XPlace Card

card Assessed on Solana (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp)x.place

Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: XPlace Terms s1 and s5.4 say Collateral and Credit Mode run through Kamino Finance smart contracts on Solana, and the homepage FAQ says XPlace runs on Solana. Kamino's lending program KLend2g3... is an OtterSec-verified build of Kamino-Finance/klend at a08760976f. The unit is that program as used for XPlace collateral. Excluded: Rain's card collateral and any XPlace-owned program (FYEO-audited per marketing), because no address could be found; no other chain is named.

At a glance

Category: Cards
Chain: Solana
CROPS tally: 1 of 23 hold up · 8 no evidence
Settles in: USDC
Security audits: 21 published
Offered: All but 17 countries
Last edited: 2026-10-13 · History

Censorship Resistance0 FailsWeakest: Admin pause or freeze powers; Settle without the provider; Reliance on hosted services
Open0 FailsWeakest: Can be self-hosted; Interfaces and data export
Free0 FailsWeakest: Open-source licences; Protection against relicensing; No proprietary dependencies
Privacy0 FailsWeakest: Payments linkable onchain; Third parties in the payment flow; Endpoints can be changed
Security No evidenceWeakest: Token approval scope; Funds safe if provider disappears; Secrets and webhook handling; Audits and bug bounty

Where it is offered

Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.

Terms and Conditions (effective 20 May 2026) s3.2 lists 17 Prohibited Countries. Use is prohibited for residents, people located there, and nationals of these countries. s3.3 adds 16 Restricted U.S. States: Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, Washington and Wisconsin. s3.4 also bars anyone subject to comprehensive sanctions without naming further countries, and says XPlace may enforce the restrictions with IP geolocation. The terms are the platform's; the card (issued through the Card Partner, Rain) has no separate country list.

Excluded countries (17): Belarus, China, Cuba, India, Iran, Iraq, Israel, Myanmar (Burma), Nepal, Nicaragua, North Korea, Russia, Syria, Türkiye, Ukraine, Venezuela, Vietnam

Evidence (3)3 documented

Documented
s3.2 Prohibited Countries, 17 countries from Belarus to Vietnam.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The s3.2 list ends with Venezuela and Vietnam, followed by XPlace's right to update it.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
s3.3 Restricted U.S. States.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Settlement token

What the balance is held in and debited from. Shown as context; it does not change any rating.

Token	Class	Issuer	Contract
USDC Default	fiat-backed stablecoin	Circle

Conversion. The token is sold for fiat when a payment is authorised.

Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.

The card spends USDC in both modes. In Cash mode a payment is settled from the user's USDC balance; in Credit mode it draws USDC credit borrowed through Kamino against deposited SOL, wETH, cbBTC, USDT or jitoSOL, which stay as collateral and are not sold. Rain (Card Partner) does authorisation, clearing and fiat settlement. How USDC reaches Rain could not be observed onchain, so the USDC mint address is not given.

Checked 2026-10-12

Evidence (3)3 documented

Documented
The card page says Cash-mode payments settle from the USDC balance and Credit-mode payments draw on the credit line backed by Collateral.
docs.x.place/card/about-xplace-sard.md
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Documented
The Credit page says credit is issued only in USDC.
docs.x.place/xplace/credit.md
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Documented
Terms s5.1 say the Card Partner performs authorisation, clearing and fiat settlement.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19

Censorship Resistance

Who can block valid use, and can users route around them?

0 FailsPillar rating: weakest of 5
0 of 5 Partial or better

What would raise this pillar

Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Reliance on hosted services reaching Weak: Intermediaries required, only documented, no public code.

Admin pause or freeze powers

Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

XPlace can freeze or block an individual account, its wallet interactions, or the card without prior notice, and it need not say why. That meets anchor 0. The lending market behind XPlace collateral could not be identified onchain, so the market owner's powers inside Kamino were not assessed. Card blocking by Rain sits offchain.

Evidence (2)1 verified · 1 documented

Verified
klend is a BPF upgradeable program (programData 9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA); the Kamino lending market XPlace uses was not identified, so its market-owner powers could not be read.
KLend2…gmjD on solana.fm
KLend2…gmjD explorer · block 454205453 · checked 2026-10-07
Documented
Terms s12.3 let XPlace freeze or block an account, wallet interactions or the card without notice; s12.4 says it need not give a reason.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Settle without the provider

Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2

0 Fails

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

A merchant is paid over Visa by Rain. Neither payer nor payee can complete a card payment by calling a contract. Kamino calls (deposit, borrow, repay) are direct, but they fund the card; they do not settle it.

