Carrot

Carrot was a Solana-based DeFi yield protocol that operated as an automated yield hub for stablecoin holders and leveraged traders. It ran for over two years on Solana mainnet before shutting down on April 30, 2026, after losses from the Drift protocol exploit made continued operations unsustainable. The shutdown marked one of the more visible casualties of the Drift hack, which drained approximately $285 million from the Solana lending ecosystem in early April 2026.

What Carrot Was

Carrot's core proposition was straightforward: give users automated access to Solana DeFi yields without requiring them to actively monitor, rebalance, or manage positions across multiple protocols. The team described it as a "yield operating system" — infrastructure that sat above individual DeFi protocols and routed capital between them on users' behalf. Its tagline, "Earn Yield. Stay Liquid. Be Stable," encapsulated the three properties the protocol aimed to deliver simultaneously.

The protocol offered three main products — CRT (an automated yield-bearing stablecoin), Boost (leveraged yield farming), and Turbo (managed leveraged token exposure) — plus an underlying lending infrastructure that powered the leverage products. Smart contracts were audited by Sec3 and MadShield. All products charged zero management fees and imposed no lockup requirements on deposited funds.

CRT: Automated Yield-Bearing Stablecoin

CRT was Carrot's flagship product and the most widely adopted. Users deposited USDC, USDT, or PYUSD into the CRT vault and received CRT tokens representing their share of the pool. The vault then automatically routed deposited capital across eight or more Solana lending protocols — including Kamino, MarginFi, Solend, and Meteora — continuously rebalancing to chase the best available yield rate. CRT holders saw their token appreciate in value as yields accrued to the vault; there was no separate claim or harvest step required.

The automated rebalancing addressed a practical problem in Solana DeFi: lending rates across protocols fluctuate frequently and the spread between the highest and lowest rates at any given moment can be substantial. Manually monitoring and moving funds between protocols to capture that spread imposes time costs and transaction fees that erode net yield. Carrot socialized those operational costs across the vault, making continuous optimization economically viable for depositors of any size.

CRT's yield ran between approximately 9% and 20% APY depending on market conditions. The token accrued value continuously — a CRT token's net asset value in stablecoin terms increased over time rather than paying out periodic distributions. This structure made it composable: other protocols could accept CRT as collateral knowing it represented a self-appreciating stablecoin position.

Boost: Leveraged Yield Farming

Boost allowed users to amplify returns on yield-bearing assets by applying automated leverage. Supported collateral included JLP (Jupiter's liquidity pool token), FLP, and ONyc. Users deposited a yield-bearing asset, chose a leverage level, and Carrot's automation handled the borrowing and looping: borrowing stablecoins against the collateral, redeploying them into more yield-bearing positions, and repeating the cycle. The protocol automatically rebalanced when borrow costs or collateral ratios shifted.

The Boost product targeted users comfortable with leveraged exposure who wanted amplified yield without managing the operational complexity of manual looping strategies. The product included health factor monitoring — an indicator of how close a position was to liquidation — so users could track their risk exposure in real time.

Turbo: Managed Leveraged Token Exposure

Turbo offered a different type of leverage: directional price exposure to assets including SOL, BTC, and GOLD, expressed through vault tokens that maintained a target leverage ratio automatically. Rather than requiring users to manage a leveraged perp position, Turbo vaults handled rebalancing to maintain target leverage as prices moved. Users who wanted, say, 2x long SOL exposure could hold a Turbo SOL vault token and the protocol would maintain that exposure level dynamically.

The product was positioned for users who wanted enhanced market exposure to specific assets without the operational burden of actively managing a leveraged position and the liquidation risk that comes with it. Turbo vaults were Carrot's second live program on Solana mainnet, classified in on-chain metadata as a derivatives product.

The Drift Exploit and Shutdown

On April 1, 2026, the Drift protocol — a major Solana derivatives and lending platform — was exploited for approximately $285 million. The attack used a novel durable nonce technique combined with a coordinated social engineering campaign in which attackers posed as quantitative traders over several months to distribute malware and compromise administrative controls.

Carrot had meaningful exposure to Drift-integrated positions within its CRT vault. When Drift's TVL was drained, approximately 50% of Carrot's total value locked faced impairment. The team paused mint and redeem functions for CRT on April 1 and published a series of updates as they worked to assess the damage and wind down remaining positions across other protocols.

By mid-April, the team had established that CRT holders faced roughly a 50% loss on affected funds. The adjusted redemption price settled at approximately $57.52 per CRT — a figure reflecting the net asset value of remaining liquid assets after accounting for Drift losses and a separate 2.6% drawdown on PYUSD balances deposited with Project0, which was also affected by the broader exploit. The team took a snapshot of CRT holdings at 20:00 UTC on April 1 and committed to distributing any future recovery amounts from Drift proportionally via an IOU token, even for holders who had already redeemed.

Redemptions reopened on April 15. On April 30, the team announced the protocol would permanently close. The announcement cited the Drift exploit as "catastrophic for continued operations." Users had until May 14, 2026, to voluntarily withdraw from all three products. After that deadline, remaining Boost and Turbo positions would be force-deleveraged to 1x leverage. Throughout the wind-down, the team emphasized that all deposited funds remained user property and that no management fees would apply during the exit period.

Solana's Role

Carrot's design was specific to Solana's architecture. The protocol's automated rebalancing depended on Solana's high transaction throughput and low per-transaction fees to make frequent capital movements economically viable — on a chain with variable or high fees, the cost of continuous rebalancing would erode the yield advantage it sought to capture. Carrot also took advantage of Solana's composability, integrating across a wide range of Solana-native lending protocols from a single vault interface and building composable tokens (CRT, Turbo vault tokens) that other Solana protocols could use as collateral.

This same deep integration into the Solana DeFi ecosystem was a contributing factor in Carrot's vulnerability. The protocol's yield generation depended on the health of the underlying protocols it routed capital through. When a major node in that ecosystem — Drift — suffered a catastrophic exploit, Carrot had insufficient isolation to absorb the impact.

Status

Carrot is no longer operational. The protocol shut down on April 30, 2026. The website and documentation remain accessible as of mid-2026, and a dedicated redemption page was available for users to exit their positions during the wind-down period. The team committed to honoring any future Drift exploit recovery distributions to CRT holders via the IOU token mechanism, but the protocol itself has ceased operations.