Risks

This page lists every risk the design is aware of. Each entry says what the mechanism is, what mitigation exists on-chain, and what remains after the mitigation. Where nothing remains, it says so; where nothing can be done, it says that instead — those cases are collected in What has no on-chain mitigation.

Nothing here is presented as solved. A collateralised debt position backed by tokenised equities on a chain with one sequencer has no precedent in production, and the first incident in this category will most likely involve a mechanism nobody anticipated.

Collateral risks

Issuer or custodian default

Mechanism. The Stock Tokens are Jersey-law debt instruments, not shares. If the issuer or its custodian defaults, the token's value stops tracking the share price and becomes a function of the security interest and an insolvency procedure. The feed would in all likelihood keep publishing the price of the underlying share while the token was worth nothing, and there would be no on-chain signal at all.

Mitigation. None on-chain. Small absolute caps, dated tiers, and mandatory disclosure.

What remains. The entire exposure. This is described in detail on What has no on-chain mitigation.

Frozen or blocklisted token balance

Mechanism. If the issuer can freeze the protocol's token balance, or blocklist its address, the collateral becomes unrecoverable while the debt remains.

Mitigation. This is a blocking pre-deployment check (hypothesis H1): if the token can be frozen, the design is not viable without a contractual arrangement with the issuer, and would be abandoned rather than shipped.

What remains. After verification, whatever the issuer's contract permits. No on-chain mechanism covers a freeze of the vault's balance, and the token-upgrade response does not either.

Hostile or unexpected token upgrade

Mechanism. The Stock Token is behind a proxy. A new implementation could alter transfer behaviour, add restrictions, or change the accounting.

Mitigation. Each branch snapshots the token's EIP-1967 implementation slot at construction and compares it at checkUpgrade(), which runs at the head of open, borrow, withdraw, flag, liquidate and redeem, and can be called by anyone at a cost of roughly 2 600 gas. A change sets a 7-day mint freeze and suspends liquidations for 24 hours, while repayment, collateral addition, closure and pool withdrawals stay open. At the end of the freeze the branch attempts an automatic clearance: three consecutive rounds, no issuer pause, a consistent implied share, and a transferability self-test that sends one wei to a seeded Probe contract and takes it back. Success clears the freeze; failure extends it in 7-day increments to 28 days, then shuts the branch down (Rule R-4.3.9).

What remains. A hostile upgrade that preserves transferability and the price relationship passes the self-test. A freeze of the vault balance is not covered by this mechanism.

Corporate actions

Mechanism. Splits, reverse splits, reinvested dividends, special dividends, spin-offs, mergers. The issuer's documented sequence is pause, update multiplier, unpause; raw balances never change; the feed carries the multiplier.

Mitigation. The PAUSED state blocks borrowing, withdrawal, liquidation and redemption on that branch while the issuer's oracle is paused, and values collateral at a pre-pause snapshot. Exit requires a grace period, three fresh rounds and a consistent implied share. A multiplier change larger than 1% without a preceding pause forces CIRCUIT. There is no whitelist of expected events (Rule R-3.2.7, Rule R-11.1).

What remains. A spin-off in which the spun-off entity is not credited on-chain is a permanent loss of 5 to 30% for the borrower, with no human guard in version 1. The issuer's behaviour on spin-offs is an open question to be settled before deployment.

Total basket correlation

Mechanism. SPY, QQQ, VOO and IVV are effectively the same asset. Per-branch isolation gives an illusion of diversification.

Mitigation. The global ceiling is the sum of the branch tiers rather than an independent number; the hourly liquidation bucket is shared across branches at 0.6 × Σ d2_eff; GLD is included as a genuinely decorrelated Tier 2 collateral.

What remains. In a crash every branch is stressed simultaneously, every liquidator sells into the same pools, and every Stability Pool receives the same unsellable collateral. This is the most probable loss scenario in the whole design.

Market and liquidity risks

Exit liquidity

Mechanism. Seized collateral must be sold. On-chain depth for tokenised equities is thin and highly variable over time.

Mitigation. The debt ceiling is a multiple of measured depth, using the 25th percentile of a seven-day buffer with a one-way ratchet. Per-transaction, per-branch-per-hour and global-per-hour throughput buckets bound how fast collateral can be seized. The liquidation bonus rises with the size of a seizure relative to depth. See Caps and liquidity.