Evidence (1)1 documented

Documented
Terms s5.1 say card settlement is done by the Card Partner (Rain, s1) through licensed financial infrastructure; XPlace does not issue cards.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Reliance on hosted services

Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3

0 Fails

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Every card payment depends on XPlace's closed app and backend and on Rain. None is public or has a fallback. Closed and single-vendor.

Evidence (1)1 documented

Documented
The card path runs through the XPlace app and backend, Rain and Visa; no XPlace repository or self-host path exists (gh search for xplace / x.place found no XPlace-owned org).
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Neutral settlement, disclosed filtering

Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4

1 Weak

Best evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Sanctions and geographic screening is disclosed in the Terms and runs in XPlace's closed services, not in public code. The card path cannot bypass it (C2 = 0). Disclosed in docs only, so 1.

Evidence (1)1 documented

Documented
Terms s3 list prohibited countries and s3.4 bars persons on OFAC, UN or UAE sanctions lists, enforced by IP geolocation, KYC data and screening tools.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Token and chain freeze risks disclosed

Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5

1 Weak

Best evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Tokens and the chain are listed in docs only, and issuer freeze powers are not stated to cardholders. 1.

Evidence (1)1 documented

Documented
The Collateral page enumerates SOL, wETH, cbBTC, USDT and jitoSOL with LTVs; Credit is issued in USDC; the homepage says XPlace runs on Solana. No page states the freeze or blacklist powers of the USDC, USDT, cbBTC or wETH issuers.
docs.x.place/xplace/collateral.md
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Open

Is the whole stack visible?

0 FailsPillar rating: weakest of 4
0 of 4 Partial or better · 1 no evidence

What would raise this pillar

Can be self-hosted reaching Weak: Docs exist; reproduction not attempted, or failed with blockers listed.
Interfaces and data export reaching Weak: Documented only.

Contracts verified onchain

Does the deployed bytecode match public source, and can a third party rebuild it? O1

1 Weak

Best evidence: VerifiedChecked 2026-10-07 12 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The Kamino lending program is a reproducible verified build of a pinned public commit. The rest of the payment path is not: XPlace's own contracts (claimed as FYEO-audited) and Rain's card collateral program have no published address, so their bytecode cannot be matched. Some contracts verified, so 1.

Evidence (2)2 verified

Verified
OtterSec verify registry reports is_verified true, on-chain hash = executable hash b1344d19...c22d9, built from Kamino-Finance/klend commit a08760976f51a3a58c4a0c6ea27b4a0e565bca79 (last verified 2026-08-20).
KLend2…gmjD on verify.osec.io
KLend2…gmjD explorer · block 454205453 · checked 2026-10-07
Verified
The verified build's source tree (Anchor workspace) at the pinned commit.
Kamino-Finance/klend · programs
commit a08760976f · checked 2026-10-07

Whole stack published

Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2

1 Weak

Best evidence: VerifiedChecked 2026-10-07 12 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Only third-party contracts are public. The XPlace app, backend, any XPlace contracts and the card integration are closed, with no API schema published. Contracts only, so 1.

Evidence (1)1 verified

Verified
The only public code in the payment path is Kamino's klend program; no XPlace repository exists on GitHub (searches for xplace and x.place returned only unrelated projects).
Kamino-Finance/klend · programs
commit a08760976f · checked 2026-10-07

Can be self-hosted

Can a stranger reach a working deployment from the README? O3

0 Fails

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

There is no path for a third party to run the XPlace product. Kamino's program can be built, but the card product around it cannot. 0.

Evidence (1)1 documented

Documented
The Platform is licensed for personal use only; no XPlace code, build or deploy instructions are published.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Interfaces and data export

Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Free

Does the license actually let a third party fork, modify, and run it?

