Lulo

Lulo is a stablecoin yield app on Solana, at lulo.fi. It is not the Colombian fruit or Lulo Bank. You deposit a stablecoin such as USDC, and Lulo spreads it across several lending protocols to earn interest. What sets it apart is built-in cover. Its Protected deposits are paid back automatically if a protocol Lulo uses is hacked or runs up bad debt. That cover is funded by a second, riskier deposit type called Boost. Boost earns more because it takes losses first. In October 2026 it did: Boost deposits fell about 6.4% after losses at Neutrl, a protocol in Boost's yield strategy.

How Lulo routes stablecoins across Kamino, Jupiter, Morpho and Maple

Lulo is a yield aggregator. You make one deposit, and Lulo spreads it over many lending markets. It does not chase the single best rate. It gives each market a share based on its size and its rate, much like an index fund. Lulo's how it works page says fixed rules set the split, and no manager picks. The split shifts as market sizes and rates change.

Your deposit passes through Lulo's smart contracts into the markets below. On 31 October 2026, the Lulo homepage listed six: Morpho, Kamino Finance KMNO$0.034-9.7%, Maple Finance, Pendle, Jupiter JUP$0.244-6.5% and Neutrl. Some are on Solana and some on Ethereum, so a deposit can earn on Ethereum markets without you bridging funds yourself.

Lulo takes seven stablecoins: USDC, USDT, USDS, USDG, PYUSD, JupUSD and CASH. JupUSD is Jupiter's own stablecoin. It was added in June 2026, as we covered when JupUSD went live on Lulo. Each coin earns a different rate, shown live on Lulo's site.

Lulo's integrated protocols page sets the bar a market must clear. Its code must be open and audited. Its team must have a track record. And it must hold large deposits with no history of lost funds.

Lulo Protected vs Boost: coverage, lockups and yield

Protected is the safer, lower-yield choice. Boost pays more because it is the insurance pool. Both earn the same base lending yield. Boost depositors also get a slice of Protected depositors' interest. In return, Boost absorbs losses first if a covered protocol fails. Protected has no lockup. Boost has one, though Lulo's docs don't say how long.

Think of it like a bond with two slices. Protected is the senior slice, paid back first. Boost is the junior slice, paid more for standing in front of the loss.

Lulo's Boost page says the premium rises when there is less Boost money relative to Protected, so fewer Boost depositors each earn more. Boost needs a lockup because its money has to stay put to pay out claims. A severe failure can wipe out part or all of a Boost deposit.

For Protected, cover is automatic. You file no claim and nobody reviews it by hand. Per Lulo's coverage page, it pays out for three events at an integrated protocol: a contract exploit, an oracle failure (a bad price feed) or bad debt. Lulo says it can handle a total loss at any single protocol, "as long as the coverage pool is sufficient."

Performance fee and the lifetime referral programme

Lulo charges a 10% fee on the yield you earn. There is no fee to deposit or withdraw, per the Lulo homepage. The fee comes out of your interest only, never out of the money you put in.

Here is how that works. Say your deposit earns $50 of interest in a year. Lulo keeps $5 and you keep $45.

Lulo also runs a lifetime referral scheme. RockawayX, which wrote up Lulo's iOS launch, says a $100 deposit unlocks a referral code. Half of Lulo's fee on a deposit you refer then goes to you, for as long as that deposit stays.

Using the app.lulo.fi web app, iOS app and API for wallets

You can use Lulo in three ways: the web app at app.lulo.fi, the iOS app, or inside another app that has built Lulo in. On the web, you connect a Solana wallet and deposit a stablecoin. Then you pick Protected or Boost. You can take money out of Protected at any time.

The iOS app, Lulo Finance, launched in mid-2025. It looks like a savings app, with no charts or trading. RockawayX says you can fund it with a USDC transfer or through Coinbase. When we checked on 31 October 2026, the App Store page said "not found". The Lulo homepage no longer mentioned the app either. Check that it works in your country before you rely on it.

Builders can plug Lulo into their own apps. The API reference shows calls that build deposit and withdrawal transactions and fetch live rates. You need a key from Lulo's developer site, dev.lulo.fi. The Lulo homepage claims more than 50 business integrations in production, naming Solflare, Fuse and Decaf.

Who Lulo suits, and who should skip it

Lulo suits stablecoin holders who want one hands-off deposit rather than several lending positions to watch. Protected fits savers who will give up some yield for cover against a protocol hack or bad debt. Boost fits people who understand they are the insurer, and who can live with a lockup and a real chance of loss.

