Field guide / Protocol · 2 min read
Risks and assumptions
Stated plainly: issuer powers, revenue uncertainty, software, privileged roles, markets.
Pre-launch, and clear about it.
The deployed configuration splits the 4% protocol fee 1% holders, 1% liquidity, 1% staking and 1% operations, fixed in the treasury program with no setter. Staking itself is planned, phase 2: the allocation is set aside, but no staking program is deployed and nothing accepts a deposit. Values that have not been read from the chain render as a dash with the reason beside them.
Issuer and asset risk
- The xStock issuer holds a permanent delegate over every xStock account, including yours. It can freeze or move balances under its terms. Redemption depends on the issuer and its custodian.
- A tokenized stock is not a share held in a brokerage account. Corporate actions are handled as the issuer specifies.
- A stock whose market becomes too thin to buy or sell at size can be retired from the allowlist; its outstanding epochs still pay.
Revenue is uncertain
- Payouts are proportional to fee revenue. Low volume means low or zero payouts.
- Trades outside the launch venue and the protocol pools pay nothing to the treasury. More $FLUX volume does not necessarily mean more revenue.
- Protocol-owned liquidity in the protocol’s own token is a long position. It can lose value, and impermanent loss is real.
Software and privileged roles
- Bugs in the programs, the keeper, this site, Raydium, Meteora, Jupiter, Pyth or the token contracts can cause loss.
- The keeper is trusted to compute allocations honestly. A compromised keeper can misallocate a future epoch; it cannot move funds out of program vaults or rewrite a published root.
- The authority can withdraw liquidity from a pool at any time, immediately and even while the protocol is paused. The proceeds land only in protocol accounts and cannot be paid out as holder rewards, and moving value out of the protocol still takes seven days of continuous public pause. You are trusting the authority not to exit the protocol’s positions without cause.
- The upgrade authority can change the programs. It is intended to be a multisig; until then it is a single key held by the operator.
- An independent security review has not been completed.
Network and market conditions
- RPC outages, congestion and fee spikes can delay epochs and claims. A delayed epoch is published late, not skipped.
- Oracle staleness stops buys until fresh prices arrive; that is the guard working.
- Wallet connection alone does not establish anyone’s eligibility for a particular asset in a particular jurisdiction.