0 FailsPillar rating: weakest of 3
0 of 3 Partial or better · 1 no evidence

What would raise this pillar

Open-source licences reaching Weak: Source-available (BUSL, SSPL, ELv2, Commons Clause, custom) on a critical repo.
Protection against relicensing reaching Weak: CLA permits relicensing; commitment exists in docs.
No proprietary dependencies reaching Weak: Documented that production needs a hosted service with no open alternative.

Open-source licences

Does every repository needed to run the product carry an OSI-approved license? F1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The only public repo is source-available (BUSL-1.1), and the XPlace app, backend and Rain card programme are closed. Required components are closed, so 0.

Evidence (1)1 verified

Verified
klend is under Business Source License 1.1 (Licensor StroudGlobal S.A.), a source-available licence.
Kamino-Finance/klend · LICENSE
commit a08760976f · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Protection against relicensing

Can the provider unilaterally relicense future versions, and has it committed not to? F2

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

No proprietary dependencies

Does a production deployment need a proprietary plugin or hosted-only service? F3

0 Fails

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The core card product cannot run without proprietary hosted services. 0.

Evidence (1)1 documented

Documented
The card cannot run without XPlace's closed platform and Rain.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Privacy

What can an observer learn, and did the user knowingly choose it?

0 FailsPillar rating: weakest of 5
0 of 5 Partial or better · 2 no evidence

What would raise this pillar

Payments linkable onchain reaching Weak: Invoice IDs or payee tags in events, disclosed.
Third parties in the payment flow reaching Weak: Present, disclosed in docs only.
Endpoints can be changed reaching Weak: Documented workaround.

Tracking and analytics

Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1

1 Weak

Best evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Analytics is disclosed in the policies. The app is closed and no trace was run. Judgment call: disclosed and presumed on by default, so 1.

Evidence (1)1 documented

Documented
The Card Privacy Policy discloses analytics services including Google Analytics; the Platform Privacy Policy s6 mentions analytics and application performance monitoring providers without naming them.
docs.x.place/legal/legal/xplace-card-privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Data collected beyond payment

Does the flow collect anything beyond addresses, amounts, token, and chain? P2

1 Weak

Best evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

KYC and biometric data are collected beyond settlement needs. Their legal basis is disclosed, but only in a hosted policy, not in code or a versioned repo document. Documented cap, so 1.

Evidence (1)1 documented

Documented
The Privacy Policy lists government ID, proof of address, selfie and liveness biometrics, wallet addresses, transaction history and device data, each with a stated lawful basis.
docs.x.place/legal/legal/xplace-privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Payments linkable onchain

What do calldata and events reveal about who paid whom for what? P3

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Third parties in the payment flow

Which third parties see a request during a payment, and can they be swapped out? P4

0 Fails

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Rain, Sumsub and Kamino are named; the infrastructure, monitoring and analytics vendors that see app traffic are not. None is swappable. Judgment call: between 1 (disclosed in docs) and 0 (undisclosed third parties) I take the lower, because some processors are named only by category.

Evidence (1)1 documented

Documented
The policy names Sumsub, the Card Partner and Kamino, but cloud, database, monitoring and analytics processors are described by category only.
docs.x.place/legal/legal/xplace-privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Endpoints can be changed

Can RPC and indexer URLs be changed, and is the indexer code public? P5

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Security

Who can cause loss, lock users in, or change the rules?

No evidencePillar rating: weakest of 6
1 of 6 Partial or better · 4 no evidence

What would raise this pillar

Token approval scope reaching Weak: Unbounded by default, disclosed.
Funds safe if provider disappears reaching Weak: Funds retrievable only through a documented manual contract call.
Secrets and webhook handling reaching Weak: Secrets in client with a disclosed mitigation.
Audits and bug bounty reaching Weak: Audit report only (documented tier cap).

Who holds funds in transit

Who holds funds between payer and payee, and can the provider redirect them? S1

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Collateral sits in Kamino lending reserves, an upgradeable program, and the user holds the obligation; this is disclosed. Card spending is funded and settled by Rain offchain, and how USDC reaches Rain could not be observed. Upgradeable escrow, disclosed, so 1.

