A Dive into Solana DeFi Accounting

Abstract

This article explores how to track user activity on Solana’s MarginFi protocol – specifically, how to identify value deposited into and withdrawn from MarginFi vaults when user-controlled wallets no longer directly hold those assets.

While most systems attempt to follow token balances, NODE40 captures financial intent and economic ownership, even when assets reside entirely in protocol-controlled accounts. We maintain a ledger that includes off-wallet activity through what we call tracking ledgers. This allows us to reconstruct a complete financial narrative from raw blockchain data.

On Solana, this challenge is amplified compared to other blockchains. Solana’s high-performance architecture enables parallel transaction execution, allowing unrelated instructions to be processed simultaneously, and packs multiple operations into a single transaction. Protocols like MarginFi rely heavily on Program Derived Addresses (PDAs) and internal program-owned accounts that never appear as user-owned addresses. These features increase throughput but make traditional balance-change tracking insufficient: a single transaction can contain deposits, swaps, repayments, and account updates across multiple programs, none of which are obvious from wallet balances alone.

This article starts with basic transaction anatomy and builds up to complex, multi-instruction, multi-program DeFi interactions, showing how NODE40’s tracking ledger approach can reconstruct economic reality where standard tools fall short.

A Simple Transfer and Its Tax Implication

Let’s start with the most basic example: a wallet transfers a token it owns to an address it doesn’t control. This represents a simple disposition of property.

• Source: Associated Token Account (ATA) owned by the wallet
• Destination: ATA not owned by the wallet
• Token: USDC
• Amount: 1,000 USDC
• Cost Basis: $950
• Proceeds: $1,000

From a tax perspective, this is a realized gain of $50. NODE40 recognizes the change in ownership and calculates gain/loss accordingly.

But what if the token was sent to a protocol-controlled account like MarginFi, where the user is still entitled to the value? That’s where things get more complex.

MarginFi: Lending Protocols and Tracking Value Outside the Wallet

One of the most important innovations at NODE40 is the concept of off-wallet value tracking. When users interact with lending protocols like MarginFi, the value they deposit, borrow, or earn interest on no longer resides in accounts they control. Instead, that value is held in program-owned accounts that represent vaults, pools, and internal balances. For most block explorers and wallets, this presents a major visibility problem.

At NODE40, we resolve this by introducing a concept we call tracking ledgers. A tracking ledger is a synthetic representation of value that a user owns or is entitled to, even though that value sits outside their wallet-controlled token accounts. This allows us to depict the lifecycle of deposits, withdrawals, borrows, repayments, and interest accruals in a way that reflects a user’s actual economic position.

In the case of MarginFi:

• A user first instructs MarginFi to create an account to manage their various MarginFi positions.
• Once a user has a MarginFi account, they deposit tokens into a MarginFi-controlled vault. This vault is not owned by the user, but the deposit updates their MarginFi account within the protocol’s internal ledgering system.
• That MarginFi account is not a vault, nor does it store user tokens. It is a plain account created and initialized under the protocol’s control, used to store balances and positions associated with a single user.
• When interest is earned or debt accrues, the balance changes happen within this account, not in the user’s wallet.
• When the user eventually withdraws, value returns to a wallet-controlled account.

Without a tracking ledger, these internal changes would be invisible to both users, financial systems, and auditors. By capturing them in a ledger of synthetic transactions, we provide a complete picture of a user’s relationship with the protocol, including total yield and borrowing costs.

Example 1: MarginFi Account Initialization

To interact with MarginFi, a user first creates a MarginFi account. Here’s what that initialization looks like on-chain:

https://solscan.io/tx/4bqHMaccxqVMKkXXNJdStrfma1JnJEZekzF9ZWZSVFB7htG5MzVGbHzw6UHZQPSRcLuztVHr1MibqQBptEVD9aPd

Figure 1: [Solscan Screenshot] Initialization of MarginFi Account 32mKTuVkfWgsriaocspWjhU69bGMhKXNE8mNmfH5fbtP. 

In this transaction, the user instructs MarginFi to create an account that will track the state of collateral, loans, yield, etc.

Figure 2: [NODE40 Balance Screenshot] Ledger entry in NODE40 Balance for the account initialization.

This is not a token deposit. No funds have been transferred into a vault. But the creation of this account is a prerequisite for any future deposit.

