Risk Disclosure

Last updated 2026-09-10

1. Read this first

Coffer is software that runs on the Ethereum network. Using it means sending your ETH to smart contracts that nobody can change or reverse. This page describes the main ways you can lose money. By using the contracts you accept the risks set out on this page. It is written in plain words on purpose. The Terms of Use apply as well.

These are the main risks, not every risk. New ones can appear as the technology and the network change. The points below summarise what follows. They do not replace it.

You are in control, and responsible. We do not hold your ETH, your keys or your bonds. We cannot reverse a transaction or recover a mistake.
A bond is only as good as the validator behind it. The contract checks the bond against the issue size the validator declared. It never checks the validator’s real balance on the consensus layer. Everything about the validator is yours to check before you buy.
A default is not shared out equally. Whoever claims first is paid in full while the money lasts. Whoever claims last may get nothing.
What you sign is what happens. Read the transaction in your wallet before you confirm it.

2. The words we use

We say bond, interest, maturity, redeem, default and yield because those words describe what the contracts do. They do not mean that a Coffer bond is a bond, a deposit, a loan, a security or any other regulated product under the law of any country. A Coffer bond is not covered by any deposit guarantee or investor compensation scheme. If a validator cannot pay, there is no fund behind them and no authority to appeal to. How the law treats it is a separate question, it can differ from country to country, and you are responsible for your own position.

3. The contracts cannot be changed

The Coffer contracts are immutable. Nobody, including us, can upgrade them or take your ETH or your bonds out of them. A validator can stop their own Coffer selling new bonds, which never affects a bond already bought. That protects you from us, and it also means that a bug stays a bug.

There is no governance, no oracle, and no key of ours over a Coffer. The one thing we control is the address that receives the protocol fee, and changing it changes no bond. The validator owns their Coffer and can change the terms it offers for new bonds, never the terms of a bond already sold. Nothing about a bond depends on a vote, an administrator or an outside price feed.

4. Risks for everyone

Smart contracts can contain bugs. A flaw in the code can lead to a loss of funds, and because the contracts cannot be changed, nobody can fix it after the fact. The contracts have been reviewed by us and by automated tools. They have not been audited by an independent firm.
Fake sites and impersonation. Others may copy the site, the app or our name to get you to sign something harmful or to hand over your keys. Check the address in your browser before you connect a wallet. We will never ask for your seed phrase or your private keys.
A page can show one thing while your wallet is asked to approve another. Because nobody takes custody of your funds, the way to attack you is to get you to sign something you did not intend. Read the transaction in your wallet, not on the page, before you confirm it.
Mistakes are permanent. Choosing the wrong amount, the wrong duration or the wrong bond cannot be undone once the transaction confirms. The bond is transferable, so you can sell it, but only at a price someone else is willing to pay.
Your wallet is run by someone else. It has its own terms, it can have its own bugs, and we are not responsible for how it behaves.
The network can fail you. Ethereum can be congested, transactions can be delayed or dropped, in rare cases a block that looked settled can be reorganised so a confirmed transaction is undone, and network upgrades can change the mechanisms the contracts rely on.
Anything someone else builds on the contracts is theirs, not ours. We do not endorse or monitor other interfaces or marketplaces.

