#The limits we accept

Stated plainly, not hidden.

#Capacity griefing

Someone can fill the $30 open-interest cap (or the vault's 80% lending limit) with small positions and pay 10% APR to keep them open. That denies service to other traders, but it steals nothing: every position still pays its fee and financing to LPs, and the vault stays fully secured. A related denial: donating USDG up to the $20 cap would block new deposits. It steals nothing either, and the attacker leaves about half the donation behind. The deploy script seeds the vault in the same run, so nobody can be the first depositor.

#LP exit lag after a weekend move

In the first minutes after the pool moves on a frozen feed, before the pool's 30-minute average leaves the 1.5% band, an LP can still withdraw at a mark that has not caught up. Exposure is bounded by idle cash and the $20 cap. Adding the pool's spot price to the mark would close this, but it would open a flash-manipulation path for depositors, which is worse.

The other direction matters too: while a position is open and the feed is frozen for the weekend, LP withdrawals wait for Monday's first fresh price. With no open positions, LPs can always withdraw.

#No keeper incentive

The risk. Knock-outs are permissionless, but nobody is paid to call them. A knock-out only happens when someone calls knockOut. If NVDA falls fast and nobody calls it, a position can fall past its worth-zero level. Then the sale no longer covers the debt, and the LPs take the difference as bad debt. The 5% buffer between the knock-out level and the worth-zero level only protects LPs if someone acts inside it.

The fix. Pay the caller from the position being closed: a small share of what is left above the debt, so a prompt knock-out is worth calling and the vault is still repaid first. A position that has already fallen past its worth-zero level has nothing left to pay from, which is the point: the reward goes to being early.

Why it is not in v1. The contracts have no owner and no upgrade path, so a keeper reward means redeploying both contracts. It changes the knock-out payout, which the solvency invariants, the adversarial pass and the planted-bug harness all exercise. Shipping it mid-event would have put untested payout code in front of real funds. Today the exposure is zero: there are no open positions. No keeper is running: with nothing to knock out it would only spend gas, and we will not leave a wallet with real funds sending transactions unattended. Anyone can be the keeper with the published knock-out watcher.

#Everything else

• NVDA only, long only. Shorts are v2: they need NVDA inventory in the vault.
• Upstream trust. Paxos can freeze a USDG address and Robinhood can pause the NVDA token. Either would freeze the affected flows.
• Calibration. The 1.5% band and 30-minute window come from one week of swaps that included one calm weekend. A weekend with a large pool move is modelled in the tests but has not been observed live.
• Corporate actions are not handled. NVDA's UI multiplier is 1.000775 today, inside the 1% fill guard. A split during an open position is out of scope.
• Knock-outs need a caller, and v1 pays none: see No keeper incentive above.
• Dead feed. If the feed has no usable print for 7 days, anyone may unwind positions at the pool's 30-minute average less 1% (vault repaid first).
• No sequencer-uptime check. No such feed is known on Robinhood Chain.
• Buildathon caps: the vault is capped at $20 USDG and open interest at $30, both in the contract.
• Not audited.