Skip Lulo if you want to choose your own venues. The allocation is rules-based and you cannot steer it. Skip Boost if you need to withdraw at short notice. And if a stablecoin losing its peg is your main worry, Lulo does not cover it.

Larger depositors should also note that Lulo adds a 10% fee on top of the yield each underlying protocol pays. For someone comfortable running positions on Kamino or Jupiter directly, that fee pays for automation and cover. The base rate underneath is the same.

Is Lulo safe? Audits, custody and what coverage excludes

Five security firms have audited Lulo: Certora, Halborn, OtterSec, Offside Labs and Sec3, per its audits page. Audits cut risk but do not end it. Lulo's cover also has limits. It pays out only when a market Lulo uses fails. It does not pay for a bug in Lulo's own code, a stablecoin losing its peg, a chain outage, or action by regulators.

Lulo does not keep your money in a vault of its own. It sends it on to other protocols. SolanaFloor called this "directed liquidity" for that reason. So you carry the risk of each market Lulo uses, plus the risk of Lulo's own code.

The audits page gives no dates or scope. Certora's report page says its review ran from 18 November 2024 to 23 January 2025. It checked Lulo's Solana programs. It found critical bugs in price updates, referral fees and withdrawals. The page does not say if they were fixed. Code changed after that review is not covered by it. We found no public scope for the other four audits, or for any contracts Lulo uses to reach Ethereum markets.

Lulo's risk framework says its contracts can only deposit into and withdraw from approved protocols. Lulo also watches each protocol and can pause allocations if problems appear. The docs do not say who can upgrade Lulo's own programs. They list no program addresses, and we hold none for Lulo. So we could not check if upgrades need a multisig (several signers) or one key. Treat that as an open question.

Some markets carry more credit risk than the word "lending" suggests. Lulo's integrated protocols page says Maple lends to vetted firms with less collateral than the loan. It says Neutrl earns yield from trades built to avoid a bet on market direction.

The Neutrl loss: Boost's 6.4% drawdown in October 2026

On 20 October 2026, Lulo posted on X that Boost deposits would take a drawdown of about 6.4%. The cause was Lulo's exposure to Neutrl Finance, a synthetic-dollar protocol used in Boost's yield strategy. Protected capital was unaffected, and Lulo said this was not a hack or a smart contract exploit.

Neutrl paused minting and redemptions of its NUSD dollar token on 14 August 2026. It said unnamed events had hit its reserves, Cointelegraph reported. In its post, Lulo said Neutrl had lost money on positions in its strategy. Neutrl then opened redemptions at about 51 cents per NUSD, so holders get back roughly half.

Lulo said the loss was kept to Boost, which by design takes risk on for Protected savers. But part of Boost's yield came from a synthetic-dollar strategy layered on top of lending. Lulo admitted many depositors may not have heard of Neutrl before the loss. On 31 October 2026, the Lulo homepage still listed Neutrl as a venue. If you hold Boost, find out where its yield comes from.

Lulo vs lending directly on Kamino or Jupiter

Lulo is the choice for one deposit with cover. Lending directly on Kamino or Jupiter is the choice for control and no extra fee. Deposit on a single market and you earn its rate in full, but you carry that market's risk alone. Lulo spreads your money over several markets, adds cover for Protected deposits, and takes 10% of the yield.

The trade-off is clearest in a bad week. If one market Lulo uses were drained, a Protected depositor would be paid from the Boost pool. A depositor sitting only in that market would have no such pool. In return, Lulo stacks risks: its own contracts sit on top of every protocol it uses.

In 2024, SolanaFloor described Lulo sending deposits to Solana apps such as Kamino and Drift Protocol DRIFT$0.012-7.3%. Its current mix adds Ethereum venues like Morpho, Maple and Pendle, which widens its yield sources and its exposure to them.

Lulo token, team and history: from FlexLend to Lulo

Lulo has no token and no DAO. Rules in its smart contracts and its allocation method set where deposits go, so depositors have no vote on venues.

Co-founder and CEO Daniel told the Solfate podcast in February 2025 that the idea began at a Solana hacker house in Miami. The team first built an order book for loans. Then, at the end of 2023, they built a simple aggregator called FlexLend over a weekend. It soon outgrew their main product, so they shut the order book. FlexLend became Lulo. Our summary of that Solfate episode has more.

In July 2024 Lulo added PayPal's PYUSD and joined Circle's Alliance programme, SolanaFloor reported. Within weeks PYUSD made up just over half of Lulo's deposits.

The iOS app followed in 2025. JupUSD support came in June 2026, and the Neutrl loss in October 2026.