Risks
What can go wrong, including the parts that are not finished.
This page is written to be useful to someone deciding whether to put money at risk, which means it leads with the things that would make a careful reader say no.
Not audited
No external audit has been performed. An internal review produced a set of findings, several of which are not yet fixed. They are listed on status rather than held back.
Until an audit has happened, the correct assumption is that unknown bugs exist.
One key controls everything
Every administrative role — upgrade rights, risk parameters, pausing, the oracle configuration — is held by a single externally-owned account. There is no multisig and no timelock.
In practice: whoever holds that key can change your liquidation threshold, pause the market, or upgrade the contracts, and nothing delays it or requires a second signature.
A move to a Safe multisig is planned. It is more involved than transferring one owner, because upgrade rights over each market and each Position are granted at construction time rather than read from the factory when used — so transferring factory ownership does not move them. They have to be migrated one at a time.
Upgradeable contracts
The factory, markets, routers, positions, rate model and data stream are UUPS proxies. Their implementation can be replaced. Combined with the point above, that means the rules governing your position can change without warning.
The earn vault and the stable engine are not upgradeable — which has its own cost: fixing them means deploying new ones, and the old instances keep their state. That has already happened once.
Oracle dependencies
The protocol prices positions from Chainlink feeds. That introduces parties you do not control:
- The feed's issuer can pause it. The protocol then refuses to price on it, which means your position cannot be borrowed against or liquidated until it resumes.
- If a feed reports a wrong price, the protocol acts on it. There is no second source to cross-check against, and no TWAP fallback — for reasons, but the consequence stands.
- Only a subset of Stock Tokens have a feed at all. Counted from Chainlink's own reference data directory on 2026-09-17: 35 feeds carrying US equity market hours, out of roughly 194 Stock Tokens — about 18%. A market cannot exist for an asset with no feed, so this bounds the protocol regardless of demand.
Weekend and holiday gaps
The largest risk specific to this protocol. While the equity market is closed the price cannot move, so borrowing and liquidation pause — but the world keeps moving.
A position that was comfortably healthy at Friday's close can be deeply underwater at the reopen, with no opportunity for anyone to act in between. Several positions may become liquidatable in the first minutes of a session at once, which is also when liquidity to liquidate them is thinnest.
Measured from the feeds themselves rather than assumed: an ordinary weekend gap is about 52 hours for NVDA and 59 for SPY. Over a long weekend it reached 78 to 81 hours. And the frozen price is frequently not the closing price — one feed's last Friday update was five hours before the close, so the number your position is valued at over the weekend can predate the session's end.
One thing not to read into this: the on-chain weekend behaviour sampled so far was calm, with deviations around 1.5% at the reopen. That is one observation of a quiet period. It says nothing about what a gap looks like after an earnings miss or a weekend of news, and it should not be taken as evidence that the gap is bounded.
Lower LTVs on Stock Token markets are the mitigation. They are not a guarantee.
Bad debt
If a liquidation cannot cover the debt, the shortfall is borne by that market's lenders. Isolation bounds it to one market; it does not prevent it.
This has already happened on testnet.
Liquidity
Withdrawals need idle liquidity. At 100% utilisation there is none until someone repays. The interest rate curve is what corrects this, and it works by making borrowing expensive rather than by producing liquidity on demand.
The asset itself
A Stock Token is an instrument issued by a third party, not a bearer claim on the underlying equity. Its issuer has powers over it, and the token can be affected by corporate actions, delisting, and the issuer's own operational decisions — all outside this protocol's control.
USDG likewise has an issuer with its own powers over the token.
Powers the issuer holds over the collateral
These are properties of the Stock Token contracts, not of Paboxo, and they apply to collateral sitting in a Position exactly as they apply to a token in a wallet. Verified against the deployed contracts (2026-09-14):
| Administrative burn | Tokens can be burned from any address. This is the sharpest one: it carries no pause guard and no blocklist guard, so it works on any balance at any time, emitting only a transfer to the zero address |
| Pause | Globally and per token. While paused, collateral cannot move — which means it cannot be liquidated either, while interest keeps accruing |
| Blocklist | Blocks receiving as well as sending. A blocked Position cannot be topped up or liquidated into |
| Mint | Uncapped |
| Upgrade | A single role upgrades the shared implementation of all Stock Tokens at once |
All of these roles sit on externally-owned accounts with no code, and there is no timelock anywhere. Whether those accounts are backed by MPC or a custodial arrangement is not determinable on-chain, so the honest statement is "no on-chain multisig or timelock", not a claim about how many people hold a key.
Worth stating alongside: none of these powers appears to have been used since launch. The blocklist was populated once before launch with roughly 200 sanctioned addresses.
Delisting can strand a contract
The issuer may terminate a series and pay fair market value to holders — but redemption requires the redeemer to pass KYC, AML and sanctions screening, and no payment is made for frozen or seized tokens.
A smart contract cannot pass KYC. If a Stock Token held as collateral is delisted, that collateral has to be sold before the liquidation date, because the contract holding it cannot redeem it. Wind-down is the mechanism for retiring the market; it does not solve the redemption problem for anyone still holding the token.
No delisting has happened since launch, so the procedure is untested.
Corporate actions
Dividends and splits are applied through a UI multiplier (ERC-8056, a draft standard) rather than by rebasing balances — raw amounts keep working. Note for integrators: the Chainlink price already includes the multiplier. Multiplying by it again double-counts. A different Chainlink product carries the raw underlying and requires applying it manually, so the two conventions are opposite and easy to confuse.
Chain
Robinhood Chain is an Arbitrum Nitro chain operated by a single party. Sequencing, censorship resistance and exit guarantees are properties of that chain, not of this protocol, and they should be evaluated separately.
Testnet is not a rehearsal for value
Every asset on testnet is a mock, the DEX is a mock whose rate table anyone can set, and the prices mean nothing. Testnet demonstrates that the mechanism runs. It demonstrates nothing about what the mechanism is worth.