> ## Documentation Index
> Fetch the complete documentation index at: https://docs.windrose.market/llms.txt
> Use this file to discover all available pages before exploring further.
# Risks
> What can go wrong on Windrose: audit status, oracle trust, vault FX risk, curve pricing, admin keys, chain-specific rules and testnets.
This page lists the risks plainly, without ranking them by likelihood. Read it before putting in money you would miss.
## No audit
The contracts, keeper, indexer and app have not been reviewed by an external auditor. They carry unit, fuzz and invariant tests (curve solvency, token conservation, vault redemption never exceeding assets), and the code is open to inspection, but tests are not an audit. A bug could lose funds on any network, including Robinhood Chain.
## Oracle trust
Every Windrose currency depends on an exchange rate, and today that rate comes from the keeper oracle on every network. An allow-listed keeper key posts rates from a public FX API; the contract only checks that a rate is non-zero, not from the future, and moves at most 15% per post. The oracle owner can force any rate.
What that means in practice:
* A compromised keeper key can push a rate off by up to 15% per post, repeatedly. Minting and redeeming at a wrong rate moves value between coin holders and backers.
* A compromised owner key can push any rate at all.
* If the keeper stops, rates go stale after two hours (higher fees, backers frozen) and expire after five days (minting, redeeming, launching and backer actions all stop until a new post).
* The FX source is a free reference-rate feed, not a tradeable quote. It updates roughly daily, so the oracle rate lags real markets, and someone who sees a large intraday move before the keeper does can mint or redeem at yesterday's price. Fees of 0.3% (1% when stale) are meant to exceed the typical gap; they do not cover a shock.
Decentralised adapters (Pyth, Chainlink) exist in the code but are not the source on any public network. See [Oracles](/concepts/oracles).
## Vault FX risk and haircuts
A vault owes coin holders a fixed number of coins. When the currency strengthens against the dollar, the dollar value of that debt rises. Backer equity absorbs it first, and backers can lose their entire deposit. Once equity is gone the vault is under water and every redemption is scaled by the collateral ratio: at 95% you get 95% of the oracle value. Coin holders cannot be locked out, but they can be paid less than face value until fees, a weaker currency or donations restore the ratio.
Vaults start with a 100% minimum collateral and no backers, so a currency with no backer equity is one adverse move away from a haircut at any time. The currencies list shows each vault's collateral ratio.
Holding a Windrose currency is holding exposure to that currency's exchange rate, the vault's solvency and the oracle, all at once.
## Curve pricing
A bonding curve has no external price. Its price is purely a function of what has been bought and sold, so:
* Your slippage tolerance is the only protection against other trades landing before yours. The default is 1%; a tighter tolerance means more reverts, a looser one means worse fills.
* Large buys on a young curve move the price a lot. The panel shows the price impact; read it.
* Nothing prevents a creator or anyone else from buying a large share of the curve. The dev buy is visible on the token page as the first trade, and the holder list shows concentration.
* The curve's dollar value moves with the currency: a rupee curve's raise is worth fewer dollars if the rupee weakens during the curve phase.
## Admin keys
The deployer account owns the currency registry, the launch factory, the liquidity locker, the keeper oracle and every vault, through OpenZeppelin's two-step ownership. There is no timelock and no multisig in front of these keys today. Ownership can be transferred to a multisig or hardware wallet in two steps, and that is the intended path, but it has not happened yet. The keeper account holds only the oracle's keeper role.
What the owner can do:
| Contract | Owner powers |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Currency registry | Point at a different oracle; register a real stablecoin for a code; create new synthetic currencies; enable or disable a currency for new launches |
| Launch factory | Change the launch parameters (supply split, curve depth, fees within hard caps) for future launches; change the pool fee and tick spacing for future graduations; change the registry, locker and fee-collector addresses; choose the fee collector |
| Vaults | Change fee rates (each at most 10%), the protocol share, the minimum collateral ratio and the liability cap; set a guardian; pause mint and deposit; unpause; claim the protocol's fee share |
| Keeper oracle | Add or remove keepers; enable or disable currencies; set the maximum move; change the fresh and stale windows; force a rate |
| Liquidity locker | Change the address that collected pool fees go to |
What the owner cannot do:
* Change anything about an existing launch: its currency, quote asset, supply, fees, reserves or balances. Curves and tokens have no admin at all.
* Remove liquidity from a graduated pool or transfer a locked position.
* Pause redeeming from a vault or withdrawing backer shares.
* Mint launch tokens, tax transfers or freeze balances.
* Take dollars out of a vault beyond the protocol's accrued fee share.
The most damaging owner powers are the oracle ones (force a rate, add a keeper) and, for a specific vault, raising its fees to the 10% cap or pausing minting. A malicious owner could not take the vault's collateral directly, but could set a rate that lets a colluding account redeem more than its share.
## Chain-specific
* **Arc's USDC blocklist.** On Arc the dollar is native USDC with a protocol-level blocklist; transfers touching a blocklisted address revert. Every fee in Windrose is pull-claimed rather than pushed so that one blocklisted recipient cannot jam a trade. A blocklisted wallet cannot trade on Arc at all.
* **Arc's 20 gwei minimum base fee.** Transactions sent below it are dropped silently. The app sets its fees correctly; scripts and wallets with custom gas settings must too.
* **Robinhood Chain's terms.** Launch names and symbols must not contain "Robinhood". The protocol does not enforce this; a launch that violates it is the creator's problem.
* **Uniswap v4 on the testnets** is a deployment of the official code by the Windrose deployer, not Uniswap's own. On Robinhood Chain the official Uniswap v4 contracts are used.
## Smart-contract and dependency risk
Windrose depends on OpenZeppelin contracts, Uniswap v4 core and periphery, Permit2 and, per adapter, Pyth or Chainlink. A bug in any of them, or in Windrose's use of them, could affect funds. Graduated liquidity sits in Uniswap v4 pools and carries Uniswap's risks as well as Windrose's.
## Testnets
Testnet tokens and balances have no value and may be wiped by a redeploy. Contracts on testnets may differ from mainnet by being deployed earlier; the Windrose currency prefix (`ac` versus `w`) is one visible example.
## What to check before you act
* The vault's collateral ratio and rate freshness on the [Currencies page](https://windrose.market/currencies) before minting, redeeming or backing.
* The price impact and minimum received on every trade quote.
* The holder list and the first trade on a token page before buying into a launch.
* That the network in the top bar is the one you mean.