# Risk Factors > AN INVESTMENT IN NET INVOLVES A HIGH DEGREE OF RISK, INCLUDING THE RISK OF > TOTAL LOSS. THE FUND'S DEFINING FEATURE — NO GOVERNANCE, NO DISCRETION — > IS ALSO ITS DEFINING RISK: NOBODY CAN SAVE YOU, BECAUSE NOBODY CAN TOUCH > ANYTHING. READ THIS SECTION AS CAREFULLY AS YOU READ THE APY TABLE. THEY > ARE THE SAME TABLE. Each risk below is real, specific, and drawn from the protocol specifications — not boilerplate. Where the fund has a mitigation, it is stated; where it merely has a disclosure, that is stated too. ## 1. Thin liquidity, by choice This was a deliberately small offering, and the fund-owned pool opened correspondingly shallow: at the fully subscribed close, roughly **15,000 USDG and 5,000 NET a side**. The pool has deepened since through fees, bonds, and premium sales, but it remains thin by any market's standard. Consequences, none of them subtle: * **Single trades of ordinary size move the price meaningfully.** Expect volatility that deeper markets would absorb, plus the 5% trading fee and AMM slippage on top. * **Exit capacity is limited.** Selling any meaningful fraction of your position into ~15,000 USDG of depth reprices the pool against you long before you are done. The Buyback Program (inverse bonds) is a floor bid near NAV, capped at 1% of liquid reserves per epoch — it is a floor, not an exit ramp. * The protocol's own operations are protected in a shallow pool by on-chain TWAP-deviation and clip-size bounds; **your trades have no such protection.** Fee inflows, bond sales, and premium sales deepen the fund-owned pool over time; day one is the shallowest the pool is designed to be. ## 2. Unmapped-pool fee bypass The 5% trading fee applies only to AMM pairs registered in the fee mapping. Uniswap v3, v4, and UniswapX are live on Robinhood Chain, and **anyone can create an unmapped NET pool that dodges the fee entirely.** Fee revenue — which becomes 100% treasury inflow after day 30 — could be structurally reduced if trading migrates to unmapped venues. *Mitigation (partial):* likely bypass pools are **pre-mapped at deploy** (Uniswap v3 NET/USDG and NET/WETH across all four fee tiers, plus the v2 NET/WETH pair, at their factory-predicted addresses — taxed from the moment anyone creates them). **Uniswap v4 and UniswapX are not taxable at all, and never will be.** This is a permanent gap, not a monitoring backlog: v4 pools live inside a singleton contract as pool IDs rather than addresses, and the fee hook is address-keyed, so there is nothing to map. (Mapping "the v4 pool" would mean taxing the singleton itself — which would tax every v4 pool on the chain, NetNet's and everyone else's.) Management reviewed this on 2026-07-14 and accepted it rather than distort the design around it. *Mitigation (partial):* fund-owned depth keeping the canonical v2 pool the best-execution venue. That is the only real defense — it always was; the fee mapping was never the thing standing between NET and a bypass. A managed race, not a solved problem, and thinner day-one depth (§1) makes the race tighter. If flow migrates to v4, fee revenue falls and the treasury's post-day-30 inflow falls with it. ## 3. Key custody: a single key holds the only permissioned surface The protocol has exactly one permissioned role — the guardian key that adds pools to the fee mapping and queues fee exemptions. Management holds it in a Safe at `0x3Bb7A23316f82C0e984fA2E784846d8928a35f42`, and **that Safe is configured 1-of-1**: one hardware-wallet owner, no second approver, no recovery path. The same address is the sole holder of the pTEAM option and is frozen into the contracts immutably at deployment. The fund's own specification recommends 2-of-3. Management accepted the weaker configuration; this document states so rather than let the word "multisig" imply protection that is not there. *What the key cannot do:* mint, pause, seize, change emissions, change the fee rate, or alter pTEAM's strike, cap, or vesting. It cannot even *remove* a mapped pool or an exemption — **no removal functions exist in the code** — and pool additions are validated on-chain against the canonical Uniswap factories, so the worst it can add is a genuine NET venue. *What a compromise costs:* the attacker gains the pTEAM option (up to 15% of float, exercisable only by paying 1 USDG per NET into the treasury) and the ability to exempt an address from the fee after a timelock. Loss of the key strands management compensation permanently. Raising the Safe's threshold does not change its address and remains possible until deployment freezes it. ## 4. Management's option is perpetual, and it tracks supply Management's pTEAM option is capped at 15% of circulating supply **measured at each exercise** — not 15% of a fixed snapshot. Because circulating supply grows with dividends and bond sales, the ceiling grows too. **Management can exercise again after every supply increase, restoring its holding to 15% of the new float, indefinitely.** The right does not expire. It is also always in-the-money: the strike is 1 USDG while NET is backed at a NAV above 1 USDG. Assume it will be exercised whenever supply grows. *What it does not cost you:* the floor. Every exercise pays 1 USDG into reserves for each NET minted, so backing per token can never be pushed below 1 USDG by it. *What it does cost you:* the premium. Minting NET at 1 USDG into a treasury whose NAV is higher drags NAV downward, toward the floor — this is one of only two operations permitted to dilute NAV at all (the other being the epoch dividend). Over time, a persistently inflating supply means a persistent, recurring NAV drag from management's exercises. Worked figures are in [Management Compensation](/team). Read them before subscribing. ## 5. Morpho exposure Up to **70% of treasury USDG** may be deployed to Morpho at any time. A Morpho smart-contract failure, market insolvency, or liquidity crunch could impair the majority of the fund's reserves. The 2% RFV haircut prices normal conditions; it does not price a loss event. A withdraw path exists so bond and buyback obligations can be met by unwinding, but unwinding assumes Morpho is functioning. ## 6. No governance — the knife cuts both ways There are **no owner functions on the emissions path** and **no parameter-change path** anywhere short of redeployment. Consequently: * **A bug is an immutable bug.