Evidence (2)1 verified · 1 documented

Verified
klend programData upgrade authority = GzFgdRJXmawPhGeBsyRCDLx4jAKPsvbUqoqitzppkzkW (bytes 13-45 of the account), last deployed at slot 440486775.
9uSbGW…DQGA on solana.fm
9uSbGW…DQGA explorer · block 454205477 · checked 2026-10-07
Documented
Terms s5.4; s10 discloses Protocol exploit, multisig compromise and liquidation risk.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Who can upgrade the code

Who can change the contract code, and with how much notice? S2

2 Partial

Best evidence: VerifiedChecked 2026-10-07 12 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The program that holds XPlace collateral can be upgraded by a Kamino Squads multisig, 5 of 10, after a 24-hour time lock. The members are bare keys with no published identities, and no notice channel is named in the klend repo. That is anchor 2. Judgment call: XPlace's own claimed contracts and the Rain collateral path were not found, so this score covers only the identified program; finding either could lower it.

Evidence (2)2 verified

Verified
Squads v4 multisig account (owner SQDS4ep6...) has config_authority = default (autonomous), threshold 5, time_lock 86400 s and 10 members, all with full permissions; its vault GzFgdRJX... is the klend upgrade authority (it signs VaultTransactionExecute tx uH9cTFjr...xun at slot 453889271).
6hhBGC…fQbM on solana.fm
6hhBGC…fQbM explorer · block 454205583 · checked 2026-10-07
Verified
klend programData upgrade authority = Squads vault GzFgdRJXmawPhGeBsyRCDLx4jAKPsvbUqoqitzppkzkW.
9uSbGW…DQGA on solana.fm
9uSbGW…DQGA explorer · block 454205477 · checked 2026-10-07

Token approval scope

How large an allowance does the SDK ask users to grant, and for how long? S3

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Funds safe if provider disappears Derived

If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Secrets and webhook handling

Are secrets kept out of client bundles and are webhooks signed and verified? S5

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Audits and bug bounty

Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No checkable evidence settles this yet, so it counts as 0.

Security audits 21

Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.

Date	Auditor	Type	Scope	Covers deployed code	Findings
2026-05-18	Ackee Blockchain Security	Audit	Kamino Lend full program review, 13 August to 12 September 2025, with a fix review (revision 1.1). at `1729408`	Partly	1 high, 3 medium, 7 low, 5 warnings, 2 informational; high fixed, some medium acknowledged
2026-03-30	OtterSec	Audit	Kamino Lend klend v1.16.0 and v1.17.0 PRs: fixed-term loan rollover, throttled liquidations of expired debt, reserve config cloning and related changes.	Partly	1 high, 1 medium, 4 low, 4 informational
2026-03-16	OtterSec	Audit	Kamino Lend klend v1.15.0 conditional-liquidity feature (queued, ticket-based withdrawals), klend-private PRs 627, 628, 632, 662 and 704.	Partly	2 low
2026-03	Certora	Audit	Kamino Lend klend v1.17.0 release changes (manual review).	Partly	1 high, 7 medium, 4 low, 3 informational; 12 fixed
2026-03	Certora	Audit	Kamino Lend klend v1.16.0: throttled term-based liquidations and auto-rollover (manual review).	Partly	1 high, 5 medium, 5 low, 1 informational; 10 fixed
2026-02-11	OtterSec	Security review	Kamino Lend klend v1.13.1 PR 654 (flash-loan fee disable marker), 15 to 16 December 2025.	Partly	1 suggestion
2026-02-11	OtterSec	Audit	Kamino Lend klend v1.13.0 borrow-order feature (18 PRs), 1 September to 18 October 2025.	Partly	2 medium, 1 low, 2 informational
2026-02	Certora	Security review	Kamino Lend klend v1.15.0 withdraw-ticket progress callback (manual review of a diff and PR 704).	Partly	No issues found
2026-02	Certora	Security review	Kamino Lend klend v1.14.1 PR 736 (minimum value checks; manual review). at `41232ce`	Partly	No issues; 1 informational, fixed
2026-02	Certora	Audit	Kamino Lend klend v1.14.0 withdraw queue (manual review, 25 August to 17 November 2025).	Partly	1 critical, 1 medium, 2 low, 5 informational; critical and medium fixed
2026-02	Offside Labs	Audit	Kamino Lend klend v1.14.0 withdraw queue, 2 to 5 December 2025.	Partly	1 high (fixed), 1 low (acknowledged), 2 informational (fixed)
2026-02	Offside Labs	Security review	Kamino Lend klend v1.13.1 emergency council changes, 10 to 11 January 2026. at `43fe383317`	Partly	1 informational, fixed
2026-02	Certora	Security review	Kamino Lend klend v1.13.1 PRs 630 and 656 (manual review, 13 to 14 November 2025).	Partly	No issues found
2026-02	Offside Labs	Audit	Kamino Lend klend v1.13.0 borrow orders, November to December 2025.	Partly	1 low (fixed), 1 informational (acknowledged)
2026-02	Certora	Audit	Kamino Lend klend v1.13.0 borrow orders (manual review, August to September 2025).	Partly	2 medium, 3 low, 2 informational; 4 fixed
2025-10-06	OtterSec	Formal verification	Kamino Lend: Kani-based formal verification of the healthy-to-healthy obligation invariant for several instructions (deposit, withdraw, borrow and others).	Partly	Invariant verified for the listed instructions under the stated modelling assumptions
2025-09-22	Ackee Blockchain Security	Security review	Kamino Lend fuzz testing with Trident (no manual code review), January 2025 with a later revision. at `829c1f3`	Partly	7 warnings, 1 informational
2025-05-13	Certora	Formal verification	Kamino Lend: security assessment and Certora Prover verification (reserve solvency, share value monotonicity), November to December 2024 and February 2025. at `5af6cfc`	Partly	2 medium, 1 low, 7 informational; 6 fixed
2025-02-06	Sec3	Audit	Kamino Lending program (kamino_lending), full source excluding tests. at `c02bcf7dfe`	Partly	2 low, 3 informational; 4 resolved, 1 acknowledged
2023-09-06	OtterSec	Audit	Kamino Lending program, August to September 2023 (then hubbleprotocol/kamino-lending). at `88dfca4` Early version of the program; substantially changed since.	Partly	3 high, 5 low, 5 informational
2023-07-03	RX Security	Audit	Kamino Lending program, initial launch version. at `419de5ceb0` Early version of the program; substantially changed since.	Partly	1 critical, 3 high, 3 medium, 3 low, 2 informational

