Docs · 04
RISK FACTORS
Nothing below is hypothetical hedging. Each of these is a real way this protocol can lose you money, paired with what actually mitigates it and what does not.
MARKET AND MECHANISM
| Risk | What actually happens | Mitigation |
|---|---|---|
| Premium collapse | Market price falls toward NAV. Emission ramps down and hits zero at P = 1.00. Your APY goes to nothing. | Real: the clamp stops dilution. It does NOT stop the price falling. |
| Trading below backing | P < 1 is possible and the protocol does not prevent it. It only refuses to make it worse by minting. | Partial: the buyback bids at RFV − 1.5%, which is a floor on RFV, not on NAV. |
| Equity drawdown | Bucket B is real equities. If NVDA halves, NAV falls with it and every Seat is backed by less. | Bucket A is untouched — RFV is USDG only, so the hard floor survives an equity crash. |
| Dilution from materialize() | New Seats are new supply. Holders who never clock in are diluted relative to those who do. | Structural, not a bug. The rate cap and the NAV clamp bound how fast it can happen. |
ORACLE AND LIQUIDITY
| Risk | What actually happens | Mitigation |
|---|---|---|
| TWAP manipulation | A large enough actor could push the 401K/USDG TWAP and inflate the premium the Distributor reads. | 30-minute minimum checkpoint gap raises the cost of holding a manipulated price. It does not make it free of risk. |
| Stale oracle | Outside the 30min–4h window every consumer reverts. Bonds, rebase, buyback and desk buys all stop. | Deliberate. Fail-closed means the protocol stalls rather than trades on a bad price. |
| Thin RWA pools | Robinhood Chain equity pools are shallow. Naive swapping donates value to MEV. | The desk batches (minimum 1 hour apart) with a hard max-slippage of 300 bps and holds USDG rather than trading through it. |
| Equity mark vs realisable value | Bucket B is marked with Chainlink-style feeds, not with on-chain swap quotes. NAV can read higher than what the treasury could actually exit at. | Honest limitation. RFV — the number the buyback uses — never includes equities. |
SMART CONTRACT AND OPERATIONAL
The invariant suitetest/Invariants.t.sol531 lines
| Risk | What actually happens | Mitigation |
|---|---|---|
| Contract bugs | DN404 plus ERC-6551 plus a rebasing staking index is a large surface. A bug in any of it can be terminal. | Invariant testing on the ten properties in the spec. Audits before mainnet. Neither is a guarantee. |
| Owner keys | mapPair() and setWhitelist() stay owner-gated. They are add-only, so a key compromise cannot un-map a pair, but it can whitelist an address to trade fee-free. | Add-only design bounds the blast radius. It does not eliminate it. |
| Nobody calls rebase() | The epoch does not close on its own. If no one calls it, emission simply does not happen that epoch. | The 0.5% bounty is the incentive. Worst case the protocol under-emits, which is the safe direction. |
| L2 and bridge risk | Robinhood Chain is an Arbitrum Orbit L2. Sequencer downtime or bridge failure affects everything here. | Outside protocol control entirely. |
REGULATORY
The treasury holds tokenized equities and delivers them to NFT-bound accounts. The legal treatment of tokenized equity exposure varies by jurisdiction and can change. Access to tokenized equities may be restricted where you live.
Nothing on this site is investment advice, and none of it is an offer to sell securities.
You can lose everything
The RFV floor is an invariant on the treasury, not a promise about the market price of 401K. It guarantees the protocol will not mint itself below one USDG of risk-free backing per token. It does not guarantee that anyone will buy your Seat at any particular price, and it does not protect you from a contract bug.