Risk is isolated per currency vault
The protocol is designed to contain a failure within one market, but isolation does not remove risk. Every action depends on deployment-specific controls and verifiable state.
Material risks and controls
| Risk | Why it matters | Capped-pilot control |
|---|---|---|
| FX | A target currency appreciating against USD raises the USD owed per synthetic token | Market caps, spread controls, isolated vaults, pause authority |
| Oracle | Stale or incorrect prices can misprice mint and redeem actions | Freshness checks, approved signers, disagreement handling, fail-closed quotes |
| Collateral | USDC can depeg or become unavailable | Approved-collateral registry, exposure caps, pause and reconciliation procedures |
| Liquidity | Redemptions can exceed liquid collateral during stress | Reserve buffer, capacity limits, strategy liquidity limits, pro-rata insolvency policy |
| Strategy | An allowlisted yield venue can lose funds or become illiquid | Conservative allocation, explicit allowlist, monitoring, withdrawal and pause procedures |
| Administration | Privileged keys can change sensitive settings | 2-of-3 Safe, delayed risk increases, scoped roles, recorded release evidence |
Loss waterfall
- Synthetic-holder liabilities remain senior claims on vault assets.
- A stable-plus-buffer position uses its dedicated protocol-owned first-loss buffer; counterparty capital participates only where that position model explicitly approves it.
- A full-range position absorbs its own isolated losses first and then the protocol-owned buffer.
- Regular-user principal is not silently consumed by a full-range loss. It is exposed only through the approved protocol-wide insolvency process.
- If liabilities still exceed eligible collateral, redemption becomes pro-rata under the documented insolvency policy.
Minting and new quotes should pause before redemption when a control degrades. That ordering reduces new exposure but cannot guarantee full recovery.
Review deployment registry requirements before treating any environment as provisioned.