Compiled from: XPlace's site and docs (the homepage says its smart contracts were audited by FYEO; no report or program address is published, and FYEO's public listings show none), the Kamino-Finance/audits repository (read at eedea0b; only the 21 Kamino Lend reports are listed, not those for vaults, farms, Scope or limit orders), Kamino's docs security pages (audits, formal verification, fuzzing), and the klend repository. Rain's Solana collateral program is unidentified, so its audits are not listed. The deployed klend program is the verified build of release v1.25.0 (a08760976f, August 2026); the newest published klend reports cover v1.17.0 (March 2026), so v1.18 to v1.25 changes have no published report and every entry is at most partly current. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.

Operational and procurement

Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.

Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 16 evidenced, 2 attested, 7 absent, 0 not applicable, 20 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.

Group A: operational facts

Fees

Evidenced

Component	Paid by	Amount	Basis
provider	payer	Annual membership Basic free, Silver 99, Gold 249, Platinum 999 USDC	Terms s6.1 (effective 20 May 2026); XPlace may change fees with 30 days' notice.
card	payer	Card transaction fee 0% (all tiers)	Terms s6.3.
fx	payer	XPlace FX fee 1% / 0.5% / 0.25% / 0% by tier, plus Visa's 1% FX fee	Terms s6.3 and the card overview page; the October 2025 card terms list FX and cross-border fees as 0%, which conflicts.
cashout	payer	Bank transfer fee 2% / 1.5% / 1% / 0.5% by tier	Terms s6.3; applies to transfers to or from a linked bank account.
provider	payer	Trading fee 1% / 0.9% / 0.7% / 0.5% by tier; Credit Mode borrow APR variable from Kamino	Terms s6.3 and the Credit page; a Credit Mode fee is named in the terms without a rate.
card	payer	Late payment up to 40 USD (international) or 2% of balance (US); returned payment up to 29 USD	Card terms important disclosures; purchases carry 0% APR.
limit	none	Monthly spend 2,000 / 10,000 / 50,000 / 750,000 USD; per transaction 1,000 / 3,000 / 10,000 / 25,000	Terms s6.1 by tier (Basic, Silver, Gold, Platinum); may vary with KYC level.

