# Risk Factors > AN INVESTMENT IN NET INVOLVES A HIGH DEGREE OF RISK, INCLUDING THE RISK OF > TOTAL LOSS. THE FUND'S DEFINING FEATURE — NO GOVERNANCE, NO DISCRETION — > IS ALSO ITS DEFINING RISK: NOBODY CAN SAVE YOU, BECAUSE NOBODY CAN TOUCH > ANYTHING. READ THIS SECTION AS CAREFULLY AS YOU READ THE APY TABLE. THEY > ARE THE SAME TABLE. Each risk below is real, specific, and drawn from the protocol specifications — not boilerplate. Where the fund has a mitigation, it is stated; where it merely has a disclosure, that is stated too. ## 1. Thin liquidity, by choice This is a deliberately small offering, and the fund-owned pool opens correspondingly shallow: at a fully subscribed close, roughly **15,000 USDG and 5,000 NET a side**. Consequences, none of them subtle: * **Single trades of ordinary size move the price meaningfully.** Expect volatility that deeper markets would absorb, plus the 5% trading fee and AMM slippage on top. * **Exit capacity is limited.** Selling any meaningful fraction of your position into ~15,000 USDG of depth reprices the pool against you long before you are done. The Buyback Program (inverse bonds) is a floor bid near NAV, capped at 1% of liquid reserves per epoch — it is a floor, not an exit ramp. * The protocol's own operations are protected in a shallow pool by on-chain TWAP-deviation and clip-size bounds; **your trades have no such protection.** Fee inflows, bond sales, and premium sales deepen the fund-owned pool over time; day one is the shallowest the pool is designed to be. ## 2. Unmapped-pool fee bypass The 5% trading fee applies only to AMM pairs registered in the fee mapping. Uniswap v3, v4, and UniswapX are live on Robinhood Chain, and **anyone can create an unmapped NET pool that dodges the fee entirely.** Fee revenue — which becomes 100% treasury inflow after day 30 — could be structurally reduced if trading migrates to unmapped venues. *Mitigation (partial):* likely bypass pools are **pre-mapped at deploy** (Uniswap v3 NET/USDG and NET/WETH across all four fee tiers, plus the v2 NET/WETH pair, at their factory-predicted addresses — taxed from the moment anyone creates them). Uniswap v4 pools **cannot** be pre-mapped (pool IDs, not addresses), so v4 and UniswapX remain a standing monitoring duty, with discovered venues added instantly through an add-only key. The structural defense is fund-owned depth keeping the canonical v2 pool the best-execution venue — a managed race, not a solved problem, and thinner day-one depth (§1) makes the race tighter. ## 3. Morpho exposure Up to **70% of treasury USDG** may be deployed to Morpho at any time. A Morpho smart-contract failure, market insolvency, or liquidity crunch could impair the majority of the fund's reserves. The 2% RFV haircut prices normal conditions; it does not price a loss event. A withdraw path exists so bond and buyback obligations can be met by unwinding, but unwinding assumes Morpho is functioning. ## 4. No governance — the knife cuts both ways There are **no owner functions on the emissions path** and **no parameter-change path** anywhere short of redeployment. Consequently: * **A bug is an immutable bug.** If the emissions formula, cap check, or fee split misbehaves, no multisig can pause or patch the live deployment. * **No crisis response.** In a USDG depeg, a Morpho failure, or an oracle outage, the protocol keeps executing its formulas exactly as written, whether or not that is sensible in context. * **Defaults are forever.** Constants tuned before deploy (spreads, clip sizes, caps) cannot be retuned afterward, even if they prove miscalibrated at this offering's scale. The compensating control is scope: the only permissioned surface in the protocol is the trading-fee pair mapping and whitelist, and it is **add-only — no removal functions exist in code**. Everything else is enforced by an invariant test suite before it is enforced by nobody. ## 5. Fee-on-transfer limitations NET is a fee-on-transfer (FoT) token, which is a compatibility statement as much as a design choice: * **Uniswap v3-style routers revert** on FoT exact-output flows; the canonical pool must be, and is, Uniswap v2. Venues and aggregators that do not use FoT-safe swap paths will fail or misquote on NET. * Integrations that assume `amountSent == amountReceived` (some vaults, bridges, CEX deposit flows, payment contracts) can break or strand funds. * Buys and sells through mapped pairs bear the 5% fee on top of AMM fees and slippage; NET is expensive to trade by design, and the round trip through the fee is −10% before anything else happens. ## 6. Premium dependence of the dividend The dividend rate is zero at or below NAV (backing per token) and reaches its maximum only at a 1.75× premium. **If the market pays no premium, the Shareholder Dividend Program (staking) pays nothing** — indefinitely. The APY table in [The Fund](/mechanism) is conditional arithmetic, not an entitlement. Additionally, the RFV hard cap can clamp or halt emissions entirely whenever supply approaches reserves, which is precisely when headline rates would otherwise look most attractive. ## 7. Fail-closed pauses The protocol has **zero liveness dependency on management** — every operational entrypoint is permissionless, and the Buyback Program requires no caller at all. The residual liveness risk is the oracle: if no one checkpoints the TWAP for more than 4 hours, the protocol **fails closed** — the Distributor skips epochs (no dividends), and buyback and premium settlement refuse to execute — until someone pokes the permissionless `checkpoint()` and waits 30 minutes. A paused protocol never trades on a stale price, but a paused protocol also is not paying dividends or standing its bid. Anyone, including you, can revive it. ## 8. Oracle and TWAP risk All pricing derives from a TWAP (valid window: 30 minutes to 4 hours) on a single canonical Uniswap v2 pair, and the source pair is immutable. TWAPs resist flash-loan manipulation but not sustained capital: an actor willing to hold a distorted price across a meaningful part of the window can skew the dividend rate and both market-making triggers together — and in a pool this shallow (§1), holding a distorted price costs less than it would in a deep one. The protocol's TWAP-deviation and clip bounds limit what a distorted price can extract from the treasury per epoch; they do not prevent the distortion. ## 9. Stablecoin and chain dependence The 1 USDG floor is a floor **denominated in USDG**. A USDG depeg moves the floor with it. Robinhood Chain is an Arbitrum Orbit L2; sequencer downtime or chain-level failure suspends every mechanism described in this document, including the ones labeled "standing." ## 10. Forward-looking statements The RWA acquisition mandate is a **Phase 2 module that does not exist in the launch contracts** — activation requires a future, separately disclosed deployment, and it may never happen. The founding shareholder register and share certificate confer **no perk promised in code**. Any statement in these documents about the future is a statement about a formula's output under assumptions, and the assumptions are yours to reject. > THE FOREGOING DOES NOT PURPORT TO BE A COMPLETE LIST. THE COMPLETE LIST > IS UNWRITEABLE. THAT IS ITSELF A RISK FACTOR.