> ## Documentation Index
> Fetch the complete documentation index at: https://docs.denar.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk framework

> The risks Denar is built around — weekend gaps, oracle failures, bad debt — and the specific mechanism that bounds each one.

Equity collateral has a risk profile no crypto asset has. This page names each risk plainly and shows the specific mechanism that bounds it — no marketing, no hand-waving.

## The central risk: prices sleep, markets don't

Between Friday's close and Monday's open, a stock's on-chain price stands still while the real world moves. Earnings, news, macro — a stock can *gap* far beyond anything intraday. During that window, borrowing continues against the held price and liquidations can't react to information that doesn't exist on-chain yet.

**The buffer is the LLTV.** Crypto money markets run 80%+ loan-to-value because their prices never sleep. Denar runs **62.5%** on single stocks and **77%** on diversified ETFs — the gap to 100% is sized to absorb a violent weekend move before a position goes underwater. This is a deliberate, permanent design choice.

## The risk ladder, mechanism by mechanism

| Risk                    | What could happen                                                                                   | What bounds it                                                                                                                                  |
| ----------------------- | --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Weekend gap             | Stock gaps past the LLTV buffer before liquidation can react                                        | Conservative LLTVs; liquidation bonus attracts instant execution at Monday's price; bad debt, if any, is capped per market                      |
| Bad debt                | Underwater position's shortfall written off to lenders                                              | Isolation: loss lands only on that market's lenders; vault caps bound the exposure (2,500 USDG per market in the seed phase)                    |
| Oracle failure          | A feed goes wrong or silent                                                                         | Staleness bounds pause the market; freeze-don't-guess design; independent USDG feed; monitoring with alerts                                     |
| Corporate action mishap | Price and multiplier momentarily inconsistent                                                       | Issuer pause flag honored on every read — market pauses through processing ([proven live](/protocol/corporate-actions))                         |
| Issuer risk             | Stock tokens are issuer-operated and upgradeable; a prolonged pause freezes a market's liquidations | Isolation + caps bound exposure; curator can zero a cap instantly; monitoring alerts on pauses                                                  |
| Sequencer outage        | Chain ordering halts; liquidations delayed for everyone                                             | LLTV buffer absorbs the delay; sequencer guard ready for the chain's uptime feed                                                                |
| Liquidity crunch        | Withdrawals exceed unborrowed liquidity                                                             | Adaptive rates make full utilization expensive and self-correcting; positions keep earning while waiting                                        |
| Smart-contract bug      | A flaw in the code                                                                                  | Minimal new code over a formally verified core; full test suite; open source with verified deployments; external audit planned before caps rise |

## What cannot happen, by construction

<Check>
  **User funds cannot be trapped forever.** Repaying debt and recovering collateral works in every protocol state — including a permanently dead oracle. There is no pause button on repayment.
</Check>

<Check>
  **One market cannot poison another.** Markets share no accounting. NVDA's worst day is invisible to the AAPL market's books.
</Check>

<Check>
  **No fee can touch principal.** Fees apply to interest only, under hard-coded caps (25% core, 50% vault).
</Check>

<Check>
  **Risk can't be raised silently.** Cap increases and other risk-raising admin actions pass through a public 1-day timelock. De-risking is instant.
</Check>

## Current security posture, honestly

Denar launched after an internal adversarial security review (all findings fixed or consciously accepted and documented). The current phase is deliberately small: **2,500 USDG caps per market** while the protocol accumulates live history. Before caps rise significantly: an external audit, and hardening of the operational key setup described in [Governance](/protocol/governance).

<Warning>
  No protocol is risk-free. Audited components, guarded oracles, isolation, and caps reduce risk — they do not eliminate it. Never deposit or borrow more than you can afford to lose.
</Warning>