** If the emissions formula, cap check, or fee split misbehaves, no multisig can pause or patch the live deployment. * **No crisis response.** In a USDG depeg, a Morpho failure, or an oracle outage, the protocol keeps executing its formulas exactly as written, whether or not that is sensible in context. * **Defaults are forever.** Constants tuned before deploy (spreads, clip sizes, caps) cannot be retuned afterward, even if they prove miscalibrated at this offering's scale. The compensating control is scope: the only permissioned surface in the protocol is the trading-fee pair mapping and whitelist, and it is **add-only — no removal functions exist in code**. Everything else is enforced by an invariant test suite before it is enforced by nobody. ## 7. Fee-on-transfer limitations NET is a fee-on-transfer (FoT) token, which is a compatibility statement as much as a design choice: * **Uniswap v3-style routers revert** on FoT exact-output flows; the canonical pool must be, and is, Uniswap v2. Venues and aggregators that do not use FoT-safe swap paths will fail or misquote on NET. * Integrations that assume `amountSent == amountReceived` (some vaults, bridges, CEX deposit flows, payment contracts) can break or strand funds. * Buys and sells through mapped pairs bear the 5% fee on top of AMM fees and slippage; NET is expensive to trade by design, and the round trip through the fee is −10% before anything else happens. ## 8. Premium dependence of the dividend The dividend rate is zero at or below NAV (backing per token) and reaches its maximum only at a 1.75× premium. **If the market pays no premium, the Shareholder Dividend Program (staking) pays nothing** — indefinitely. The APY table in [The Fund](/mechanism) is conditional arithmetic, not an entitlement. Additionally, the RFV hard cap can clamp or halt emissions entirely whenever supply approaches reserves, which is precisely when headline rates would otherwise look most attractive. ## 9. Fail-closed pauses The protocol has **zero liveness dependency on management** — every operational entrypoint is permissionless, and the Buyback Program requires no caller at all. The residual liveness risk is the oracle: if no one checkpoints the TWAP for more than 4 hours, the protocol **fails closed** — the Distributor skips epochs (no dividends), and buyback and premium settlement refuse to execute — until someone pokes the permissionless `checkpoint()` and waits 30 minutes. A paused protocol never trades on a stale price, but a paused protocol also is not paying dividends or standing its bid. Anyone, including you, can revive it. ## 10. Oracle and TWAP risk All pricing derives from a TWAP (valid window: 30 minutes to 4 hours) on a single canonical Uniswap v2 pair, and the source pair is immutable. TWAPs resist flash-loan manipulation but not sustained capital: an actor willing to hold a distorted price across a meaningful part of the window can skew the dividend rate and both market-making triggers together — and in a pool this shallow (§1), holding a distorted price costs less than it would in a deep one. The protocol's TWAP-deviation and clip bounds limit what a distorted price can extract from the treasury per epoch; they do not prevent the distortion. ## 11. Stablecoin and chain dependence The 1 USDG floor is a floor **denominated in USDG**. A USDG depeg moves the floor with it. Robinhood Chain is an Arbitrum Orbit L2; sequencer downtime or chain-level failure suspends every mechanism described in this document, including the ones labeled "standing." ## 12. Real-world asset positions The [Real World Bonds](/rwa-desk) desk is live and the Manager's RWA Sleeve holds tokenized equity positions. Equity prices can fall, and a decline reduces the value of those positions. **Sleeve assets are held outside the reserve and are never counted in backing or RFV**, so a fall does not impair the floor — and by the same token, shareholders should not read the Sleeve as support for the floor. Tokenized equities additionally carry the issuer and redemption mechanics of their tokenization, which are not the fund's to control. ## 13. Games of chance WinNET, the Superstore, CLIMB, INC., COINflip, and SPACEX INVADERS are games of chance. Odds are disclosed and outcomes are decided by a public randomness beacon, but a participant can lose their entire stake on any entry: most Superstore boxes pay less than their price, the expected result of a full CLIMB run is forfeiting the book, and every COINflip bet carries a negative expectation equal to its 5% fee. SPACEX INVADERS carries a negative expectation from two sources rather than one: its multiplier board returns about 90% of the stake on average before any fee, disclosed in the printed alien multipliers, and its 5% fee applies on top, for a combined expected return of about 85.5%. COINflip and SPACEX INVADERS additionally pay their winners in a tokenized stock, whose price moves and whose sale is gated on market hours. CLIMB, INC., the Superstore, COINflip, and SPACEX INVADERS are restricted to participants aged 18 or older. Each program's own page is its controlling disclosure. ## 14. Borrowing against the share The [Lombard Credit Facility](/lending) is a live Morpho market. Borrowers against wsNET collateral face liquidation if the credited value of their collateral falls, interest rates float with utilization, and the facility is a second Morpho dependency beyond the Treasury deployment in §5. Depositors' USDG is lent to those borrowers and earns only what they pay. ## 15. Forward-looking statements The founding shareholder register and share certificate confer **no perk promised in code**. Any statement in these documents about the future is a statement about a formula's output under assumptions, and the assumptions are yours to reject. > THE FOREGOING DOES NOT PURPORT TO BE A COMPLETE LIST. THE COMPLETE LIST > IS UNWRITEABLE. THAT IS ITSELF A RISK FACTOR.