Risk Model

Design Assumptions

The Upside risk model is built on these assumptions:

1 Reserve backing is maintained

Deposited collateral remains in strategy and is available for exits

2 Upstream strategies are solvent

Yield strategyYield StrategyProtocol used to generate yield on deposited capital. Aave V3 is the only supported strategy at launch. Yield funds the platform fee and the project ecosystem budget. If buyback is enabled, yield surplus can also fund buyback and burn. (e.g., Aave V3) honors deposits and withdrawals

3 Oracle feeds are live

Deposit-time pricing requires accurate oracle data

4 On-chain mechanics are correct

Smart contract logic executes as designed

When these assumptions hold, principal protectionPrincipal ProtectionStructural guarantee that investors can always redeem their deposited collateral via the perpetual PUT. Proportional to reserve backing, not a fixed dollar guarantee. works as intended. The risk model addresses what happens when they don’t.

Risk Scenarios

Scenario Overview

Click a scenario to jump to full details below.

Yield to Zero

Principal still works, buyback (if enabled) stops

Auto-recovery when yield returns

Upstream Liquidity Crunch

Withdrawals temporarily constrained

Normalizes as liquidity returns

Smart-Contract Exploit

Strategy value drops, loss isolated to raise

Proportional settlement of remaining

Reserve Shortfall

Exits settle against available collateral

Circuit breaker slows panic velocity

Mass Redemption

Circuit breaker throttles, exits stretch over time

Same rate for all, no first-mover advantage

Oracle Outage

New deposits blocked

Exits still work (stored parameters)

Project Abandonment

Admin operations halt

Exit rights remain on-chain

Low impact

Medium impact

High impact

Yield goes to zero

Impact

• Principal mechanics still function, investors can still redeem - Configured buyback (if any) and ecosystem budget inflow stops - No guaranteed minimum yield - Platform revenue stops for that raise

Recovery

Automatic when yield conditions improve. No action required for exit rights.

Upstream liquidity crunch

Strategy liquidity is temporarily constrained (e.g., high Aave utilization).

Impact

• Withdrawal amounts may be temporarily constrained - Wrapper availability checks may reduce executable amount - Exits may require retries over time

Recovery

Liquidity normalizes as other Aave users repay. The capital still exists; it is temporarily lent out. This is a delay, not a loss.

Smart-contract exploit in strategy stack

Strategy capital is lost due to upstream protocol vulnerability.

Impact

• Reported strategy value drops - Exit paths continue, but payouts settle against actual remaining collateral - Loss is isolated to the affected raise context - The circuit breakerCircuit BreakerVelocity control on outflows that limits how fast capital can leave through wrapper withdraw paths. Uses a dual-buffer model to protect against exploit-velocity drains while keeping exits available over time. may activate to throttle outflows during the initial discovery window, spreading exits over time instead of rewarding the fastest responders

Recovery

Exits settle via proportional settlement against remaining collateral. Every investor receives the same proportional rate. Principal protection covers project-token downside, not reserve depletion from upstream strategy compromise.

Reserve shortfall

Strategy reserve collateral is below expected target (loss event or strategy accounting issue).

Impact

• Exits settle against available collateral and conversion constraints - Circuit breakerCircuit BreakerVelocity control on outflows that limits how fast capital can leave through wrapper withdraw paths. Uses a dual-buffer model to protect against exploit-velocity drains while keeping exits available over time. outflow controls slow panic/exploit velocity

Recovery

Each exit settles against available collateral. In normal operation this equals the original deposit; in a shortfall, it equals the proportional share of what remains.

Mass redemption

A large share of investors attempt exits via redeem in a short time window.

Impact

• Each exit uses the same conversion mechanics for that position - Wrapper and strategy liquidity governs immediate execution capacity - Circuit breaker can throttle outflow velocity - Processing may stretch across multiple blocks if upstream liquidity is constrained

Recovery

Everyone gets the same rate. Outflow limits spread exits over time, preventing first-movers from extracting at others' expense.

Oracle outage

Oracle feed is stale, zero, or invalid.

Impact

• New deposits are blocked/reverted - Existing position exits remain available through conversion math and reserve state - A prolonged outage pauses all new deposits, which can delay a raise from reaching its cap

Recovery

An oracle outage blocks deposits but does not block exits. Exit conversion uses stored position parameters, not a live price feed.

Project abandonment

Project team becomes inactive.

Impact

• Exit rights remain on-chain and user-callable - Strategy may continue accruing yield passively - Yield collection is permissionless; anyone can trigger the claim function - Administrative operations (e.g. configured buybackBuyback and BurnOptional mechanism where released capital from withdraws and yield surplus can be used to buy back and burn project tokens, reducing circulating supply. Enabled by the raise creator at raise creation. execution) halt if no operator acts

Recovery

Exit rights remain on-chain and user-callable. Yield collection is permissionless.

Rounding and Dust

Rounding and dust

Integer division leaves residual dust.

Impact

• Rounding always favors the protocol (reserve), never the user - Small residual balances can remain until final cleanup/sweep operations

Recovery

Rounding always favors the protocol (reserve), never the user. The amounts are negligible (wei-level).

Risk Isolation

Each raise operates in full isolationRaise IsolationEach raise operates with independent reserve collateral accounting, position state, yield strategy routing, and admin controls. A failure in one raise cannot affect other raises.: separate reserveReserveThe pool of collateral backing investor positions in a raise. Under normal conditions, each investor's proportional share equals their original deposit. In a shortfall, proportional settlement distributes what remains fairly. Reserve accounting is per-raise (isolated). accounting, position state, yieldYieldReturns generated by the yield strategy on deposited collateral. Variable, not guaranteed. Distributed via the yield waterfall: platform fee (10%) to DAO, then net yield (90%) to the project. routing, and admin controls. See Guarantees for details.

What Is and Isn’t Protected

Risk	Protected?	Mechanism
Project token goes to zero	Yes	PUT right returns collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral routes to the yield strategy and backs investor principal protection.
Project team disappears	Yes	Exits are permissionless on-chain
Upstream strategy exploit	No	Exits settle against remaining collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral routes to the yield strategy and backs investor principal protection.
Temporary liquidity crunch	Delayed	Retries succeed as liquidity normalizes
Oracle failure	Partial	Blocks depositsDepositThe action of investing collateral into a raise. The raise contract receives collateral, routes it to the yield strategy, and mints a pFT position NFT. A live oracle price feed determines USD notional for FT allocation via deposit-time conversion., exits still work
Volatile collateralCollateralThe asset an investor deposits into a raise (e.g., USDC, WETH). Each accepted collateral type runs in an isolated pool with independent reserve accounting. Active collateral routes to the yield strategy and backs investor principal protection. loses USD value	No	RedemptionRedeemExercise principal protection and exit to collateral. Implemented by the divest contract function. Permissionless and on-chain. is in depositDepositThe action of investing collateral into a raise. The raise contract receives collateral, routes it to the yield strategy, and mints a pFT position NFT. A live oracle price feed determines USD notional for FT allocation via deposit-time conversion. asset, not USD