Velocity smart contracts: programs, addresses, administration
Open-source code, a fresh program deployment and a tiered key model
Velocity is built as a fully open on-chain protocol: the velocity-v1 monorepo is published on GitHub together with the program's Rust sources, the TypeScript SDK and migration documentation. The protocol inherited the battle-tested Drift v2 architecture but was deployed as a brand-new program — from scratch, under a new address, with a reworked privilege model.
Below are the verified mainnet program addresses and key architectural facts for developers and analysts.
Registry of verified addresses (Solana mainnet)
| Component | Address | Purpose |
|---|---|---|
| Velocity Protocol core |
vELoC1audYbSYVRXn1vPaV8Axoa9oU6BYmNGZZBDZ1P | Perpetual markets, cross-margining, spot collateral, insurance funds |
| Velocity Vaults Delegated pools |
vAuLTsyrvSfZRuRB3XgvkPwNGgYSs9YRYymVebLKoxR | Managed trading vaults with share-based accounting |
| USDT (quote mint) Settlement asset |
Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB | The base collateral and PnL settlement currency of all perpetual markets |
| Drift (legacy) For reference |
dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH | The halted Drift program; no state carried over to Velocity |
An integrator's note: the global-state PDA seed was renamed from drift_state to velocity_state. All PDA addresses (users, markets, vaults) must derive from the new program ID — reusing addresses from the former deployment is impossible by definition.
The tiered admin-key model
The main architectural lesson of the April incident — privilege concentration in a single administrator — is solved by role separation. Instead of one State.admin, the program operates four key levels:
- cold_admin — critical, rarely changed configuration: appointing the protocol-fee recipient (
protocolFeeRecipientPerp/Spot) and structural parameters. This key is expected to stay in cold storage. - warm_admin — parametric market management without the right to change payout recipients.
- hot keys — high-frequency operational actions (for example, protocol-fee withdrawals via the dedicated
FeeWithdrawkey). - pause_admin — emergency stops of individual functions or the whole protocol.
Protocol-fee withdrawals are additionally recipient-locked: funds from the protocol_fee_pool go strictly to the address fixed by cold_admin, and a withdrawal can never exceed the pool's balance — user deposits are technically untouchable. The durable-nonce mechanism that let attackers obtain the Security Council's signatures in April has been removed from the program completely.
Oracle infrastructure: Pyth and Pyth Lazer
Market pricing relies on Pyth (a push oracle) and Pyth Lazer — a low-latency real-time delivery service. Switchboard support was removed: configurations with that source are marked deprecated and fail to load a price. For prelaunch markets with no external spot price yet, an internal mark-TWAP oracle with a hard ceiling is used — a self-referential design in which funding payments encourage the price back toward a stable level and limit the room for manipulation.
Each market also operates an oracle confidence band and TWAP-sanitization rules tied to its contract tier: the riskier the market, the tighter the acceptable price-divergence corridor.
The Velocity Vaults program
Delegated trading pools live in a separate program — vAuLT… — with its own SDK. A vault manager receives delegated authority over the trading account, while depositors hold shares protected from dilution: watermark profit-share mechanics, a hurdle rate, a redemption period and a ban on managers withdrawing funds directly in the Normal vault class. Raising a manager's fees is possible only through a timelock of at least max(1 week, 2× the redemption period); lowering them takes effect immediately.
Frequently Asked Questions
Do Drift addresses and accounts carry over to Velocity?
No. Velocity is a completely new program deployment with its own ID: every PDA address (state, users, markets, vaults) derives from the new program address, and no on-chain state from the former Drift deployment carries over. Even one service account's seed was renamed: drift_state became velocity_state. Addresses derived from the old program cannot be reused on Velocity.
How are the protocol's administrative functions protected?
Drift's single administrator is split into tiers: cold_admin (critical configuration, including appointing the protocol-fee recipient), warm_admin, operational hot keys and a pause_admin for emergency stops. Protocol-fee withdrawals are locked to a fixed recipient and require a dedicated FeeWithdraw hot key, and raising vault fees goes through a timelock of at least one week.
Which oracles does Velocity use?
Price feeds are supplied by Pyth (push) and Pyth Lazer — Pyth's low-latency push service. Switchboard support has been fully removed: markets configured with the deprecated Switchboard source fail to load a price. For prelaunch markets with no external spot price, an internal mark-TWAP oracle with a hard price ceiling is used.