Risk Model

Design Assumptions

The Upside risk model is built on these assumptions:

1. Reserve backingReserveThe pool of collateral backing investor positions in a raise. In normal operation, each investor's proportional share equals their original deposit. In a shortfall, proportional settlement ensures fair distribution. Reserve accounting is per-raise (isolated). is maintained — depositedDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion. collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection. remains in strategy and is available for exits
2. Upstream strategies are solvent — yield strategyYield StrategyProtocol used to generate yield on deposited capital. Aave V3 is the only supported strategy at launch. Yield funds the platform fee, project ecosystem budget, and buyback and burn. (e.g., Aave V3) honors depositsDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion. and withdrawalsWithdrawClaim project tokens and forfeit principal protection on the withdrawn amount. Implemented by withdrawFT. Requires transferable to be enabled. Released capital moves to capitalDivesting for buyback and burn.
3. Oracle feeds are live — depositDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion.-time pricing requires accurate oracle data
4. On-chain mechanics are correct — smart contract logic executes as designed

When these assumptions hold, principal protectionPrincipal ProtectionThe structural guarantee that investors can always redeem their deposited collateral via the perpetual PUT. Protection is proportional to reserve backing, not a fixed dollar guarantee. works as intended. The risk model addresses what happens when they don’t.

Risk Scenarios

Yield goes to zero

Impact:

• Principal mechanics still function, investors can still redeemRedeemExercise principal protection and exit to collateral. Implemented by the divest contract function. Always available, permissionless, and on-chain.
• BuybackBuyback and BurnMechanism where released capital from withdraws and yield surplus are used to buy back and burn project tokens, reducing circulating supply. and ecosystem budget inflow stops
• No guaranteed minimum yieldYieldReturns generated by the yield strategy on deposited collateral. Variable and not guaranteed. Distributed via the yield waterfall: platform fee (10%) to DAO, then net yield (90%) to the project.
• Platform revenue stops for that raise

Recovery: Automatic when yieldYieldReturns generated by the yield strategy on deposited collateral. Variable and not guaranteed. Distributed via the yield waterfall: platform fee (10%) to DAO, then net yield (90%) to the project. conditions improve. No action required for exit rights.

Upstream liquidity crunch

Scenario: Strategy liquidity is temporarily constrained (e.g., high Aave utilization).

Impact:

• High Aave utilization may temporarily constrain withdrawalWithdrawClaim project tokens and forfeit principal protection on the withdrawn amount. Implemented by withdrawFT. Requires transferable to be enabled. Released capital moves to capitalDivesting for buyback and burn. amounts
• Wrapper availability checks may reduce executable amount
• Exits may require retries over time

Recovery: Liquidity normalizes as other Aave users repay, the capital still exists, it’s just temporarily lent out. This is a delay, not a loss.

Smart-contract exploit in strategy stack

Scenario: Strategy capital is lost due to upstream protocol vulnerability.

Impact:

• Reported strategy value drops
• Exit paths continue, but payouts settle against actual remaining collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection.
• Loss is isolatedRaise IsolationEach raise operates with independent reserve collateral accounting, position state, yield strategy routing, and admin controls. A failure in one raise does not affect unrelated raises. to the affected raise context

Recovery: Exits settle via proportional settlementProportional SettlementEach investor receives their proportional share of the reserve pool. In normal operation, this equals the original deposit. In a reserve shortfall, it equals the proportional share of what remains. The last person to redeem gets the same rate as the first. against actual remaining collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection. — every investor gets the same proportionalProportional SettlementEach investor receives their proportional share of the reserve pool. In normal operation, this equals the original deposit. In a reserve shortfall, it equals the proportional share of what remains. The last person to redeem gets the same rate as the first. rate. See Guarantees for details.

Principal protectionPrincipal ProtectionThe structural guarantee that investors can always redeem their deposited collateral via the perpetual PUT. Protection is proportional to reserve backing, not a fixed dollar guarantee. is designed against project-token downside, not against reserveReserveThe pool of collateral backing investor positions in a raise. In normal operation, each investor's proportional share equals their original deposit. In a shortfall, proportional settlement ensures fair distribution. Reserve accounting is per-raise (isolated). depletion from upstream strategy compromise.

