Risks and known limits
What is not finished and what can go wrong. Read this before you use the app.
Last updated 6 October 2026.
Nothing has been audited
No independent security firm has reviewed the contracts or the services around them. A bug could lose or lock funds.
An admin controls the testnet
For simplicity, the testnet is controlled by an administrator key on both networks. It can create USC, move the Treasury's holdings, and pause, reconfigure or replace contracts. On mainnet, the system is controlled by a decentralized community.
The bridge is weaker than it looks
Testnet only. Moving value between the two networks needs two of three signatures, but on the testnet all three signing keys run on one server, so whoever controls that server controls the bridge. Per-transfer limits cap the damage from one mistake; they do not stop someone who holds the keys. On mainnet, the bridge is controlled by the decentralized community.
The CAPE pool is small
Testnet only. On the testnet, one CAPE pool is the only place to buy the CAPE a new USC needs, and it holds only several thousand dollars of value on each side. A swap of a tenth of its depth moves the price by about 20%, and the move stays. The protocol values its own CAPE from this pool, so one person's swap changes the backing figure for everyone. On mainnet, CAPE has a market and does not depend on one pool.
Large withdrawals can be paid in two parts
The Merchant pays at once from the ETH it keeps ready. Anything above that waits in a queue until the protocol borrows ETH on Compound against its staked ETH or sells staked ETH. How fast that happens depends on Compound having ETH to lend and on the price of staked ETH in the pool. While it waits, the rest of your withdrawal is owed to you and is paid in the order requests arrived.
Borrowing is not subtracted from the backing
The backing per USC counts what the Treasury holds against the USC in circulation. ETH the protocol has borrowed on Compound is not subtracted from it; the amount is shown on its own on the Metrics page. Borrowed ETH can also end up staked, and on the testnet the pool that turns staked ETH back into ETH is small, so a loan can stay open until new deposits arrive. It is repaid automatically once enough ETH is ready.
Pairing with the pool is leveraged
Your stake moves with the ETH price about as much as holding the ETH would, and a little worse in both directions: if ETH falls 20%, your stake falls about 21%; if ETH halves, your stake falls about 59%. You carry all of that loss. The savings pot is paid its 9% first, whether or not the pool earns that much in fees. Positions close at 25% of your stake, and a very fast price move can take more than that before the close. On this testnet the pool uses test WETH that anyone can create for free, so it does not show how the product would behave with real money.
Savings are locked
A savings deposit cannot be taken out for 180 days, at any price. If you miss the 24-hour window after maturity, it locks for another 180 days. Interest is paid only while the savings pot's rewards can cover it.
Savings fund the lines
Part of the savings pot is lent to paired pools and held for protocols' crisis lines. If a protocol that drew a line does not repay, the loss is taken from the rewards set aside for savers first. Only a loss larger than those rewards reaches deposits, and then the savers who withdraw last carry the shortfall: earlier withdrawals are paid in full while the cash lasts. Each line has a limit, and a new line is written only if USC stays backed at 1.30 or more with every line drawn.
The testnet runs on one machine
For simplicity, chain 9000 runs on a single server, which has crashed and rolled back blocks several times, most recently a 31-hour stop in October 2026. The price updates, the bridge and the gas grant depend on it and on one free provider for reading Sepolia. When any of them stops, adding money, withdrawing or bridging can stop too. The status page shows the live checks. On mainnet, the system runs on many nodes.
These are test networks
Sepolia and chain 9000 are test networks. Test tokens have no market value, and test networks can be reset or abandoned. Never send real ETH or real stablecoins to any address shown here.
Questions or a problem to report: mk5303@columbia.edu.