Risk
Security & guardrails
Six guards, each one added because the failure it prevents has already cost somebody money somewhere else.
None of these make the protocol safe. They make specific known failures less likely, which is a different and more honest claim.
The six guards#
| Guard | Prevents | Status |
|---|---|---|
| Oracle freshness gate | Borrowing against a price nobody has confirmed recently | Always on |
| Deviation circuit breaker | A bad print becoming a real liquidation | Always on |
| Supply & borrow caps | Concentration in any single ticker | Always on |
| Pause guardian | An exploit draining the pool while nobody can react | Standby |
| Emergency repayment | Users being trapped in a paused protocol | Always on |
| Market-hours risk mode | Overnight and weekend gaps exceeding the buffer | Always on |
Oracle freshness gate
Every state-changing call re-reads the Chainlink answer and its timestamp. Past the heartbeat, the feed is stale and new borrows against that asset stop. Repayment and top-ups stay open. Detailed in Market hours & oracles.
Deviation circuit breaker
A price move beyond the per-asset deviation band inside one block halts liquidations for that asset until two independent updates agree. It costs a few blocks of delay and prevents an unrecoverable wrongful seizure.
Supply and borrow caps
Per-asset caps bound the protocol’s exposure to any single ticker. They rise with observed on-chain liquidity depth, never ahead of it — a cap larger than the market can absorb in a liquidation is not a cap.
Pause guardian
A multisig can halt new borrows and deposits. It deliberately cannot halt repayment or the withdrawal of healthy collateral.
A paused protocol must never trap a solvent user
This is the design line that matters most. Plenty of protocols have paused during an incident and left users unable to reduce their own risk while liquidations kept running. Here, every path that lets you get out or get safer stays live regardless of what is paused.
Emergency repayment
Even with borrowing frozen, repay, deposit and self-liquidate remain callable so anyone can walk their own position back from the edge.
Market-hours risk mode
LTV and borrow caps tighten as the distance to the next real price grows. The weekend haircut is the largest.
What the guardrails cannot do#
Read this before you decide the protocol is safe
- They cannot prevent a smart contract bug. Audits reduce that probability; they do not remove it.
- They cannot prevent bad debt from an overnight gap larger than the liquidation buffer.
- They cannot prevent losses from a USDG depeg, which sits entirely outside this protocol.
- They cannot prevent you from over-borrowing. Nothing stops you drawing to the limit and being 13% of collateral movement from trouble.
- They cannot give you legal recourse. There is no regulator, no insurance scheme and no complaints process behind a contract.
How this is being rolled out#
| Phase | What ships | Status |
|---|---|---|
| Phase 0 — Testnet | Mock tokens, full supply/borrow/repay loop, Chainlink integration | Shipped |
| Phase 1 — Guarded mainnet | 1 ETF + 3 mega-caps, small caps, liquidation bot, points | In progress |
| Phase 2 — Credit line | Revolving line, fixed terms, portfolio risk engine, Smart Deleveraging | Next |
| Phase 3 — Scale | Institutional vaults, white-label SDK, flash loans, governance | Later |
Before real value moves#
- Two independent audits, published in full including unfixed findings.
- A public testnet period long enough for the liquidation bot to see real volatility.
- A live bug bounty with a meaningful ceiling, running before caps rise.
- Published risk parameters re-derived from historical volatility, on-chain depth, oracle behaviour and stress simulation — not the illustrative numbers currently on this site.
The parameters you see today are a design, not a commitment
Every LTV, threshold and bonus across these docs is a starting point for discussion. They will change before mainnet, and they should. Treat them as the shape of the system rather than as final values.
See the guards in their live state
The risk centre shows which circuit breakers are armed, oracle freshness per asset, and your own protections.