> ## Documentation Index
> Fetch the complete documentation index at: https://docs.denar.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk framework

> The risks Denar is built around — weekend gaps, oracle failures, bad debt — and the specific mechanism that bounds each one.

Equity collateral has a risk profile no crypto asset has. This page names each risk plainly and shows the specific mechanism that bounds it — no marketing, no hand-waving.

## The central risk: prices sleep, markets don't

Between Friday's close and Monday's open, a stock's on-chain price stands still while the real world moves. Earnings, news, macro — a stock can *gap* far beyond anything intraday. During that window, borrowing continues against the held price and liquidations can't react to information that doesn't exist on-chain yet.

**The buffer is the LLTV.** Crypto money markets run 80%+ loan-to-value because their prices never sleep. Denar runs **62.5%** on single stocks and **77%** on diversified ETFs — the gap to 100% is sized to absorb a violent weekend move before a position goes underwater. This is a deliberate, permanent design choice.

## The risk ladder, mechanism by mechanism

| Risk | What could happen | What bounds it |
| - | - | - |
| Weekend gap | Stock gaps past the LLTV buffer before liquidation can react | Conservative LLTVs; liquidation bonus attracts instant execution at Monday's price; bad debt, if any, is capped per market |
| Bad debt | Underwater position's shortfall written off to lenders | Isolation: loss lands only on that market's lenders; vault caps bound the exposure, and the two vaults never share it |
| Oracle failure | A feed goes wrong or silent | Staleness bounds pause the market; freeze-don't-guess design; independent USDG feed; monitoring with alerts |
| Corporate action mishap | Price and multiplier momentarily inconsistent | Issuer pause flag honored on every read — market pauses through processing ([proven live](/protocol/corporate-actions)) |
| Issuer risk | Stock tokens are issuer-operated and upgradeable; a prolonged pause freezes a market's liquidations | Isolation + caps bound exposure; curator can zero a cap instantly; monitoring alerts on pauses |
| Sequencer outage | Chain ordering halts; liquidations delayed for everyone | LLTV buffer absorbs the delay; sequencer guard ready for the chain's uptime feed |
| Liquidity crunch | Withdrawals exceed unborrowed liquidity | Adaptive rates make full utilization expensive and self-correcting; positions keep earning while waiting |
| Smart-contract bug | A flaw in the code | Minimal new code over a formally verified core; full test suite; every deployed contract verified on Blockscout with public on-chain source; external audit planned before caps rise |

## On-chain-native collateral: a different ladder

The risks above are the risks of *equity* collateral. [On-chain-native markets](/protocol/onchain-markets) swap almost all of them for a different set.

| Risk | What could happen | What bounds it |
| - | - | - |
| Oracle manipulation | Someone pushes the Uniswap pool far enough, long enough, to move the time-weighted price and borrow against inflated collateral | The supply cap, sized below the cost of moving the pool; a 5-minute averaging window; a low LLTV that makes walking away unprofitable until the price is moved enormously |
| Liquidation lag | In a fast crash the time-weighted price stays above what a liquidator can sell at, so liquidating stops paying | Measured at 4.44% against a 15% incentive through a real −10.2%/8min move; the window is chosen for this, not only for manipulation resistance |
| Pool liquidity leaving | The pool thins out and the price becomes both wrong and unsellable | The oracle freezes below a liquidity floor and if the pool goes untraded; caps are sized to measured exit depth |
| Volatility | These assets move far more than equities, and around the clock | LLTV 38.5% — a position survives a 61.5% fall before bad debt; a separate vault so the loss never reaches equity lenders |

There is no weekend gap, no issuer risk and no corporate-action risk in these markets — those three simply do not exist for a token with no issuer and no closing bell.

## What cannot happen, by construction

<Check>
  **User funds cannot be trapped forever.** Repaying debt and recovering collateral works in every protocol state — including a permanently dead oracle. There is no pause button on repayment.
</Check>

<Check>
  **One market cannot poison another.** Markets share no accounting. NVDA's worst day is invisible to the AAPL market's books.
</Check>

<Check>
  **No fee can touch principal.** Fees apply to interest only, under hard-coded caps (25% core, 50% vault).
</Check>

<Check>
  **Risk can't be raised silently.** Cap increases and other risk-raising admin actions pass through a public 1-day timelock. De-risking is instant.
</Check>

## Current security posture, honestly

Denar launched after an internal adversarial security review, and the dUSD suite, the oracles and the liquidator have since been assessed by [Hashlabs](https://www.denar.markets/audit.pdf): no critical or high findings. The current phase is deliberately small: **10,000 USDG caps per equity market**, 20,000 on the on-chain-native ones, while the protocol accumulates live history. Before caps rise significantly: the report's low findings closed in one release, the operational key setup described in [Governance](/protocol/governance) finished, and a second external audit.

<Warning>
  No protocol is risk-free. Audited components, guarded oracles, isolation, and caps reduce risk — they do not eliminate it. Never deposit or borrow more than you can afford to lose.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.