL/xOKSOL LPs, Debank, February 13th, 2026

Given the asset’s recent deployment, liquidity is primarily supplied by the X Layer team, resulting in a single LP source for both pools.

2.2 Volatility

Source: xSOL/USD, Geckoterminal, February 13th, 2026

Source: SOL/USD price feed (Base), Chainlink, February 16th, 2026

xSOL price data is limited, with data only available from January 21st. Since then, secondary market price action in the USD pool has remained closely correlated with a SOL/USD Chainlink price feed.

2.3 Exchanges

Source: SOL spot markets, OKX, February 16th, 2026

Source: SOL/USDT, OKX, February 16th, 2026

The spot market on OKX experiences considerable volume, as shown above, the SOL/USDT market is the largest, with 24-hour volume exceeding $90M. Money flows from these pairs show predominant net outflows within these pairs; however, it should be noted that this coincides with the recent market volatility seen recently.

Source: SOL perp markets, OKX, February 16th, 2026

Source: SOLUSDT perp market, OKX, February 16th, 2026

The perpetual market for SOL is similarly active in terms of volume, across 3 separate markets. Open interest, as shown above, has fluctuated between 3.97M contracts and 2.67M in the largest SOLUSDT perpetual market over the 30 days observed.

2.4 Growth

Source: xSOL Market Cap, Coingecko, February 13th, 2026

Limited growth was observed at the time of writing as measured by onchain TVL, given the token’s recent deployment. As shown in section 2.3, OKX exchange represents a large base for potential growth for xSOL on X Layer, given that xSOL is minted when users withdraw SOL from OKX.

3. Technological Risk

3.1 Smart Contract Risk

A Zellic audit was completed on xSOL and other assets on December 23, 2025. 1 medium severity, 2 low severity issues, and 1 informational issue were found. The team acknowledged the issues and implemented fixes to the medium and low-severity issues. The medium issue was related to potential addresses on the denylist being able to transfer funds from accounts that granted them allowances. The final report is yet to be shared publicly.

3.2 Bug Bounty Program

xSOL smart contracts are covered under a live OKG bug bounty program hosted on HackerOne with a max bounty of $1M.

3.3 Price Feed Risk

No Chainlink price feed has been deployed, with the team indicating that it is still in development.

3.4 Dependency Risk

xSOL relies on OKX to effectively maintain a 1:1 custody of the underlying SOL custodied on OKX and on Solana. The Solana reserve creates an additional foreign network dependency, one that Aave has yet to deploy on. xSOL does not call external unverified functions, calling only internal system functions.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

To the extent other X Layer assets are governed by the same dedicated wrapped-token user agreement that applies across all wrapped 1:1 assets, they should be treated as operating within the same core legal architecture as xETH. On that premise, the legal analysis prepared for xETH is directionally applicable to such X Layer assets, particularly the findings regarding (i) the assets’ legal construct, (ii) the eligibility and access model, and (iii) the authorisation and regulatory perimeter status of the operating entity.

4.2 Access Control Risk

xSOL is deployed behind a Transparent Upgradeable Proxy, with the current implementation contract.

4.2.1 Contract Modification Options

A Role-Based Access Control system is utilized. The roles and their associated capabilities are outlined below:

MINTER_ROLE: Can mint and burn tokens, assigned to MPC 1.

DENY_LISTER_ROLE: Can pause/unpause transfers and manage the deny list, assigned to MPC 2.

DEFAULT_ADMIN_ROLE: Has admin privileges over Timelock, ProxyAdmin, and xSOL, assigned to MPC 2.

TimelockController Roles manage sensitive admin functions through a timelock delay mechanism. assigned to MPC 2:

• PROPOSER_ROLE: initiates transactions to the queue.
• EXECUTOR_ROLE: executes transactions after a delay.
• CANCELLER_ROLE: can cancel pending operations.

Sensitive functions exposed by each role include

MINTER_ROLE:

• mint & burn xSOL
• transferMinter relinquishes the role to a new account

DENY_LISTER_ROLE:

• pause and unpause all token transfers
• setReceiver determines where the newly minted are sent
• addToDenyList & removeFromDenyList controls a permissioned Deny list that blocks addresses from sending/receiving tokens
• transferDenyLister relinquishes the role to a new account

DEFAULT_ADMIN_ROLE:

• All Deny List Role functions
• grantRole assigns roles to addresses
• revokeRole removes roles assigned to addresses

PROPOSER_ROLE:

• schedule schedules a single transaction (target address, value, and data).
• scheduleBatch schedules multiple transactions to be executed in sequence.

EXECUTOR_ROLE:

• execute triggers the actual call to the target contract once the delay has ended.
• executeBatch triggers a group of function calls.

CANCELLER_ROLE:

• cancel deletes a pending operation before it is executed.

These roles highlight the highly centralized controls that roles have key contract functions, i.e, minting, transferring, pausing, and determining where newly minted xSOL are sent (and indirectly, access to the underlying SOL redemption right).

4.2.2 Timelock Duration and Function

TimelockController enforces a 3-day delay for upgrades and role changes.

4.2.3 Multisig Threshold / Signer identity

MPCs are controlled internally by OKX; no external parties are involved in the management of control systems. Admin actions require internal review and senior management approval.

Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.