XOXNO Lending on Stellar: Spokes, Flash Loans, LP Collateral

XOXNO Lending by the numbers (October 2026)

Measure	Value	Source
Stellar TVL	$131K	DefiLlama, 6 Oct 2026
Borrowed on Stellar	$48K (mostly USDT0 and USDC)	DefiLlama
Tracked since	2 September 2026	DefiLlama
Hubs / spokes / markets	3 / 9 / 31	configs/mainnet
Flash-loan fee	9 bps (0.09%)	markets.json
USDC supply rate	2.66%	DefiLlama yields, 6 Oct 2026
SCF award	$135K Build award, SCF #43	communityfund.stellar.org

For scale, XOXNO's MultiversX deployment held about $944K on the same day, and Blend held about $162.8M on Stellar. The Stellar Community Fund lists the project under Financial Protocols with a team of two, its $135K award fully paid.

How to choose a spoke

Because an account is bound to its spoke permanently, the spoke is the first decision, not the asset:

• Borrowing one stablecoin against another: Stables & FX gives the highest LTVs (USDC 88%, PYUSD 86%, EURC and USDT0 84%) and also accepts USDY, USST and Spiko funds at 80%.
• Borrowing against XLM, USDC or BTC: Blue Chip, where everything can be both collateral and debt.
• Borrowing against an Aquarius LP: AMM Collateral, or a themed spoke (Aquarius Ecosystem, Ondo RWA, Commodities) if you also hold that theme's base asset.
• Borrowing against tokenised Treasuries: Etherfuse RWA, Spiko RWA, Centrifuge RWA or Ondo RWA. Our guide to RWA collateral covers the general trade-offs, and Etherfuse stablebonds explains CETES and USTRY.

Accounts are NFTs

Every XOXNO position lives in an account represented by a position NFT. Whoever holds the NFT controls the whole account: its collateral, its debt and the right to withdraw. Accounts are created on first supply, multiply or flash position, and bound to one spoke for their lifetime.

This makes positions portable. You can hold several accounts in different spokes, and a position can change hands in one transfer. The project's threat model is blunt about the downside: approving an NFT operator "enables transfer of the entire position, including collateral and debt. This is not a narrowly scoped permission to handle a collectible." Treat any approval prompt on the NFT as a request to hand over the account.

Hubs and spokes: where the risk boundaries sit

A hub groups market books, each with its own cash, interest indexes and rate curve. A spoke chooses which of those markets an account can use, and with what risk settings. The mainnet configuration has hubs for Core assets, RWAs and AMM tokens, and nine spokes on top.

Spoke	Collateral	Max LTV	Borrowable
Blue Chip	XLM, USDC, EURC, PYUSD, USDT0, SolvBTC, xSolvBTC	60–76%	All seven
Stables & FX	USDC, EURC, PYUSD, USDT0, USST, USDY, six Spiko funds	80–88%	USDC, EURC, PYUSD, USDT0
Etherfuse RWA	USTRY, CETES	60%	USDC, XLM, EURC, PYUSD
Spiko RWA	Six Spiko money-market funds	60%	USDC, XLM, EURC, PYUSD
Centrifuge RWA	deJTRSY, deJAAA	60%	USDC, XLM, EURC, PYUSD
Ondo RWA	USDY, USDY/USDC LP	80% / 50%	USDC, XLM, EURC, PYUSD
Commodities	XAUM, XAUM/USDC LP	65% / 50%	USDC, XLM, EURC, PYUSD
AMM Collateral	Nine Aquarius LP tokens	50%	USDC, XLM, EURC, PYUSD
Aquarius Ecosystem	AQUA, XLM/AQUA LP, AQUA/USDC LP	55% / 50%	USDC, XLM, EURC, PYUSD

Two design choices matter. RWAs, AQUA and LP tokens are collateral-only: nobody can borrow them, so a mispriced RWA cannot be borrowed out and dumped. And borrowing out of a themed spoke is capped separately. In AMM Collateral, for example, total USDC borrowing is capped at 62,000 USDC, so capacity is deliberately small while the LP oracle builds a record.

Liquidations are not a fixed close factor. Each spoke sets a target health factor (1.15 in most, 1.02 in Stables & FX), and repayment is sized to bring the account back toward it, with a bonus that grows as health falls further.