Solana network fees and the bridge deposit fee named in s6.3 have no stated amount, so they are unknown, not zero. The card terms (October 2025) and the platform terms (May 2026) disagree on FX; both are listed.

Documented
Terms s6.1 membership table and s6.3 transaction and platform fee table.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Card overview, foreign currency spending.
docs.x.place/card/about-xplace-sard
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Credit page, borrow APR.
docs.x.place/xplace/credit
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
International card terms (25 October 2025), fees table.
docs.x.place/legal/legal/card-terms-international-user
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Custody model

Evidenced

Hybrid: self-custody with a provider-controlled spend path

Agrees with S1 (score 1): collateral sits in Kamino's upgradeable lending program under the user's obligation, from an embedded wallet in XPlace's closed app. Card spending is funded and settled by Rain offchain; Cash Mode USDC is deposited onto the card balance, which the issuer controls. Judgment call: hybrid, because the card side is custodial with Rain while collateral is not held by XPlace.

Evidence shared with CROPS: S1 item 1, S1 item 2

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Licences and registrations

Evidenced

Entity	Country	Regulator	Licence	Register
Odoakpu Microfinance Bank Nigeria Limited partner	Nigeria	Central Bank of Nigeria	Microfinance bank Markets the card to Nigerian users and is responsible for CBN compliance and Nigerian data protection for it (card terms s7.4).	register

Only the Nigerian partner is evidenced from a register. Pontech Group L.L.C-FZ (the provider) does not appear in the VARA public register (vara.ae, server-rendered, read 2026-10-09), and the terms say XPlace is not a money transmitter or financial intermediary; no other UAE register was searched. Rain (Signify Holdings, Inc.) is described as 'a licensed card program manager and issuing sponsor' without a licence named; the international issuer is named only as 'Third National' and was not identified in a register; the US issuer is not named. Rain MENA FZE holds a VARA licence (VL/26/10/001) but XPlace does not name it.

Documented
CBN microfinance bank list (client-rendered from /api/GetMFBs) includes ODOAKPU MFB, id 3799; no licence category or date is given.
www.cbn.gov.ng/supervision/Inst-MF.html
checked 2026-10-09
Documented
International card terms s7.4, for Nigerian users.
docs.x.place/legal/legal/card-terms-international-user
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Cash-out options

Evidenced

Where	Method	Partner	Fee	Limits
everywhere offered	card spend	Signify Holdings, Inc. (Rain), issuer Third National, Visa	0% card fee; FX 1% Visa plus 0 to 1% XPlace by tier	2,000 to 750,000 USD per month and 1,000 to 25,000 per transaction by tier
everywhere offered	bank transfer		2% to 0.5% by membership tier	Partner, currencies and countries not stated

ALL means every country not on the 17-country blocklist (and not in the 16 restricted US states). The US card terms mention PIN cash withdrawals at ATMs "if enabled" with no cash advance fee, but no XPlace page says ATM withdrawal is offered, so no ATM row is recorded.

Documented
Terms s5.1 (card settlement by the Card Partner) and s6.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Portfolio page lists sending to an external wallet or bank account; the fee is in Terms s6.3.
docs.x.place/xplace/portfolio
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

First deployment

Unknown

XPlace publishes no address for its own (FYEO-audited) contracts or for Rain's Solana collateral program, and card settlement is offchain. The listed klend program is Kamino's, deployed long before XPlace existed, so its date would not describe XPlace. The earliest dated XPlace documents are the EULA and cookie policy (effective 15 October 2025).

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Operating entity

Evidenced

Pontech Group L.L.C-FZ, AE-DU

The L.L.C-FZ suffix and Meydan address indicate a Meydan Free Zone company; no company register entry could be read (no public search without a browser), so no register URL or number is given.

Documented
Terms name Pontech Group L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, as the contracting party.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Security incidents

Unknown

Absence of a found incident is not evidence that none occurred.

Searched: XPlace docs, terms, privacy policies and homepage; no incident disclosure or log found. XPlace has no public repository with advisories. Kamino incidents were not searched, since XPlace's market is not identified.

