Risk

Position health

Every request checks the position’s LTV against the market’s liquidation threshold with a configured buffer on top: an unwind is rejected unless the LTV sits the buffer distance below the liquidation LTV, which comes from the lending market itself. Oracle updates (Pyth) are submitted in the same transaction, so health checks always run on fresh prices rather than stale ones.

Illustrative thresholds: a market with an 86% liquidation LTV and a 6-point buffer rejects unwind requests above 80%. Oracle prices are refreshed in the same transaction as the check.

Pause and recovery

A safety manager can pause a manager, which blocks new requests and queue settlement. Liquidations are deliberately not blocked by a pause: keeping unhealthy positions liquidatable during an emergency preserves solvency for everyone else. A safety-close path exists for stuck requests (see when the tokenised asset side fails), and recovery beyond that is handled at the lending market level.

Isolation and its limits

Each request on an asynchronous market runs in its own escrow: collateral, debt, and interim assets are separated per request, so one user’s exit cannot consume another’s collateral. Positions on markets that wind synchronously carry no escrow; they sit on the user’s own account. One caveat is inherited from the settlement design: the manager holds aggregate settled funds on behalf of all requests, and liquidation payouts draw on that aggregate balance, so correct operator accounting is part of the trust surface.

Upgradeability

Nothing in the system is upgradeable. Escrows are minimal-proxy clones of an immutable implementation, and the manager contracts are immutable too: fixing a defect means deploying a new implementation for future requests or a new market through the factory, while already-deployed escrows never change. What users opted into is what runs to completion.

When the tokenised asset side fails

If the underlying asset itself fails (an issuer default, a sanctions event, an exploit on the tokenised asset platform), the safety manager pauses the market and can close affected requests through the safety-close path (safetyCloseWind, safetyCloseUnwind). The safety manager repays the request’s outstanding debt from its own funds, the escrow closes, and the interim collateral is withdrawn and burned; on the unwind side the Receipt NFT is burned with it. Recovering value from the failed asset then happens off-chain, outside the protocol.

The path is deliberately narrow: it only applies while the tokenised asset platform has delivered nothing for the request, and never while a liquidation auction round is active. It works while the market is paused, so recovery does not depend on reopening it.

Permissioned assets

Markets that list a permissioned tokenised asset depend on the issuer’s whitelist. Every transfer of the asset requires the issuer to have whitelisted both parties, so a wallet that loses its whitelist entry cannot receive or move the token, and transfers revert. See how it works.

Roles

Admin: Configuration and fee withdrawal.
Keyring operator: Finalises requests and settles redemption queues on users’ behalf.
Liquidation path: Auction-based for unwinding escrows, credential-gated bidders; native lending market liquidation for active positions.
Safety manager: Pause and unpause, and safety-close stuck requests; cannot block liquidations.