Smart contract risk
Status
Section titled “Status”fact No third-party audit has been completed. The contracts have an internal testing methodology described in Security and nothing more. Do not deposit funds you cannot afford to lose entirely.
Surface
Section titled “Surface”| Component | Notes |
|---|---|
NoteCore, NoteLegs | Escrow and accounting for all series. A bug here can lose all escrowed USDG and Stock Tokens |
OracleAdapter, MarketCalendar | Wrong price or wrong close acceptance |
NOTE, sNOTE, Treasury, BondDepository, RevenueRouter, Desk | Token engine; a bug can mint or misprice NOTE, misvalue reserves, or misroute fees |
| OpenZeppelin v5.1.0 | Battle-tested dependency for ERC-20, ERC-1155, ERC-4626, Votes, Pausable, ReentrancyGuard |
| Solidity 0.8.28, Foundry | Checked arithmetic; custom FixedPointMath for WAD and bps operations |
Design choices that reduce risk
Section titled “Design choices that reduce risk”- No upgradeability. Contracts are not proxies. A fix requires a new deployment and migration; there is no admin function that can change logic under users.
- Pull payments only. No loops over holders, no pushes; each user pulls their own funds.
- Reentrancy guards on every state-changing external function that transfers tokens.
- Bounded parameters. Fees, haircut, discount, half-life, bump, fill cap and cooldown have compile-time maxima.
- Guardian can pause, cannot unpause or move funds. Owner is a timelock. See Governance.
Design choices that add risk
Section titled “Design choices that add risk”- ERC-1155 transfer hook.
NoteLegscalls back intoNoteCoreon every transfer. The hook is simple, but any contract calling intoNoteCorefrom a token callback is a classic reentrancy surface; guards are in place and tested. - External token behaviour. Stock Tokens may have transfer restrictions, hooks or supply adjustments outside the protocol’s control.
SafeERC20is used throughout, but a token that reverts unexpectedly can block redemptions for that series. - Fixed-point exponential.
ExpMath.halfLifeDecayWadis custom code; error bounds are tested but any error affects buyback pricing. - Governance actions with real teeth. Force-observe, cancel, calendar edits, treasury withdrawals. Bounded by delays and events, not eliminated.
Recommendations
Section titled “Recommendations”- Start with small positions and short-tenor series.
- Verify the deployed bytecode against the published source and the addresses on the Addresses page before interacting.
- Monitor
Paused,StrikeDeferred,ObservationDeferredand governance proposal events.