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Product changes affecting users

Evidenced

2025-10-15: EULA and cookie policy take effect (earliest dated XPlace documents). source
2025-10-25: Card terms (US and international) and card privacy policy published; international issuer Third National, 0% FX and cross-border fees. source
2026-05-20: New terms and privacy policy take effect, with the tiered fee table (FX 0 to 1%, bank transfer 0.5 to 2%) and Kamino named as the protocol. source

Documented
EULA effective date.
docs.x.place/legal/legal/end-user-license-agreement-eula
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
International card terms effective date.
docs.x.place/legal/legal/card-terms-international-user
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Terms effective date.
docs.x.place/legal/legal/xplace-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Volume transacted (verified only)

Not observable

Card payments are authorised, cleared and settled offchain by Rain over Visa; XPlace publishes no address for its own contracts or for the Rain collateral program, and the Kamino market used for XPlace collateral is not identified. The chain is Solana, which the EVM log spec cannot express.

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Group B: institutional due diligence

Control	State	What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?	Unknown	No ISO 27001 statement found for Pontech Group L.L.C-FZ in the XPlace docs, terms, privacy policies or homepage.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?	Unknown	No hosting or support organisation certification found; the privacy policy names cloud, database and APM providers by category only.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?	Unknown	No SOC 2 or ISAE report or statement of availability found.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?	Attested	The homepage says XPlace's smart contracts are audited by FYEO; no report, scope, date or contract address is published (CROPS S6 unknown). Kamino's klend audits are the protocol's own. source 1
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?	Unknown	No penetration-test report or attestation found; the privacy policy's "vulnerability testing" statement is recorded under B1.6.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?	Evidenced	The privacy policy states "regular security assessments and vulnerability testing of Platform infrastructure"; no cadence or tool is given. source 1
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?	Absent	none of 1 repo(s): Kamino-Finance/klend ✗ no security policy file source 1
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?	Unknown implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?	Absent	none of 1 repo(s): Kamino-Finance/klend ✗ no scanning config or workflow step found source 1
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?	Evidenced	For a personal data breach posing a high risk, affected users are notified "promptly and without undue delay" once confirmed and the supervisory authority within 72 hours where the law requires; breaches at the Card Partner or Kamino fall to their own incident response. No 24-hour commitment. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?	Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?	Unknown implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?	Unknown implied from the component list
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?	Evidenced	Sign-up by email, Google or Apple ID, then a 6-digit app PIN with optional Face ID; the card has a 4-digit PIN. No separate second factor is documented. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?	Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?	Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?	Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?	Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?	Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?	Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?	Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?	Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?	Evidenced	Personal data encrypted in transit (TLS/SSL, version not stated) and at rest; card data encrypted in transit and at rest and full card numbers not stored by XPlace. No data classification is stated. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?	Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?	Evidenced	Account and identity data and KYC/biometric data for the account's life plus 5 years; transaction records at least 5 years; usage and analytics data up to 24 months; support data 3 years after ticket closure; then deleted or anonymised. On-chain data cannot be deleted. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?	Evidenced	Pontech Group L.L.C-FZ is the controller; where it passes KYC data to the Card Partner, it acts as processor and the partner is controller; Sumsub and infrastructure providers are processors under DPAs. No DPIA is mentioned. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?	Attested	Standard Contractual Clauses for EEA transfers are available on request by email; no published DPA for customers. source 1
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?	Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?	Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?	Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?	Absent	none of 1 repo(s): Kamino-Finance/klend ✗ no deployment configuration source 1
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?	Evidenced	all of 1 repo(s): Kamino-Finance/klend ✓ rules: repository_visibility, repository_delete, repository_transfer, required_signatures, deletion, non_fast_forward, pull_request source 1
B9.2 CI runs on pull requests Does every pull request trigger automated checks?	Evidenced	all of 1 repo(s): Kamino-Finance/klend ✓ 1 workflow file(s) source 1
B9.3 Tests run in CI Do the CI workflows run the test suite?	Evidenced	all of 1 repo(s): Kamino-Finance/klend ✓ test command in a workflow source 1
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?	Absent	none of 1 repo(s): Kamino-Finance/klend ✗ coverage tooling referenced source 1
B9.5 Versioned releases Are releases tagged with immutable semantic versions?	Absent	none of 1 repo(s): Kamino-Finance/klend ✗ latest tags: release/v1.26.0, release/v1.25.0, release/v1.24.0 source 1
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?	Evidenced	all of 1 repo(s): Kamino-Finance/klend ✓ 10 of 10 recent commits signed source 1
B9.7 Changelog Is a changelog maintained with the code?	Evidenced	all of 1 repo(s): Kamino-Finance/klend ✓ 10 release(s) with notes source 1
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?	Absent	none of 1 repo(s): Kamino-Finance/klend ✗ none found source 1
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?	Absent	Searched: the docs.x.place index and every product and card page, the homepage, GitHub (no XPlace organisation). source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?	Evidenced	Pontech Group L.L.C-FZ, Meydan Grandstand, Dubai, UAE; terms under UAE law with DIAC arbitration in Dubai. The card is a three-party agreement with the issuer (Third National for international users). No company register entry was found; Meydan Free Zone has no public search that could be read without a browser. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?	Evidenced	Annual membership fees (0 to 999 USDC) and per-use fees (FX, bank transfer, trading, Credit Mode); cashback is paid out of those fees. No annual report was found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?	Evidenced	XPlace may suspend or terminate without notice on listed grounds, and suspend Kamino or Credit Mode access on a protocol incident; the user terminates by emailing legal@x.place after repaying Credit Mode balances; XP, cashback and membership are forfeited with no refund. Collateral stays in Kamino under the user's obligation (S1). source 1 CROPS S1
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?	Evidenced	The privacy policy says KYC and sanctions screening may involve automated decision-making including profiling with significant effects; Sumsub runs biometric verification and the Card Partner does transaction monitoring. Whether a learned model is used is not stated. source 1 CROPS C4
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?	Evidenced	Users may request human review, give their view and contest an automated decision (override); monitoring, validation, decommissioning and bias evaluation are not documented. source 1