There is nothing interesting about this transaction that would require more than the most basic pre- and post-token balance analysis.

Example 2: Deposit of a Token

In this example, a user deposits an SPL token (USDC) into MarginFi. The token leaves their wallet’s ATA and is moved to a MarginFi vault.

https://solscan.io/tx/5VNahfEbTcRH48Bq27KryGfoEicf28ETA8kh2zBZpGPsAVdveKhUYZt779AUQA3uSQ58cy7CvNsCumzj7a2kiiUu

Figure 3: [Solscan Screenshot] Deposit of 20,000 USDC into the MarginFi USDC Bank Vault by 2EvcwLAHvXW71c8d1uEXTCbVZjzMpYUQL5h64PuYUi3T via MarginFi account 32mKTuVkfWgsriaocspWjhU69bGMhKXNE8mNmfH5fbtP.

The transaction:

• Decreases the wallet’s token balance by 20,000 USDC
• Increases the vault’s balance by 20,000 USDC
• Updates the internal MarginFi account for the user

NODE40 uses a tracking ledger to reflect this:

• We create a synthetic deposit record tied to the user’s MarginFi account
• We preserve cost basis from the outgoing token by building a transfer link between the user’s wallet and the synthetic deposit
• No gain/loss is realized and ownership is maintained

Figure 4: [NODE40 Balance Screenshot] Ledger entries showing fee paid plus the transfer of 20,000 USDC from the user’s wallet to the off-wallet tracking ledger.

This reflects continued economic ownership, even though the asset has left the wallet. If a ledgering system relied on pre- and post-token balance changes, $20,000 would have evaporated. See Figure 5 below.

Figure 5: [Solscan Screenshot] Balance change view of the deposit of 20,000 USDC into a MarginFi account. This highlights the difference between technology and economic intent.

Example 3: Deposit of SOL (Wrapped)

Now that we’ve seen a simple token deposit, let’s examine how SOL deposits differ. When a user deposits SOL into MarginFi, the operation is slightly more complex:

1. The user’s SOL is wrapped into WSOL (SPL version)
2. The WSOL is transferred to the MarginFi vault
3. The wrapped account is closed

Let’s take a look at an example: 

https://solscan.io/tx/4VoHdX6DWhGTvFefZgqHN6iS8Ug5K2gZuXLa2EgwfrwD67nSW6rWW1FEVWcDxHpsgSiw8A7cw5bpGXCPgkjHcNYK

Figure 6: [Solscan Screenshot] Creation of a temporary WSOL account to convert SOL to WSOL for use in MarginFi. The complete process of creating the account includes 4 steps. To view them, visit the link above.

Figure 7: [Solscan Screenshot] Transfer of SOL into the newly created WSOL ATA, then the conversion of SOL to WSOL (via SyncNative).

Once the SOL is converted to WSOL, the deposit into the MarginFi vault follows the same process as example 2 above, with the addition of a final close step as shown in Figure 8 below.

Figure 8: [Solscan Screenshot] The temporary WSOL account is closed and the rent plus any SOL balance is returned to the owner.

Despite the extra steps, the end result is the same: the wallet no longer controls the funds, but the user retains ownership through their MarginFi account.

NODE40 handles this by tracking:

1. Creation of the WSOL ATA
   1. Create a WSOL token account as an ATA
   2. Transfer SOL to the newly created token account
   3. Convert the SOL to WSOL in the newly created token account
2. Transfer of WSOL to the vault
3. Closure of the temporary WSOL ATA (refund of lamports)

We reflect the entire process as a single deposit into the MarginFi tracking ledger, but reflect the involvement of WSOL as net movement of SOL because the WSOL conversion and closure happen entirely within the transaction.

Example 4: Withdrawal Principal and Interest Income

In this example, the user withdraws interest accrued (MarginFi calls this emissions) then withdraws their principal.

https://solscan.io/tx/2JXQkqjyroKo4juyeKmREUN5yM6v5shXvALTFkQ3bhJyfsB7xH9QMxpzegMCydcXUiMyE26Az6XcaBxT2RXkRZg1

Figure 9: [Solscan Screenshot] The transfer of ~2.64 PYUSD interest earnings back to the user’s ATA.

