What has no on-chain mitigation
Eight risks the protocol cannot address in code. They are listed here because writing them down is the only honest response available.
Everything on this page has been considered and has no on-chain remedy. There is no parameter that manages it, no mechanism that detects it, and no key that answers it. These are the reasons the debt ceilings are small, the branches are isolated, and no yield is promised.
1. Issuer or custodian default
The Stock Tokens are Jersey-law debt instruments, not shares. Holding one is holding a claim on an issuer, secured by an arrangement, not an ownership interest in a company. In a default the token's value stops being a function of the share price and becomes a function of the security interest and an insolvency procedure.
The failure mode that matters is silent. The token would keep trading. The Chainlink feed would in all likelihood keep publishing the price of the underlying share, because the feed tracks the share, not the issuer's solvency. Fyber would keep valuing collateral at that price, keep allowing borrowing against it, and keep refusing to liquidate positions that look healthy — while the collateral was worth nothing. There is no on-chain signal for this at all.
A partial palliative was considered and rejected as unavailable: requiring an attestation of backing from the verification agent, dated within 72 hours, and freezing minting beyond that. It depends on such an attestation being published in a machine-readable form, which is an open question, and no contract rule can depend on it in a design with no setters.
What is left: disclosure, and small caps. The issuer was incorporated on 23 October 2025, has no operating history and no rating, and is not a regulated entity.
2. Total correlation of the collateral basket
SPY, QQQ and VTI are, for risk purposes, the same asset. Per-branch isolation gives an illusion of diversification that the correlation matrix does not support.
In a crash: every branch is stressed at the same moment; every liquidator sells into the same pools within the same hour; every Stability Pool receives the same collateral, at the same time, and none of it can be sold.
This is the most probable loss scenario in the entire design.
Three things bound it rather than fix it: the global ceiling is the sum of the branch tiers rather than an independent, larger number; the hourly liquidation bucket is shared across branches at 0.6 × Σ d2_eff, so the protocol cannot try to sell everything at once; and GLD is included as a genuinely decorrelated collateral, though it activates only on its own metrics and may never activate at all.
3. A single centralised sequencer
Robinhood Chain orders transactions first-come, first-served through one sequencer operated by one company. Censorship — deliberate, or from a fault — prevents liquidations and prevents repayments alike, and there is no second path.
The rollup's seven-day challenge window protects against invalid state, not against not being included. Seven days is not a timescale on which a leveraged position survives.
If a Chainlink sequencer uptime feed exists on the chain, an outage produces SEQ_DOWN, and the automatic timers follow: interest stops at 24 hours, the branch shuts down at seven days. If no such feed exists, the address is zero at construction, the check does not exist, and staleness thresholds are the only thing absorbing an outage.
Irreducible. Displayed.
4. No precedent
As of the drafting of this specification, no CDP stablecoin backed by tokenised equities is live anywhere. The only precedents are lending markets — Kamino, Morpho, Venus — every one of which set a borrow cap of zero on the stock token itself, and none of which issues a stablecoin against that collateral.
The honest conclusion drawn in the design record: the first incident in this category will most likely be at Fyber, and it will involve a mechanism the specification did not anticipate.
That conclusion is what produces the rest of the design: small caps, per-branch shutdown, no promised yield that would force growth ahead of liquidity, and an emergency key that can only close.
5. Corporate actions with no human guard
The mechanics of splits and dividends are handled: the pause blocks action, the pre-pause snapshot values the collateral, the implied-share check catches a desynchronisation between the feed and the multiplier, and the exit from the pause requires several confirmations.
What is not handled is an event the design did not model.
A spin-off is the concrete case. If the issuer does not credit the spun-off entity on-chain, the token's price drops permanently by the value of what was spun off, the price returns after the pause at a level the deviation guard eventually accepts, and positions become liquidatable at the new price once the return ramp has run. That is a permanent loss of 5 to 30% for the borrower, and no human guard exists in version 1.
There is deliberately no whitelist of expected corporate actions and no function to acknowledge one, because either would be a setter. The relative bounds absorb the event or the branch stops acting until they do — and stopping is not the same as protecting.
A cash merger or an acquisition ends the feed. The branch goes to PAUSED, then FROZEN on the missed heartbeat, interest stops after 24 hours, and shutdown follows at seven days with urgent redemptions and settlement thirty days later. There is never a feed migration to a successor instrument: the new underlying is a matter for a future version.
6. Legal classification
Three questions are open and are answered by counsel, not by code.
Is the liquidation engine a multilateral system? Under MiFIR article 1(5b), a system bringing together multiple third-party buying and selling interests may require authorisation. Direct liquidation, CollateralSale and open redemptions are all mechanisms where third parties meet. If the answer is yes, the affected mechanisms would have to be restructured before deployment — plausibly to the Stability Pool alone — and the mainnet launch is blocked until the answer arrives.
Does fyUSD have an identifiable issuer under MiCA? The position taken is that issuance is exclusively the act of contracts whose minters were frozen at construction, and that closing is not issuing. The weak point is the "control via admin keys" criterion during the Closer's twelve months. If counsel concludes that a purely destructive, bounded, expiring key is enough to constitute an issuer, the answer is an early renunciation, not a design change.
Does the revenue stream to the development company create an intermediary? The Endowment address receives 15% of interest once total debt exceeds 25 M. The address is immutable, so this is decided before deployment or never.
Related open questions include the exposure of Safe signatories under the reasoning in Samuels v. Lido DAO, and whether a public commitment to 24/7 monitoring itself constitutes operating the protocol.
7. No on-chain address blocking
Fyber has no blocklist and no address freeze in any contract, and never will. Adding one would destroy the argument that there is no identifiable issuer, and it is explicitly excluded from the design forever.
This cuts both ways, and both are stated:
- Anyone can interact with the contracts directly, whatever any interface in front of them does.
- No party can freeze a user's funds either. There is nobody to ask and no function to call.
8. The gas regime, and other things that change under the protocol
The 90-day gas subsidy on Robinhood Chain expires. Every permissionless mechanism in the design — the 90-second flag, the depth poke() at 150 000 to 300 000 gas, the hourly bucket accounting, the collateral sale — assumes a marginal cost of execution. The costs are re-measured before deployment, and if they are unaffordable the keeper share is raised at construction, the depth oracle is reduced to two pools, and the flag window is widened.
The 100 fyUSD minimum debt is frozen either way. If gas makes small positions unviable, that is an accepted defect of version 1.
The same category holds the reference Morpho market for the rate floor, the reference Uniswap pools for depth, and the availability of the sequencer uptime feed. Each one degrades restrictively rather than breaking, and none of them can be repointed.
The pattern
Every item on this page shares a shape: the protocol can refuse to act, but it cannot act correctly. Refusing to act is expressed as a regime or a flag — FROZEN, MINT_FREEZE, shutdown — and in every one of those states, repayment, collateral addition, closure and withdrawal remain open.
That is the whole of the guarantee. It is not that the protocol handles these events. It is that it stops making the situation worse, and never stands between a user and their own exit.
Last reviewed: 2026-09-07 · Spec v0.4
Scenarios
Twelve end-to-end scenarios with real numbers: a crash, a split, a depeg in each direction, a feed outage, a branch shutdown, a wind-down, an exploit, and an automatic activation.
On-chain hypotheses
Fifteen assumptions about Robinhood Chain that must be verified before deployment. Every one of them is blocking, because none can be corrected afterwards.