Risks

This page sets out the risks to weigh before you deposit or borrow on Paboxo.

A 2-of-4 Safe controls everything

Every administrative role — upgrade rights, risk parameters, unpausing, the oracle configuration — is held by the protocol Safe, a 2-of-4 multisig that also receives the protocol fee. Since 4 November 2026 (block 105757627) it also holds every single-owner setting: the market calendar, all eight price-feed adapters of the time and the three added on 13 November 2026, the factory's owner() and the Earn vault's vaultAdmin. No other account holds any of them.

One narrow power sits with a separate pauser key: PAUSER_ROLE on each market's lending pool. It can pause a market and do nothing else. It cannot unpause, move reserves, change a parameter or upgrade anything. It exists so a market can be stopped within one block, without waiting for two signatures.

In practice: any two of the Safe's four signers can change your liquidation threshold, pause or resume a market, or upgrade the contracts.

Some settings are bounded on-chain. The interest rate model refuses a curve that would stop interest from accruing, a max rate above 1,000% a year, or a reserve factor above 50%. These bounds guard against a mistake. They do not limit the key holder, who can still upgrade the contract itself.

Upgrade rights over each market and each Position are granted at construction time from the factory's owner(), which has been the Safe since 4 November 2026, so a market or Position created from then on starts with the Safe's roles and nobody else's.

Upgradeable contracts

The factory, markets, routers, positions, rate model, data stream, the Earn vault and the Earn vault factory are UUPS proxies. Their implementation can be replaced. Combined with the point above, that means the rules governing your position — and your Earn deposit — can change without warning.

The Earn vault's upgrade right is not its curator's. It resolves, on every call, to the vaultAdmin that the EarnVaultFactory names — the same externally-owned account as everything else.

Oracle dependencies

The protocol prices positions from Chainlink feeds. That introduces parties you do not control:

• The feed's issuer can pause it. The protocol then refuses to price on it, which means your position cannot be borrowed against or liquidated until it resumes.
• If a feed reports a wrong price, the protocol acts on it. There is no second source to cross-check against, and no TWAP fallback — for reasons, but the consequence stands.
• Only a subset of Stock Tokens have a feed at all. Counted from Chainlink's own reference data directory on 2026-09-17: 35 feeds carrying US equity market hours, out of roughly 194 Stock Tokens — about 18%. A market cannot exist for an asset with no feed, so this bounds the protocol regardless of demand.

Weekend and holiday gaps

The largest risk specific to this protocol. While the equity market is closed the price cannot move, so borrowing and liquidation pause — but the world keeps moving.

A position that was comfortably healthy at Friday's close can be deeply underwater at the reopen, with no opportunity for anyone to act in between. Several positions may become liquidatable in the first minutes of a session at once, which is also when liquidity to liquidate them is thinnest.

Measured from the feeds themselves rather than assumed: an ordinary weekend gap is about 52 hours for NVDA and 59 for SPY. Over a long weekend it reached 78 to 81 hours. And the frozen price is frequently not the closing price — one feed's last Friday update was five hours before the close, so the number your position is valued at over the weekend can predate the session's end.

A calm weekend says nothing about what a gap looks like after an earnings miss or a weekend of news, and should not be taken as evidence that the gap is bounded.

Lower LTVs on Stock Token markets are the mitigation. They are not a guarantee.

Bad debt

If a liquidation cannot cover the debt, the shortfall comes out of what the Earn vault has lent to that market, and with it out of the value of every peUSDG share. Because the liquidator is paid the bonus first, that happens as soon as the collateral is worth less than the debt plus the bonus — not only once it is worth less than the debt — so a small shortfall in collateral can become a much larger loss for lenders (see liquidation math). Markets are isolated for borrowers, not for lenders: the vault is the only lender everywhere, so one market's bad debt is shared by every Earn depositor. The vault's per-market cap bounds it — and that cap is currently unlimited — so nothing prevents it.

As of 2026-10-27 the indexer shows one borrow on mainnet (50 USDG on WETH/USDG, 19 October 2026), no liquidations and no bad debt.

LP markets

In the two LP markets your collateral is a Uniswap liquidity position. On top of everything on this page it carries impermanent loss, a range the price can leave, a pool price that can drift from the oracle the position is valued at, and Uniswap itself as a third party. Rebalance agents you appoint can move your position within the limits you set, and cost slippage and pool fees each time.

Liquidity

Withdrawals need idle liquidity. At 100% utilisation there is none until someone repays. The interest rate curve is what corrects this, and it works by making borrowing expensive rather than by producing liquidity on demand.

The asset itself

A Stock Token is an instrument issued by a third party, not a bearer claim on the underlying equity. Its issuer has powers over it, and the token can be affected by corporate actions, delisting, and the issuer's own operational decisions — all outside this protocol's control.

USDG likewise has an issuer with its own powers over the token.

Powers the issuer holds over the collateral

These are properties of the Stock Token contracts, not of Paboxo, and they apply to collateral sitting in a Position exactly as they apply to a token in a wallet. Verified against the deployed contracts (2026-09-14):

All of these roles sit on externally-owned accounts with no code. Whether those accounts are backed by MPC or a custodial arrangement is not determinable on-chain, so the accurate statement is "no on-chain multisig", not a claim about how many people hold a key.

Worth stating alongside: none of these powers appears to have been used since launch. The blocklist was populated once before launch with roughly 200 sanctioned addresses.

Delisting can strand a contract

The issuer may terminate a series and pay fair market value to holders — but redemption requires the redeemer to pass KYC, AML and sanctions screening, and no payment is made for frozen or seized tokens.

A smart contract cannot pass KYC. If a Stock Token held as collateral is delisted, that collateral has to be sold before the liquidation date, because the contract holding it cannot redeem it. Wind-down is the mechanism for retiring the market; it does not solve the redemption problem for anyone still holding the token.

No delisting has happened since launch, so the procedure is untested.

Corporate actions

Dividends and splits are applied through a UI multiplier (ERC-8056, a draft standard) rather than by rebasing balances — raw amounts keep working. Note for integrators: the Chainlink price already includes the multiplier. Multiplying by it again double-counts. A different Chainlink product carries the raw underlying and requires applying it manually, so the two conventions are opposite and easy to confuse.

Chain

Robinhood Chain is an Arbitrum Nitro chain operated by a single party. Sequencing, censorship resistance and exit guarantees are properties of that chain, not of this protocol, and they should be evaluated separately.