Figure 10: [Solscan Screenshot] The withdrawal of principal back to the user’s ATA.

Here’s how NODE40 tracks such a multi-operation sequence:

1. A synthetic claim transaction is made from the tracking ledger of 2.63997 USDC
2. A synthetic deposit transaction is made in the user’s wallet, marked as interest income, and the net balance change is adjusted down by 2.63997 USDC
3. A synthetic withdrawal transaction is from the tracking ledger of 1,181.3707 USDC
4. A synthetic deposit transaction is made in the user’s wallet, marked as transfer (cost basis pulled from previous deposit into tracking ledger), and the net balance change is adjusted down to zero
5. No other SOL is received, but a fee is paid to execute the transaction

Figure 11: [NODE40 Balance Screenshot] Ledger entries showing fee paid plus the separate transfers of interest and principal from the vault to the user’s wallet.

The net balance change, according to the blockchain is a deposit of 1,184.010607. This is technically true, but not economically true. In reality, this net change is the result of principal and interest. We split this into two deposits so a financial report can be made more accurate.

Figure 12: [Solscan Screenshot] The net balance change of both principal and interest fails to reflect economic intent and is inadequate for use in financial reporting.

Final Example: Withdraw → Swap → Repay

In complex DeFi strategies, users often execute a variety of operations within a single transaction. For example, a user may withdraw collateral from a MarginFi vault, swap the withdrawn asset for a different token, then repay a MarginFi loan with the swapped token.

A single transaction encodes this entire workflow, which comprises three distinct transactions.

Let’s examine an example.

https://solscan.io/tx/4GZgAY8D6kyudFWh8oRXLipeE7mXgazJRy33JNE4U9Fm55htY2LTrDoA6KYmJ5MQ8L8556HaRKoc5HdAyBcygxQU

Figure 13: [Solscan Screenshot] A withdrawal from a MarginFi vault, a swap, a loan repayment to MarginFi.

Here’s how NODE40 tracks such a multi-operation sequence:

1. Withdraw – User withdraws Bonk from the MarginFi Bonk vault
   • A synthetic withdrawal is created in the tracking ledger
   • The net result of Bonk is zero at the end of the transaction so no deposit transaction is made to the user’s wallet
2. Swap on Jupiter (a popular DEX aggregator) – Bonk to $WIF
   • The Bonk is swapped for $WIF via Jupiter on three protocols
   • Bonk swapped for WSOL on Whirlpools
   • WSOL swapped for USDC on Obric
   • USDC swapped for $WIF on SolFi
3. Repayment of $WIF to MarginFi
   • With $WIF in hand, the user invokes the repay operation and makes good on a previous loan.

This sequence spans multiple programs and intents but is ultimately just value moving between user-controlled and protocol-controlled locations. NODE40 stitches it together into a coherent, ledger-backed financial story.

Why Auditors and Jurors Need Narratives

Numbers alone tell what happened; transaction narratives explain how and why it happened. For auditors, a narrative ties each balance change to an identifiable economic event, ensuring compliance with accounting standards and providing a defensible audit trail. For jurors, a clear sequence of actions transforms technical transaction data into a logical story they can follow, bridging the gap between raw blockchain records and real-world financial intent.

Wrap-up

The examples in this article illustrate why traditional balance-based tools fall short on Solana and why NODE40’s tracking ledger approach delivers a more accurate and defensible view of a user’s financial reality.

On Solana, economic activity often happens off-wallet. High throughput, parallel execution, and multi-instruction transactions allow protocols like MarginFi to bundle complex sequences—deposits, borrows, swaps, repayments—into a single transaction. These operations frequently interact with accounts that never appear in the user’s address space. Without off-wallet tracking, large portions of a user’s portfolio, sometimes millions of dollars, vanish from view in standard explorers or wallet-based reports.

If you’re an accountant, auditor, or compliance officer, the difference is shocking. Imagine trying to explain an $8M gap in a $10M portfolio because those assets are locked in protocol-controlled vaults. Point-in-time explorers can tell you what is there, but not how it got there or changed over time. The “how” is essential for financial reporting, taxation, and proving ownership.

Understanding economic intent is not optional. It is the difference between incomplete data and a verifiable, audit-ready record.

By Sean Ryan, CTO and co-founder at NODE40