Arc Perp
Wallet login not configured

Risks & security

What is actually guaranteed, what is not, and what can still go wrong. Written as we would want to read it.

What cannot happen

The liquidity cannot be withdrawn. Not by the creator, not by us, not by a compromised key. The locker has no function that moves the position — see Locked liquidity.

The supply cannot grow. Minted once, in the constructor. There is no mint function.

Your sells cannot be blocked by the token. No branch of the token contract gates a transfer out of a wallet, in any block, under any condition. The anti-snipe window restricts buying only, and expires on a block number. (USDC's own blocklist is a separate matter — see below.)

Your fees cannot be redirected. The creator address is written when the coin is locked and has no setter.

A bond cannot strand liquidity. The migration reverts unless essentially everything withdrawn is redeposited.

A tracker's vault cannot pay anyone but its hedge wallet. The one path by which margin leaves a vault, fundHedge, sends only to the vault's hedgeFunder, only out of idle USDC above the redemption floor, never before the tracker bonds and never while the vault is paused. The caller picks an amount, never a destination.

A tracker cannot promise more leverage than its hedge can hold. The factory caps every tracker at the lower of 5× and 90% of the venue's own cap for the market, on chain.

What you are exposed to

The tracker is leveraged, and leverage decays. A bonded coin's floor is a leveraged position — up to 5×. It loses ground on a round trip in the underlying, it pays funding every 4 hours and trading fees, and it can be liquidated. See NAV, decay & funding. This is the single most important thing on this page.

The venue. The perpetual position backing a tracker lives on edgeX, an order-book perpetuals exchange that runs on its own chain. We do not control it and cannot insure it. If it pauses or halts a market, misprices it, changes its rules, or stops answering, the backing behind every coin on that tracker is affected. edgeX liquidates an account when its equity falls below its maintenance margin — at 5× on a market like Nvidia, about 17.9% against a long or 17.1% against a short from the averaged entry (see The hedge book for every market), plus a 1% liquidation fee.

Stock hours on a 24/7 venue. edgeX lists its stock and ETF markets around the clock, but while the underlying market is closed — nights and weekends — it rejects market orders and only accepts limit orders inside a band around the last close. The keeper sends only immediate-or-cancel limit orders inside that band; on a thin night book they may not fill, so de-levering can take several attempts, and the price can gap when the underlying market reopens.

Position caps. Each edgeX market caps one account's position (for example 900 units of Nvidia) and steps allowed leverage down above a notional of $200,000 ($300,000 on gold, silver and WTI). Every coin on a tracker shares one account, so a very large tracker runs below its stated multiple rather than past the cap.

Funding. Settled every 4 hours on edgeX, at a rate the venue sets. It can run against a tracker for long stretches.

The keeper and the NAV. NAV is computed and signed by the protocol's keeper and posted on chain; the chain cannot check it against the venue, because the venue's accounts are not on Arc. If the keeper stalls, NAV goes stale; after 15 minutes the contracts refuse to mint or redeem that tracker rather than act on an old price, which fails closed but still means a coin can be temporarily unquotable. A keeper that stops also stops rebalancing, and a leveraged position that is not de-levered on the way down runs into the venue's liquidation threshold.

Redemptions can wait. Shared trackers keep no idle buffer, so most of a bonded tracker's dollars sit on edgeX. A redeem the vault cannot pay at once joins a first-in-first-out queue the keeper fills by withdrawing from the venue — about a minute per withdrawal when all goes well, longer if a withdrawal is large, the market is closed, or the venue is slow. A queued redeem can be cancelled until it executes.

Concentration. Many coins can bond onto the same tracker, and they share one position. A bad day on one stock is a bad day for every coin behind it. The hedge book publishes exactly how concentrated the book is, because you should be able to see it.

Price impact on a thin coin. A fresh launch has very little behind it. Early buys move the price hard, and selling into that pool moves it hard the other way. This is not a hidden cost — the backing figure on every coin page is exactly how much is there.

Custody and trust: who holds the hedge

This is the part that is not trustless, stated plainly.