Flash loans and multiply

XOXNO offers two kinds of flash liquidity. A cash flash loan sends tokens to a receiver contract and pulls back principal plus a 9 basis-point fee in the same transaction. A flash position mints debt without a fee, but the transaction must finish with a solvent account.

The multiply function packages the second kind for users: it flash-borrows the debt asset, swaps it through XOXNO's swap aggregator, supplies the result as collateral, and checks health once at the end. Modes are Multiply, Long and Short. Related functions swap collateral, swap debt, repay debt with collateral, and migrate_from_blend moves an existing Blend position into a new XOXNO account, from pools governance has approved.

The architecture document adds a caveat worth repeating: the controller checks that the swap produced output and that the final account is healthy, but "these checks do not guarantee route quality". Slippage on the swap leg is your cost. For the leverage maths on an LP position, see Aquarius LP tokens as collateral.

Position managers and delegates

An account owner can grant up to 16 delegates the right to act on the account, but only addresses that governance has registered as active position managers. This is the hook for automated strategies such as auto-deleveraging bots or vaults that manage positions for users.

The permission is wide. The threat model notes that delegates "can borrow/withdraw to their chosen recipient within account gates" and that those gates "do not constrain them to acting in the owner's economic interest". Revoking a delegate is immediate; transferring the NFT disables the previous owner's grants.

Oracle design

For its core assets (XLM, USDC, EURC, USDT0 and the gold token XAUM), XOXNO needs two independent sources to agree before it accepts a price: a Reflector time-weighted average and a RedStone feed, within a band of about ±5% for stablecoins and about ±10% for XLM. If either source fails, the operation that needs the price fails too.

That is deliberate. The design notes call it "fail-closed valuation": it "protects risk decisions at the cost of withdrawal and liquidation availability during outages". Each price must also sit inside a hard sanity band. Not every market has two sources: PYUSD, USDY, USST and the Centrifuge tokens use a single RedStone feed, and the Spiko funds a single XOXNO-run feed, which is marked as disabled in the current configuration. Etherfuse assets, SolvBTC and AQUA combine a conversion rate with a second feed.

Aquarius LP tokens are priced differently: from the pool's own reserves and share supply, with each leg valued by its own oracle and combined as 2 × √(value_a × value_b), a fair-value formula that a trade inside the pool cannot easily inflate. Stable-swap pools use a variant that accounts for the amplification coefficient. This is the right answer to the problem that sank the YieldBlox pool: a price that one thin market can set.

Governance, licence and audits

In the repository's design, governance owns the controller and price aggregator and changes them through typed, delayed proposals. The repository sets the timelock minimum to 12 ledgers on mainnet, about a minute, with longer floors for sensitive and recovery actions.

A guardian role can pause immediately, and an oracle role can tighten sanity bands immediately. Code upgrades, price-source changes and Blend approvals need the owner as proposer. The documentation itself advises users to "verify the deployed minimum and its review window before funding". A one-minute delay protects against mistakes, not against a compromised owner key.

The code is published under the PolyForm Noncommercial 1.0.0 licence, which allows reading and non-commercial use; commercial use needs a written agreement with XOXNO. The repository includes Certora formal-verification specifications, documented invariants and a threat model. Its security policy says audit material will be linked "when available"; we did not find a published third-party audit report as of 6 October 2026. For what an audit does and does not tell you, see smart contract audits.

How it fits into Stellar lending

XOXNO's niche is collateral that Blend's large pools do not list, and risk grouping fine enough to list it safely. It also plugs into the rest of the stack: a DeFindex adapter lets DeFindex vaults supply to it, and Blend migration lowers the cost of switching. Set against that, $131K of TVL means one large depositor can move utilisation, and therefore rates, in a single transaction. For the field as a whole, see the best lending protocols on Stellar.

The takeaway

XOXNO Lending is the most carefully segmented money market on Stellar so far, with sensible choices on oracles and collateral-only RWAs. It is also unaudited by any published third party, governed with a short timelock, and still tiny. Use it, if at all, at a size you can afford to have stuck while the protocol builds a record.

Sources: XOXNO rs-lending-xlm (configs/mainnet/markets.json, spokes.json, hubs.json, networks.json; docs/reference and docs/explanation; contracts/price-aggregator), commit a2486b2; DefiLlama protocol and yield APIs, 6 October 2026; Stellar Community Fund project page. Parameters change through XOXNO governance.