What remains. The measurement can be wrong, and the pools can vanish faster than the ratchet closes. A depth reading driven to zero closes minting and leaves existing positions untouched, which is the intended failure mode but not a solution for a position already open.

The gap when the official price returns

Mechanism. A position that was comfortable when the market went quiet can be below its threshold when the next official print arrives — now the Sunday-evening overnight round rather than Monday morning.

Mitigation. The liquidation price follows the on-chain price down through the recognition band while the market is shut, so an ordinary weekend move is absorbed before the print arrives and a fall is recognised up to 4% of the way down on tier 1. A returning print applies in one step, followed by 10 minutes during which the Stability Pool executes nothing. The deviation guard treats an implausible print as a fault and not as news. And the single threshold leaves a solvency cushion of 6.09% on tier 1.

What remains. A move larger than 4% lands whole on Sunday evening, and it lands on the Stability Pool in one go: at 20:10 the pool absorbs, in hourly slices, everything the weekend made liquidatable, at a price from a single provider. Below the solvency cushion the result is bad debt, as it is in any threshold-based design. The earlier design bought extra cushion by sweeping positions on Friday afternoon; this one declines to pay for that with liquidations that were unnecessary 99 times out of 100. No weekend in SPY's history has produced −25%. The protocol is sized as though the out-of-session open sale did not exist, because no weekend buyer has been identified.

What also remains. The gap is not measured on this chain yet. The premium and discount of Robinhood stock tokens against their close over a full weekend has never been published, so the band and trigger constants are estimates until four weekends of mainnet measurement land before deployment.

On-chain price manipulation at the edge of the band

Mechanism. Pushing a thin pool's time-weighted average below the official print can make positions close to the threshold liquidatable through an open sale.

Mitigation. The band takes the minimum of the print and the banded on-chain price, so a manipulation upward is ignored entirely, and the band is a constant, so holding a fall for longer buys the attacker no extra room. A fall counts only with a second qualified pool of the same branch or 3 hours of persistence; the basket of the other equity branches confirms nothing, because those branches read the same pools. A pool under $500,000 of depth is not a price source at all. The attack must hold for at least 90 minutes on-chain, in public, while every borrower can repay. The Stability Pool never buys during it. And the out-of-session bucket caps extraction at 15% of a branch's debt per shut period.

What remains. On the measured depths, moving a qualified pool 4% costs a few hundred thousand dollars of capital and tens of thousands in slippage per session held, against a maximum gross gain of 1.02 / 0.96 − 1 = 6.25% of the debt taken. Since the band stopped widening, the reachable window is only the debt sitting between 115% and 119.8%, which is 3 to 5% of a branch. The cost is paid per pool and the gain is collected per branch, so adding branches no longer helps the attacker: each one needs its own pools pushed. Bounded, not eliminated, and the worst case for borrowers as a group is about 0.9% of branch debt across one weekend.

Stablecoin risks

fyUSD below par

Mechanism. A stablecoin backed exclusively by tokenised US equities, on a chain where the dominant stablecoin is USDG, has no natural demand. The peg depends entirely on redemptions and the Stability Pool.

Mitigation. Three simultaneous arbitrages: buy below par and exit at the PSM at 0.998; buy below par and redeem collateral at the oracle price for 0.5% plus baseRate; and borrowers buying back their own debt at a discount. The PSM reserve is targeted at 5 to 10% of the supply.

What remains. All three arbitrages work around the clock — redemption is no longer switched off when the market is shut, it simply costs more. A simultaneous USDG depeg still removes the PSM leg. This is arguably the first-order risk of the whole project.

fyUSD above par

Mechanism. With the PSM at its cap, the debt ceilings full and no seller, a purchase on a thin pool can push the price well above par.

Mitigation. swapIn mints at 1.0005 while intake capacity remains; the Stability Pool is a structural seller, since depositors can withdraw and sell at a premium in a single step; concentrated liquidity incentives at ±0.5%; repayWithUSDG protects any borrower who needs to repay at par regardless of the market price.

What remains. The 30% intake cap never rises. A persistent premium is an accepted outcome that lasts until the caps or the market loosen, and nobody intervenes.

USDG depeg

Mechanism. The PSM holds USDG as its reserve and has no oracle for it.

Mitigation. During the Closer's life, a MINT freeze on the PSM blocks entry for at most 72 hours at a time, bounded cumulatively at 30 days, while swapOut and fyUSD repayment stay open. After the key expires: nothing. The exposure is bounded by the 30% cap.