A smart contract cannot own an edgeX account. So each tracker's position sits in an edgeX account of its own, held by the protocol's hedge wallet — an ordinary wallet whose key the protocol holds. The vault sends it money only through fundHedge; the keeper deposits that money into the tracker's account in the same pass; and every withdrawal the keeper makes names the vault as recipient, so edgeX pays the vault directly. Orders are signed by a separate key that can only trade.

What that leaves you trusting:

  • The hedge wallet's key, which is online. Deposits and recalls run automatically, so the key sits on the keeper's machine. The keeper's code refuses any withdrawal that does not pay the vault and any transaction other than the four it needs. A thief with the key is not bound by that code: a withdrawal's recipient is a field the key signs, and nothing on edgeX is known to force it back to the vault. Such a thief could reach everything on the trackers' edgeX accounts, and — until the owner pulls the kill switch — each bonded vault's fundable USDC too.
  • edgeX's custody. Money on edgeX is held by edgeX. Its bridge on Arc is controlled by a 3-of-5 multisig that can pause it, upgrade it and move its funds. edgeX V2 has no escape hatch: there is no contract through which an account holder can force a withdrawal if the venue stops processing them. Dollars already on edgeX come back only through edgeX and the hedge wallet's key.
  • The order-only key. It cannot move money out of an account, but it can trade — badly, if compromised.
  • The keeper's NAV. Signed, not proven. What the chain does prove is every dollar that left each vault for the venue (HedgeFunded) and every dollar that came back.

Some edgeX details that shape this are still being confirmed with edgeX before any money moves: how many accounts one wallet may hold, which keys may sign withdrawals, whether withdrawal addresses can be allowlisted, and the exact permissions of the order-only key.

The switches the vault owner holds, which need nothing from the keeper:

  • setHedgeFunder(address(0)) — the kill switch. From that block, no dollar can leave the vault for the venue, whoever asks.
  • setPaused(true) — stops fundHedge, minting and redeeming together.

Neither reaches money already on edgeX, and neither closes a position: open positions stay open under the venue's rules until the keeper — or a new hedge wallet, after the balance has been withdrawn to the vault — manages them.

What the protocol owner can do

On the factory: list or delist the markets the launch form offers (setUnderlying), route a tracker to a market and hedge wallet (setVenueRouting), set the defaults new trackers are created with, authorise launchers, and change the NAV signer and fee recipient for new trackers. On each tracker's vault: change or cut off its hedge wallet, pause it, replace its NAV oracle, change its target leverage and rebalancing band, its NAV floor for minting, its redemption floor, and its fees within hard caps (5% per mint or redeem, 5% a year management — all zero at creation), withdraw the protocol's accrued fees, and pull the vault's own reference-pool liquidity back into the vault (never anywhere else). On each NAV oracle: change the signer, the staleness window and the floor, or pause it.

Every one of these is an on-chain transaction anyone can see. None of them touches a coin that already exists: its pool, its lock, its split and its creator are fixed at launch and no owner action reaches them. The owner is a single key today, not a multisig.

Dependencies outside our contracts

  • Arc. The chain itself, run by Circle's validator set, with deterministic finality. Gas is paid in USDC.
  • USDC. Circle's dollar, and Arc's gas token. It has a blocklist: an address on it can neither send nor receive USDC, so it cannot buy, sell, redeem or claim in USDC here. If a vault, the hedge wallet or the treasury were ever blocklisted, every USDC transfer involving it would revert.
  • Uniswap on Arc. The canonical V3 factory, position manager and router. Coins and reference pools live there.
  • edgeX, as above, and its bridge on Arc.

Verify rather than trust

Every claim about our contracts is a public call or a source-code read. The addresses will be in Architecture, with verified sources on Arc's explorer; nothing is deployed on Arc yet, so any address presented as ours today is unverified. If a statement on this page and the chain disagree, the chain is right and we want to hear about it.

Audit status

The contracts have not been audited by a third party. They are tested — including against the real Uniswap contracts and USDC on a fork of Arc mainnet, with edgeX's bridge in the loop for deposits — and will be deployed unproxied, so the bytecode is what runs. No order has been sent to edgeX by this system yet: the first live tests on the venue are small-size tests on edgeX mainnet, since edgeX has no public test environment.