Risk Disclosures

Trading on CRX carries risk. This page names each risk and what secures it. The list is not exhaustive, and nothing here is investment advice.

WarningNot production, not audited. Every property below is a stated design property, not an audited fact. The audit is in process. Balances, pairs, and settlements carry no real value, and the network may be reset. Do not commit value you cannot afford to lose.

Eligibility and onboarding: Eligibility (~3 min).

Collateral & custody

All collateral sits in one on-chain vault, keyed by relationship: segregated, non-rehypothecable, never on CRX's balance sheet, and moved only on validated on-chain proof. The code is split across a few deployed contracts to stay within the per-contract size limit, but they share one state and act as one, detailed in CRX (~10 min). Keys are a multisig across parties with something at stake.

The audit is in process. Treat the contracts as unaudited code until a published audit says otherwise.

Smart contract risk

A contract could carry a bug. The design narrows the surface:

• Deterministic. The same inputs always produce the same result; the code never loops over stored lists or branches on who is calling.
• No growing on-chain lists. Position and asset sets are passed in with each call and checked by count and membership, so no call can run an unbounded loop.
• Split, but one state. A core contract and two engine contracts share one state and run as one. The full surface is in CRX (~10 min).

Until a published audit says otherwise, treat the contracts as unaudited code.

Oracle risk

The mark and the fixing both read Pyth, a price oracle published directly by major trading firms and exchanges and relied on across institutional DeFi. Each price is signed at the source and weighted by publisher confidence, so a thin or mispriced quote is all but ignored. CRX guards it further:

• FX rate. A print older than 30 seconds (MAX_MARK_AGE) is rejected, raising StaleMark.
• Collateral prices. A collateral price older than ten minutes is valued at zero, never trusted stale.
• Confidence-band breaker. A print the publishers disagree on is refused, and the mark falls back to the EMA.
• Missing or mis-scaled feed. It fails loud and halts the path that needed it.

If Pyth is unavailable for a pair, trades on it cannot mark or settle until it returns: no trade runs on a price the guards reject. See Oracle (~3 min).

Counterparty risk

Every trade settles against CRX as the dealer, so the use case carries counterparty exposure, as any bilateral trade does. Two structural properties secure it:

• Non-custodial collateral. Your margin is held by the contract, segregated, never on CRX's balance sheet, and moved only on validated on-chain proof. No counterparty failure can strand it.
• The defaulter pays first. A defaulting party's loss is taken from its own estate (its SCA for the relationship, then its general balance pro-rata) before any residual is carried. Any residual the estate cannot cover is borne by CRX, with ISDA recovery as the legal claim.

The loss is absorbed in a fixed order, each tranche reached only when the one before is exhausted:

Liquidation risk

An unmet variation-margin call closes the relationship out against the collateral posted there, not a maintenance-line trim. The call first ripens through the relationship's cure window: zero in a permissionless relationship, a grace period in a credit-checked one.

A local close-out (Tier-1) takes only the SCA posted in that relationship. A proven global shortfall escalates to the whole-book cascade (Tier-2), which sweeps every SCA and runs the waterfall above. Full procedure (order, tiers, worked steps) in the Credit Model (~8 min).

Glossary

Term	Meaning
EMA	Exponential moving average of the Pyth price: the fallback rate the oracle uses when the live spot's confidence band is too wide to trust.
SCA	Segregated Collateral Account: a party's initial margin inside one Account Control Agreement.
VM	Variation margin: the automatic on-chain debit that clears P&L as the rate moves.