Risks & security

What is actually guaranteed, what is not, and what can still go wrong. Written as we would want to read it.

What cannot happen

The liquidity cannot be withdrawn. Not by the creator, not by us, not by a compromised key. The locker has no function that moves the position — see Locked liquidity.

The supply cannot grow. Minted once, in the constructor. There is no mint function.

Your sells cannot be blocked by the token. No branch of the token contract gates a transfer out of a wallet, in any block, under any condition. The anti-snipe window restricts buying only, and expires on a block number. (USDC's own blocklist is a separate matter — see below.)

Your fees cannot be redirected. The creator address is written when the coin is locked and has no setter.

A bond cannot strand liquidity. The migration reverts unless essentially everything withdrawn is redeposited.

A tracker's vault cannot pay anyone but its hedge wallet. The one path by which margin leaves a vault, fundHedge, sends only to the vault's hedgeFunder, only out of idle USDC above the redemption floor, never before the tracker bonds and never while the vault is paused. The caller picks an amount, never a destination.

A tracker cannot promise more leverage than its hedge can hold. The factory caps every tracker at the lower of 5× and 90% of the venue's own cap for the market, on chain.

What you are exposed to

The tracker is leveraged, and leverage decays. A bonded coin's floor is a leveraged position — up to 5×. It loses ground on a round trip in the underlying, it pays funding every hour, and it can be liquidated. See NAV, decay & funding. This is the single most important thing on this page.

The venue. The perpetual position backing a tracker lives on Lighter, an order-book perpetuals exchange built as a zk-rollup on Ethereum. We do not control it and cannot insure it. If it pauses or halts a market, misprices it, changes its rules, or stops answering, the backing behind every coin on that tracker is affected. Lighter liquidates an account when its equity falls below its maintenance margin — at 5× on a market like Nvidia, about 17.5% against a long or 16.5% against a short from the averaged entry (see The hedge book for every market), plus a 1% liquidation fee.

Stock hours on a 24/7 venue. Lighter lists its stock, index and commodity markets around the clock, with no closed-market price band. The backing keeps moving at any hour, and the mark can gap when the underlying market reopens. A market the venue halts or sets to reduce-only cannot be grown until it resumes.

One account for every tracker. All trackers of a hedge wallet are hedged inside one cross-margin Lighter account (a wallet may hold at most four sub-accounts, far fewer than the trackers). The keeper keeps a per-tracker ledger that attributes each its share; on the venue, the positions share one margin balance. A liquidation of the account would hit every tracker of the wallet, not only the one that lost. The keeper sizes every tracker well under the venue's cap, and a long and a short tracker on the same market net against each other on the venue.

Funding. Settled every hour on Lighter, at a rate the venue sets. It can run against a tracker for long stretches.

The keeper and the NAV. NAV is computed and signed by the protocol's keeper and posted on chain; the chain cannot check it against the venue, because the venue's accounts are not on Avalanche. If the keeper stalls, NAV goes stale; after 15 minutes the contracts refuse to mint or redeem that tracker rather than act on an old price, which fails closed but still means a coin can be temporarily unquotable. If the keeper's own books or its per-tracker ledger disagree with what the venue shows, it posts no NAV for any tracker of that wallet until the difference is repaired by hand — the same fail-closed outcome. A keeper that stops also stops rebalancing, and a leveraged position that is not de-levered on the way down runs into the venue's liquidation threshold.

Redemptions can wait. Shared trackers keep no idle buffer, so most of a bonded tracker's dollars sit on Lighter. A redeem the vault cannot pay at once joins a first-in-first-out queue the keeper fills by withdrawing from the venue and bridging the USDC back from Arbitrum — 15 to 20 seconds for Lighter's fast withdrawal according to its docs, plus one Circle attestation (seconds to a few minutes according to Circle); neither measured on this route yet — when all goes well, longer if Lighter's fast-withdraw pool is short, or the venue or the bridge is slow. A queued redeem can be cancelled until it executes.

Concentration. Many coins can bond onto the same tracker, and they share one position. A bad day on one stock is a bad day for every coin behind it. The hedge book publishes exactly how concentrated the book is, because you should be able to see it.

Price impact on a thin coin. A fresh launch has very little behind it. Early buys move the price hard, and selling into that pool moves it hard the other way. This is not a hidden cost — the backing figure on every coin page is exactly how much is there.

Custody and trust: who holds the hedge

This is the part that is not trustless, stated plainly.

A smart contract cannot own a Lighter account. So the positions sit in a Lighter account held by the protocol's hedge wallet — an ordinary wallet whose key the protocol holds — with every tracker of that wallet inside the one account, behind the keeper's per-tracker ledger. The vault sends the wallet money only through fundHedge. Lighter takes USDC straight from Avalanche: the wallet sends it with a plain transfer to a deposit address Lighter issues for it. On the way back, Lighter's fast withdrawal pays the wallet on Arbitrum, and the wallet burns the USDC with Circle's CCTP naming the vault as the recipient, so it is minted straight into the vault on Avalanche. Orders are signed by a separate API key that can only trade.