Reserve shortfall

Scenario: Strategy reserveReserveThe pool of collateral backing investor positions in a raise. In normal operation, each investor's proportional share equals their original deposit. In a shortfall, proportional settlement ensures fair distribution. Reserve accounting is per-raise (isolated). collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection. is below expected target (loss event or strategy accounting issue).

Impact:

• Exits settle against real available collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection. and conversion constraints
• Circuit breakerCircuit BreakerVelocity control on outflows that limits how fast capital can leave through wrapper withdraw paths. Uses a dual-buffer model to protect against exploit-velocity drains while ensuring exits remain available over time. outflow controls can slow panic/exploit velocity

Recovery: Each investor’s exit settles against real available collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection.. In normal operation this equals the original depositDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion.; in a shortfall, it equals the proportionalProportional SettlementEach investor receives their proportional share of the reserve pool. In normal operation, this equals the original deposit. In a reserve shortfall, it equals the proportional share of what remains. The last person to redeem gets the same rate as the first. share of what remains.

Oracle outage

Scenario: Oracle feed is stale, zero, or invalid.

Impact:

• New depositsDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion. are blocked/reverted
• Existing position exits remain available through conversion math and reserveReserveThe pool of collateral backing investor positions in a raise. In normal operation, each investor's proportional share equals their original deposit. In a shortfall, proportional settlement ensures fair distribution. Reserve accounting is per-raise (isolated). state

An oracle outage blocks depositsDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion. but does not block exits, exit conversion uses stored position parameters, not a live price feed.

Project abandonment

Scenario: Project team becomes inactive.

Impact:

• User exit rights remain on-chain and user-callable
• Strategy may continue accruing yieldYieldReturns generated by the yield strategy on deposited collateral. Variable and not guaranteed. Distributed via the yield waterfall: platform fee (10%) to DAO, then net yield (90%) to the project. passively
• YieldYieldReturns generated by the yield strategy on deposited collateral. Variable and not guaranteed. Distributed via the yield waterfall: platform fee (10%) to DAO, then net yield (90%) to the project. collection is permissionless, anyone can trigger the claim function
• Administrative operations (e.g., buybackBuyback and BurnMechanism where released capital from withdraws and yield surplus are used to buy back and burn project tokens, reducing circulating supply. execution) may halt if no operator acts

Investor exit rights are on-chain and do not depend on the project team remaining active.

Risk Isolation

Each raise operates in full isolationRaise IsolationEach raise operates with independent reserve collateral accounting, position state, yield strategy routing, and admin controls. A failure in one raise does not affect unrelated raises. — separate reserveReserveThe pool of collateral backing investor positions in a raise. In normal operation, each investor's proportional share equals their original deposit. In a shortfall, proportional settlement ensures fair distribution. Reserve accounting is per-raise (isolated). accounting, position state, yieldYieldReturns generated by the yield strategy on deposited collateral. Variable and not guaranteed. Distributed via the yield waterfall: platform fee (10%) to DAO, then net yield (90%) to the project. routing, and admin controls. See Guarantees for details.

What Is and Isn’t Protected

Risk	Protected?	Mechanism
Project token goes to zero	Yes	PUT right returns collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection.
Project team disappears	Yes	Exits are permissionless on-chain
Upstream strategy exploit	No	Exits settle against remaining collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection.
Temporary liquidity crunch	Delayed	Retries succeed as liquidity normalizes
Oracle failure	Partial	Blocks depositsDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion., exits still work
Volatile collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral is routed to the yield strategy and backs investor principal protection. loses USD value	No	RedemptionRedeemExercise principal protection and exit to collateral. Implemented by the divest contract function. Always available, permissionless, and on-chain. is in depositDepositThe action of investing collateral into a raise. Collateral is received by the raise contract, routed to the yield strategy, and a pFT position NFT is minted. At deposit time, a live oracle price feed determines USD notional for FT allocation via deposit-time conversion. asset, not USD