What remains. Up to 30% of the fyUSD supply exposed to USDG, plus whatever repayWithUSDG has added on top, with no hedge and no mechanism to add one after deployment.

Protocol risks

Bad debt

Mechanism. A position whose collateral is worth less than its debt at the moment of liquidation leaves fyUSD supply with nothing behind it.

Mitigation. Partial liquidation to a target ratio; a dynamic bonus; the Stability Pool as the first payer; direct liquidation as the second; a Backstop funded by formula at 5 points of routed interest while below 2% of total debt, plus a permissionless fund(); on-chain sale of residual collateral at a 3% discount; and, as a last resort after 72 hours, permissionless redistribution confined to the branch.

What remains. Redistribution is a real loss to remaining borrowers on the same branch. Any bad debt permanently locks the branch's capacity tier — even after full recovery.

Smart contract bug

Mechanism. An error in the code.

Mitigation. A hundred percent branch coverage on the core modules; roughly two dozen fuzzed invariants run nightly; fork tests against real tokens, feeds and pools; a deployment test asserting zero setters; mutation testing at 80% or better; two private audits with a public contest between them; a bug bounty before mainnet. See Tests and Audits.

What remains. No audit has been completed as of this writing. An atomic exploit in a single transaction is not addressable by any key. A bug in repay, close or pool withdrawal is deliberately not protectable, because freezing those functions would be worse than the bug.

The Closer key

Mechanism. A two-of-three Safe held by the development company can freeze certain functions for at most 72 hours and can irreversibly shut down a branch or the whole protocol, until day 365.

Mitigation. A closed list of functions; hard bounds on duration and cumulative use; an immutable expiry that nobody can extend; a published doctrine of freeze-before-shutdown; an event on every use; a public status page.

What remains. During its life, the key can freeze new borrowing and redemptions and can kill a branch on a false positive, which costs a redeployment. It can never touch repayment, withdrawal, closure, pool withdrawal or swapOut. After day 365 there is no human intervention available at all, which is a different risk rather than the absence of one.

Immutability itself

Mechanism. No parameter can be corrected after deployment.

Mitigation. Constructor assertions on every relation; blocking pre-deployment verification of fifteen hypotheses; conservative parameters where data is thin; a version-2 path with a PSM bridge.

What remains. A wrongly calibrated parameter is a defect of version 1 for the whole life of version 1. If the recognition band turns out to be narrower than the ordinary weekend premium of these tokens, the observation is published and feeds a future version — nothing is corrected in place.

Infrastructure risks

Single sequencer

Mechanism. Robinhood Chain orders transactions first-come, first-served through one sequencer. Censorship, deliberate or by fault, prevents liquidations and repayments alike.

Mitigation. If a sequencer uptime feed exists, its outage produces SEQ_DOWN with a 1 800-second recovery window, after which the interest clock stops at 24 hours and the branch shuts down at seven days. If no feed exists, the substitute is a stale ETH/USD feed together with an absence of blocks.

What remains. Irreducible. The rollup's seven-day challenge window does not operate on a timescale that matters here.

Oracle failure

Mechanism. One Chainlink proxy per branch, with no fallback.

Mitigation. Eight validation checks; automatic exits from every degraded state; the interest clock stopping after 24 hours; permissionless shutdown after seven days with urgent redemptions and settlement.

What remains. A branch whose feed dies dies with it. That is the design, not an oversight, and it is why the caps are small.

Gas cost

Mechanism. The 90-day gas subsidy on Robinhood Chain expires. Every permissionless mechanism assumes marginal cost.

Mitigation. Costs are re-measured before deployment; if they are too high, the keeper share is raised at construction, the depth oracle is limited to two pools, and the flag window is widened.

What remains. The 100 fyUSD minimum debt is frozen. If gas makes it unviable, it is an accepted defect of version 1.

Legal and jurisdictional risks

Covered in full on the Legal pages and summarised on What has no on-chain mitigation: the exact nature of the collateral, restricted jurisdictions with front-end-only geo-blocking, the classification of fyUSD, the classification of the liquidation and sale mechanisms, and the absence of any on-chain address or jurisdiction blocking — which is deliberate, permanent, and cuts both ways.

Last reviewed: 2026-09-07 · Spec v0.4