Risks & security
What is actually guaranteed, what is not, and what can still go wrong. Written as we would want to read it.
What cannot happen
The liquidity cannot be withdrawn. Not by the creator, not by us, not by a compromised key. The locker has no function that moves the position — see Locked liquidity.
The supply cannot grow. Minted once, in the constructor. There is no mint function.
Your sells cannot be blocked. No branch of the token contract gates a transfer out of a wallet, in any block, under any condition. The anti-snipe window restricts buying only, and expires on a block number.
Your fees cannot be redirected. The creator address is written when the coin is locked and has no setter.
A bond cannot strand liquidity. The migration reverts unless essentially everything withdrawn is redeposited.
The keeper cannot walk off with the backing. It trades the tracker's account through a key the venue lets place orders and withdraw — but every withdrawal is paid back to the tracker's vault, and the key cannot send collateral to any other address. See below for what it can do.
A tracker cannot promise more leverage than its hedge can hold. The factory caps every tracker at the lower of 5× and 90% of the venue's own cap for the market, on chain.
What you are exposed to
The tracker is leveraged, and leverage decays. A bonded coin's floor is a leveraged position — up to 5×. It loses ground on a round trip in the underlying, it pays funding and fees, and it can be liquidated. See NAV, decay & funding. This is the single most important thing on this page.
The venue. The perpetual position backing a tracker lives on Nado, an order-book perpetuals exchange on Ink. Its contracts are upgradeable proxies controlled by Nado's owner, not by us, and orders and withdrawals go through Nado's sequencer. If the venue pauses a market, misprices it, changes its rules or upgrades its contracts, the backing behind every coin on that tracker is affected; if its sequencer stops, the vault's on-chain withdrawal requests can be forced through only after three days. Nado liquidates an account when its maintenance health falls below zero — at 5× on a market like Nvidia, about 17.9% against a long or 17.1% against a short from the averaged entry (see The hedge book for every market). Stocks, indices and commodities trade around the clock there, so the keeper can de-lever at any hour — and a move can also happen at any hour. Nado also holds two short maintenance windows a week. We do not control the venue and cannot insure it.
The keeper's key. The key the vault links on Nado can trade the account. The venue stops it from moving the collateral anywhere but the vault, but not from trading badly: a hostile or compromised key could run the position into losses. That risk is bounded by two things — the most the vault can ever put on the venue is its idle USDT0 above what it keeps for redemptions, capped on chain, and the vault owner can cut the key off at any time (below). The keeper itself only sends orders that fill immediately, priced off the venue's oracle within 0.5%.
The oracle and the keeper. NAV is posted on chain by a keeper. If it stalls, quotes that depend on NAV go stale; the contracts reject a stale post rather than acting on it, which fails closed but still means a coin can be temporarily unquotable. A keeper that stops also stops rebalancing, and a leveraged position that is not de-levered on the way down runs into the venue's liquidation threshold.
Concentration. Many coins can bond onto the same tracker, and they share one position. A bad day on one stock is a bad day for every coin behind it. The hedge book publishes exactly how concentrated the book is, because you should be able to see it.
Price impact on a thin coin. A fresh launch has very little behind it. Early buys move the price hard, and selling into that pool moves it hard the other way. This is not a hidden cost — the backing figure on every coin page is exactly how much is there.
The hedge account, and who holds which key
A tracker's vault is its own account on Nado. It deposits its USDT0 into its own subaccount — the vault's address followed by default — and every withdrawal from that account, whoever signs it, is paid back to the vault. No operator wallet ever holds the backing in transit.
The keeper is a linked signer: a key the vault owner chooses with setHedgeSigner(keeper), which the vault then links to its account on the venue. The venue enforces what that key may do — place and cancel orders, withdraw to the vault, move USDT0 between the vault's own subaccounts — and what it may not: send collateral to any other address.
How much can reach the venue at all is decided on chain: depositToHedge is capped at the vault's idle USDT0 above its redeem-buffer floor (fundableUsdt0()), so the keeper can never commit the money ordinary redemptions are paid from.
The vault owner keeps two controls that need no cooperation from the keeper and no key of the keeper's:
revokeHedgeSigner— the key loses its authority on chain in the same block, and the venue unlinks it within seconds. Orders signed by that key stop being accepted.requestHedgeWithdrawal— the vault asks the venue, on chain, to pay collateral back to itself. The venue honours it for whatever the open positions do not need.
Neither reads the oracle, and neither closes anything by itself: positions already open stay open, under the venue's own liquidation rules, until a new signer is linked to manage them. That is the honest cost of the kill switch, and it is why the switch is paired with rotation rather than offered alone. The small fee the venue charges for these on-chain requests is paid by the owner, never out of the backing.
What the protocol owner can do
Point the site at a different launcher, list or delist the markets the launch form offers, and choose, rotate or revoke the keeper's key on a tracker's vault and pull its collateral back as above. None of this touches a coin that already exists: its pool, its lock, its split and its creator are fixed at launch and no owner action reaches them.
Verify rather than trust
Every claim here is a public call or a bytecode inspection. The addresses are in Architecture, with verified sources on Ink Explorer. If a statement on this page and the chain disagree, the chain is right and we want to hear about it.
Audit status
The contracts have not been audited by a third party. They are tested — including against the real Nado and Uniswap contracts on a fork of Ink — deployed unproxied, and the bytecode is what runs.