What that leaves you trusting:

The hedge wallet's key, which is online. Deposits and recalls run automatically, so the key sits on the keeper's machine. The keeper's code refuses any withdrawal that does not pay the wallet itself, any bridge transfer from Arbitrum that does not pay the vault it serves, and any transaction outside the short list it needs on each chain. A thief with the key is not bound by that code: a fast withdrawal's recipient is a field the key signs, so such a thief could withdraw the whole account — every tracker of the wallet — anywhere on Arbitrum, register a new trading key, and — until the owner pulls the kill switch — reach each bonded vault's fundable USDC too.
Lighter's deposit address. It belongs to Lighter's bridge operator. Dollars sent to it are in flight for the minutes it takes Lighter to credit them, guarded by nothing on chain.
Lighter's fast-withdraw pool. A liquidity pool Lighter runs. If it is short, a return waits; the keeper reads the pool's limit before asking, and a recall it cannot pay is parked and alerted. Lighter's slow, secure withdrawal (to the wallet's own address on Ethereum, after a delay of about 25 minutes on 2026-09-22) exists as a fallback.
One hop on Arbitrum. Returning dollars sit on the hedge wallet on Arbitrum between the fast-withdrawal payout and the bridge burn towards Avalanche. For that hop they are guarded by the keeper's code and by nothing on chain.
Circle's CCTP, on the way back. The bridge depends on Circle's attestation service answering; its contracts can be paused by Circle; and USDC's blocklist applies on both chains. A burn that is not attested is money that does not arrive until it is.
Lighter's custody. Money on Lighter is held by Lighter. It is a rollup on Ethereum with an escape hatch: an account holder can force an exit on Ethereum if the venue stops processing withdrawals — an improvement on a venue on its own chain, and still a path that pays the wallet's address, so it passes through the wallet key.
The API key. It cannot move money out of the account to a stranger, but it can trade — badly, if compromised.
The keeper's NAV. Signed, not proven. What the chains do prove is every dollar that left each vault (HedgeFunded on Avalanche), every transfer to Lighter's deposit address, every fast-withdrawal payout on Arbitrum, every bridge burn and mint, and every dollar minted back into a vault.

Several Lighter details that shape this are read from its docs and public API (2026-09-22) and not yet exercised with money: whether the deposit address is stable per wallet, the fast-withdrawal fee and pool limits in practice, and the exact permission model of API keys.

The switches the vault owner holds, which need nothing from the keeper:

setHedgeFunder(address(0)) — the kill switch. From that block, no dollar can leave the vault for the venue, whoever asks.
setPaused(true) — stops fundHedge, minting and redeeming together.

Neither reaches money already on Lighter, on Arbitrum or in the bridge, and neither closes a position: open positions stay open under the venue's rules until the keeper — or a new hedge wallet, after the balance has been brought back to the vault — manages them.

What the protocol owner can do

On the factory: list or delist the markets the launch form offers (setUnderlying), route a tracker to a market and hedge wallet (setVenueRouting), set the defaults new trackers are created with, authorise launchers, and change the NAV signer and fee recipient for new trackers. On each tracker's vault: change or cut off its hedge wallet, pause it, replace its NAV oracle, change its target leverage and rebalancing band, its NAV floor for minting, its redemption floor, and its fees within hard caps (5% per mint or redeem, 5% a year management — all zero at creation), withdraw the protocol's accrued fees, and pull the vault's own reference-pool liquidity back into the vault (never anywhere else). On each NAV oracle: change the signer, the staleness window and the floor, or pause it.

Every one of these is an on-chain transaction anyone can see. None of them touches a coin that already exists: its pool, its lock, its split and its creator are fixed at launch and no owner action reaches them. The owner is a single key today, not a multisig.

Dependencies outside our contracts

Avalanche. The C-Chain itself and its validator set. Gas is paid in AVAX.
USDC. Circle's native dollar on Avalanche. It has a blocklist: an address on it can neither send nor receive USDC, so it cannot buy, sell, redeem or claim in USDC here. If a vault, the hedge wallet or the treasury were ever blocklisted, every USDC transfer involving it would revert.
Uniswap on Avalanche. The canonical V3 factory, position manager and router. Coins and reference pools live there.
Lighter, as above: its rollup, its deposit bridge from Avalanche and its fast-withdraw pool.
Arbitrum and Circle's CCTP. Every returning hedge dollar lands on Arbitrum and crosses back through Circle's bridge contracts on both chains and Circle's attestation service.

Verify rather than trust

Every claim about our contracts is a public call or a source-code read. The addresses will be in Architecture, with verified sources on Snowtrace; nothing is deployed on Avalanche yet, so any address presented as ours today is unverified. If a statement on this page and the chain disagree, the chain is right and we want to hear about it.

Audit status

The contracts have not been audited by a third party. They are tested — including against the real Uniswap contracts and USDC on a fork of Avalanche mainnet — and will be deployed unproxied, so the bytecode is what runs. No order has been sent to Lighter and no dollar has crossed the bridge for this system yet: the first live tests are a 10 USDC round trip — vault to Lighter, fast withdrawal to Arbitrum, CCTP back into the vault — then small-size tests on Lighter mainnet.