5. Risks for holders

A validator can be slashed or penalised by the network. The bond is backed by that validator’s stake, and a smaller stake means less backing.
The buffer is set by the validator, not by the protocol. Each validator chooses how much of their stake to keep in reserve above what they have promised. The contracts do not check that the choice is sensible. You do, before you buy.
A Coffer can name a validator it does not control. Anyone can create a Coffer against any validator’s public key, and the contracts do not check who holds that key. Such a Coffer can still sell bonds, and nothing stands behind them. Before you buy, check on the consensus layer that the validator’s withdrawal credentials point at the Coffer’s address.
A validator can fail to pay at maturity. Anyone can then declare a default. Every bond becomes redeemable at its full maturity value, and anyone can ask the network to exit the validator so the remaining stake is swept into the contract to pay holders.
Claims in a default are paid first come, first served. They are not shared out equally. Whoever claims first is paid in full while the money lasts. If the recovered stake does not cover every bond, whoever claims last is paid in part, or not at all.
Anyone can declare a default, so timing is not in your hands. A redemption you have already sent can arrive after someone else’s declaration and lose its place in that queue.
Getting paid after a default depends on the network processing an exit, which takes time and can be delayed, and penalties keep accruing until the validator leaves. It also depends on the validator’s withdrawal credentials pointing at the Coffer. If they point elsewhere, the exit request is accepted and paid for, the network ignores it, and nothing is swept in for holders.
Some network-wide events are beyond any buffer. If Ethereum stops finalising, penalties grow faster and faster for as long as it lasts, and no buffer a validator keeps can track that. The same is true of slashing on a large scale. In those conditions holders can lose most or all of what they are owed.
A bond bought from another user may be worth less than its face value suggests. A bond that has already been partly paid out in a default carries only what remains. Check the live value before you buy.
A bond may be hard to sell. The marketplace only works when someone wants to buy, and the price is whatever the buyer offers.
Sending a bond NFT to a wrong address loses it. Nobody can return it.

6. Risks for validators

Selling bonds adds an obligation to pay at maturity out of your stake. Penalties, slashing or a long exit queue can leave you unable to pay in full, and the default rules then apply to your stake.
A default can end your validator. While a default stands, anyone can ask the network to exit you, repeatedly, for as long as any bond is outstanding. The exit sweeps your entire remaining stake, including the minimum balance, into the contract to pay holders. Exiting is in every holder’s interest, so a request usually lands before you can settle. An exited validator can never rejoin. Treat a default as the end of that validator and that coffer contract.
A default also freezes you. While it stands you cannot sell bonds and you cannot take anything out. The only way out is to pay every bond in full.
The shortest bond you sell is the shortest warning you get. A new bond is a new obligation with no funds behind it in the contract, and the minimum duration you set is your guaranteed time to fund it. Set it above how quickly you can actually move funds.
Your withdrawal credentials must point at your coffer contract. If they point elsewhere, every request the coffer contract sends to the consensus layer is accepted and paid for and then ignored, so withdrawals, the exit and the switch to compounding never happen. Credentials cannot be changed afterwards.
The interest rate is fixed when a bond is sold and cannot be renegotiated.

7. Risks in the app and the services around it

The app can have bugs, can show stale data or can be unavailable. The contracts keep working without it, and they can be used directly.
The RPC providers and the hosting we rely on are run by others and can fail.
A listing or an offer you sign stays valid until it expires or you cancel it on-chain. Signing a new one does not cancel the old one.
If you sell through the marketplace and your wallet cannot receive plain ETH, the sale still completes and you are paid in wrapped ETH instead.

8. What the contracts fix, and what they do not

The rate is fixed the moment a bond is bought, and the interest is simple, so the amount is calculable from that moment. The maturity value is written into the contract and does not change. You can read it on-chain and on the NFT itself. At maturity you withdraw exactly that amount. The validator can also settle your bond earlier, in full, into an escrow you claim from at any time. What you receive never changes, only when. The one thing that can reduce it is a default, where a partial payment lowers what remains.

What the contracts do not fix is what happens around them, how a validator performs over the term and what price a bond will fetch if you sell it before maturity.

The figures you see before you buy are a different matter. The calculator on the site projects from the network’s current reward rate, which changes every day, and is not a promise of any return. The buy card in the app computes your payout from the fixed rate and the fee rate at that moment and shows it rounded. Once you buy, the maturity value is exact and written into the contract.

9. Fees

The contracts charge fees. A protocol fee is taken from a bond’s interest when it is bought, never from the principal, so the amount you get back at maturity is never less than what you paid. A marketplace fee is paid by the buyer when a bond is bought or sold through the marketplace, on the difference between the bond’s maturity value and the price, and there is none when the price is at or above the maturity value. Both rates are fixed in the contracts. The documentation sets out the full schedule.

10. Your responsibility

You decide what to do with your funds. Nothing here is advice. You are responsible for the laws and taxes that apply to you, and use of the contracts may be restricted where you live. Only use funds you can afford to lose.