Issuer and freeze
The collateral is a certificate, not a share. What happens if the entity behind it fails, freezes a balance, upgrades its contract, or runs a corporate action nobody anticipated.
Spec v0.9.1, reviewed 2026-09-08
Everything the protocol does rests on an instrument most people will read as a share. It is not one, and the difference is where the largest uncovered exposure in the design sits. The legal detail is on Nature of the collateral; this page is about the failures.
What you are actually holding
A collateralised tracker certificate, issued as a ledger-based security, secured and limited in recourse. Your claim is against the issuer and the collateral arrangement it has put in place. It is not a claim on the company whose price the certificate tracks, and it carries no ownership, no vote and no direct dividend entitlement.
The issuer was incorporated in October 2025, is not a regulated entity and says so in its own documentation, and has no financial history and no rating.
The failure that matters most, and has no mitigation
Risk
The price feed tracks the share. It does not track the certificate's backing.
If the issuer or its custodian fails, the feed keeps publishing the price of the underlying equity, because that is what it is built to do, while the certificate goes toward zero. The protocol would keep valuing collateral at the share price and keep lending against it. Every borrower would be solvent on paper. Every depositor would be buying something worth nothing.
There is no on-chain signal for this, no oracle for it, and no mechanism in Fyber that could act on one. It is disclosed rather than solved.
Rule R-15.4.1 (8)
What partially stands between a user and this is procedural and sits outside the protocol: whether the security agent's backing attestation is published, whether it is readable, and how recent it is. That check belongs to whoever is about to deposit.
What the protocol does contribute is size. Branch ceilings climb a dated ladder from $3,000,000 at most on the index branches, and the whole registry cannot exceed $37,000,000 even if all twenty branches reach their last step. The exposure is bounded in dollars, not in probability.
A frozen or blocklisted balance
If the issuer can freeze the protocol's token balance, or blocklist a contract address, the collateral becomes unrecoverable while the debt stands.
This is a blocking pre-deployment check. If the token can be frozen, the design is not viable and is abandoned rather than shipped. After verification, whatever the token contract actually permits is what remains.
Risk
Nothing in Fyber covers a freeze of a branch's balance. Not the Closer key, not a shutdown, not the reserve, not the staked FBR. A borrower would be unable to recover collateral they had repaid for; a depositor would hold seized tokens that cannot move.
A liquidity vault is exposed to the same event from a second direction. It holds both the stock and fyUSD in one position, so a freeze reaches both. A withdrawal still returns the fyUSD side and leaves the stock side claimable when it moves again, and after 7 days in that state every lock in the vault falls. What no mechanism reaches is the frozen stock itself.
Rules R-2.4.5, R-15.4.1 (15)
An upgraded token contract
The collateral token sits behind a proxy. A new implementation could change transfer behaviour, add a restriction, or alter the accounting.
Each branch snapshots the implementation slot and the code hash at construction and compares them on every operation that increases risk. A change triggers an automatic response with no human involvement.
| Stage | What happens |
|---|---|
| Change detected | Borrowing and withdrawing frozen for seven days. Liquidations and redemptions suspended for 24 hours. Repaying, adding collateral, closing and pool withdrawals stay open |
| Automatic test | A probe contract, seeded at deployment, attempts a one-unit transfer to the branch and back, and the branch's own balance is checked for movement it did not cause |
| Test passes | The freeze clears, the new implementation becomes the reference, and nothing else changes |
| Test keeps failing | The freeze extends in seven-day steps to four weeks, then the branch shuts down permissionlessly |
What is left over. An upgrade that preserves transferability and the price relationship passes the test, whatever else it changed. And the test says nothing about a freeze of the branch's own balance, which is the case above.
Corporate actions
The issuer's documented sequence is to pause its oracle, update a multiplier, then unpause. Raw balances never change; the feed carries the multiplier; the protocol never applies it to a valuation, because applying it twice after a ten-for-one split would multiply collateral by a hundred.
| Event | What the protocol does |
|---|---|
| A reinvested dividend, under one per cent | Records the new multiplier and carries on. Nothing is blocked |
| A split | Halts the branch while the issuer's oracle is paused, values collateral at the pre-pause snapshot, and leaves repaying and depositing open. Exit needs three re-accepted rounds and a consistent implied share |
| A split the feed does not reflect | The feed contradicts the composite, rounds are quarantined, and liquidations freeze. Nothing is liquidated at a tenth of its value, and the branch does not close on the contradiction |
| A special dividend above one per cent | New borrowing blocked for the 24 hours before it takes effect |
| A merger for cash | The feed stops, the branch halts, interest stops after 24 hours, and after 7 days the branch shuts down and everyone exits |
Risk
A spin-off has no safeguard. If the entity spun off is not credited on-chain, the certificate reprices downward and the borrower carries the whole difference: five to thirty per cent, permanent, with no human guard in version 1. The protocol will treat it as a price move, because from where it stands that is what it is. How the issuer actually behaves on a spin-off is an open question to be settled before deployment.
Rules R-11, R-15.4.1 (9)
Correlation, which is an issuer risk too
The index branches track close to the same thing, and several of the single-stock branches track the same sector. Per-branch isolation gives an appearance of diversification that a crash removes: every branch is stressed at once, every liquidator sells into the same pools, and every Stability Pool receives collateral nobody wants at the same moment.
The design's answers are that the global ceiling is the sum of the branch ladders rather than an independent number, that the third-party liquidation bucket is shared across branches at 0.6× of the summed depth per hour, and that the gold branch is genuinely decorrelated. None of that makes the branches independent.
What is checked before any of this ships
Whether the token can be frozen, blocklisted or upgraded without delay; whether its balance function returns the raw quantity; whether the issuer's pause flag lives on the token and survives an upgrade; and a real corporate action observed end to end. Each is blocking, and the list with its failure responses is on What is measured before launch.
Contracts and immutability
Code that has never been audited, has no upgrade path, and cannot be corrected. What immutability buys, what it costs, and what a second version would mean for someone already in the first.
Peg and the swap module
What holds fyUSD near a dollar, what happens above and below, the cap that never rises, what a USDG depeg does, and the loop between the liquidity vaults and the reserve.