Risk summary

1. Issuer or custodian failure. If the collateral issuer or its custodian fails, the price feed keeps publishing the price of the underlying share while the token's value goes to zero. The protocol cannot detect this and would keep lending against it. Nothing on-chain covers it.

Rule R-15.4.1 (8)

2. A freeze or blocklist on the collateral token. If the issuer can freeze, blocklist or upgrade the token's balances, the protocol's collateral could be immobilised. The automatic response to a contract upgrade — minting frozen, liquidations suspended, a transferability self-test, shutdown at 28 days — does not cover a freeze of the protocol's own balance. Nothing does.

Rules R-2.4.4, R-4.3.9

3. An unanticipated corporate action. A spin-off can resume the price materially lower with the spun-off entity never credited on-chain. Positions become liquidatable at the new price after the return ramp. A definitive loss of 5–30% is possible, and no human safeguard exists because none can be added.

Rules R-11, R-15.4.1 (9)

4. An atomic exploit. A bug exploitable in a single transaction is not covered by anything. The Closer key responds at human latency; against an atomic attack, human latency is irrelevant. What defends against this class is design — no flash mint, a one-block rule between risk increases, no external call in the mint or repay path — not a key and not a pause.

Rule R-12.1.8

And nobody can fix anything. A wrong parameter is wrong forever. A failing component closes its branch instead of being replaced. A documented instance of what this costs: a protocol with no governance was drained of roughly $775,000 over two days in August 2026 and, in the operator's own words, "because the contract is immutable and has no governance, there is no pause button: users have to withdraw themselves."

Article 1(5b) of MiFIR is the largest unresolved question in this project. The collateral is a transferable security. A regulation in force since 2024 requires that all multilateral systems in which third-party buying and selling interests in financial instruments can interact operate as a regulated market, an MTF or an OTF. Whether a CDP's liquidation engine, redemption mechanism and Stability Pool constitute such a system has never been analysed in any published work. A dedicated memorandum from a financial-markets firm is commissioned before mainnet, and the answer is not known today.

MiCA. fyUSD referenced to one dollar would be an e-money token if it had an issuer. The position taken is that an immutable contract with no upgrade key is not a natural person, a legal person or an undertaking, and therefore that fyUSD has no identifiable issuer within the meaning of the regulation — which places it outside Titles II, III and IV under recital 22. This position has never been tested before a competent authority. The precedent for what happens when a stablecoin issuer is identifiable and established in the EU is unambiguous and it is not favourable.

Personal exposure of contributors. A US court has held it adequately alleged that a governance-participating collective operates as an unincorporated general partnership with joint and several personal liability. "No entity" is not protection; it is the absence of protection. This is a risk to the people building the protocol, and indirectly to anyone relying on their continued existence.