Scope of assessment

Components in the payment path

Component	Role	Public	Licence	Operator	Required
Kamino Lending program (klend)	contracts	Yes	BUSL-1.1	Kamino (upgrade key held by a Squads 5-of-10 multisig)	Yes
XPlace mobile app and embedded wallet sign-in (email, Google, Apple)	wallet	No	proprietary	Pontech Group L.L.C-FZ (XPlace)	Yes
XPlace backend (credit mode, card funding, XP, membership)	backend	No	proprietary	Pontech Group L.L.C-FZ (XPlace)	Yes
XPlace smart contracts (claimed, address not published)	contracts	No	proprietary	Pontech Group L.L.C-FZ (XPlace)	No
Rain card programme (Card Partner; authorization, clearing, fiat settlement)	card-issuer	No	proprietary	Signify Holdings, Inc. (Rain)	Yes
Visa card network	card-network	No	proprietary	Visa	Yes
Sumsub identity verification	kyc	No	proprietary	Sumsub	Yes

Repositories

Repository	Role	License
Kamino-Finance/klend	contracts	BUSL-1.1

Contracts

Role	Address	Source verified
Kamino Lending program (upgradeable; collateral and credit)	`KLend2…gmjD` explorer	verified-build
Kamino upgrade multisig (Squads v4, 5-of-10, 24 h lock)	`6hhBGC…fQbM` explorer	none

Assessor notes

Type card: Kamino's klend program is a verified build of a public repo, and XPlace's Terms make it the protocol through which Collateral and Credit Mode run. Judgment call: klend is third-party and no XPlace user position was found onchain, so the link rests on XPlace's Terms; Cash Mode (plain USDC balance) may not touch Kamino at all. XPlace's own "smart contracts audited by FYEO" (homepage) and Rain's Solana collateral program have no published address; Rain's integration repo SignifyHQ/collateral-contract-integration-examples has IDLs but no mainnet program id. The Kamino market XPlace uses was not identified (none of the 44 markets in api.kamino.finance is named for XPlace). Solana items carry no `check` because the nightly re-check reads EVM words only.

At a glance

Holds up 1

Falls short 14

Not yet evidenced 8

Where it is offered

Settlement token

What would raise this pillar

What would raise this pillar

What would raise this pillar

What would raise this pillar

What would raise this pillar

Security audits 21

Group A: operational facts

Group B: institutional due diligence

Scope of assessment

Components in the payment path

Repositories

Contracts

Assessor notes