Risks

This page explains the mechanisms. The Risk Disclosure states the same ground in plain language, and neither page restates the other.

For the validator

A validator’s income varies, with the size of the total network stake, with occasional sync committee and block rewards, and with time offline. A bond’s interest is fixed at purchase. When realised income over a bond’s term is less than the interest owed, the difference comes out of the validator’s stake. A higher rate attracts holders faster and costs more stake when income falls short, the two move together. And when a matured bond is not paid, the default machinery in Default takes over, which in practice ends the validator.

For the holder

The protocol enforces no minimum backing beyond what is observable at purchase. The contracts do not read the consensus layer, the starting balance was the validator’s own report, and the issue size does not follow the beacon balance afterwards. Rewards and penalties change the backing without changing the issue size. The buffer is the validator’s own estimate. The paper’s sizing rule is the holder’s test, “Choosing the buffer R therefore depends on the bond’s duration, since the holder expects enough reserve on the consensus layer to keep a bond backed even if the validator goes offline for a long period.”

Offline penalties

While the chain keeps finalising, a validator that misses its attestation or sync committee duties loses a little of its consensus balance for every missed duty, gradually, for as long as it is offline. Being offline is never in a validator’s interest, but it happens, and a long bond gives it more room to happen in. That is what the buffer is for, and penalties inside the buffer leave every bond fully backed.

Slashing

A slashed validator loses an initial penalty plus a further amount that grows with how much stake is slashed together with it in the same window. A validator that is one of several run by one entity, or one of several Coffers under common control, carries that correlated exposure, one cause can slash them all together. The buffer is chosen by the validator and not enforced by the protocol, and a validator near the top of its issue size has no incentive to raise it. Whether it is conservative enough for the concentration and the duration is the holder’s judgement, made before buying.

The two events no buffer bounds

An inactivity leak, where the chain stops finalising because a large share of the network is offline, grows penalties with time and can reach the entire balance. A network wide correlated slashing event, where a large share of all stake is slashed at once, approaches the entire balance too. Both require a failure at the scale of the whole network, and no buffer of any size removes them. A long bond carries residual exposure to both, and the third box in Before you buy has the buyer accept it together with the ordinary case, penalties beyond the buffer.

The declaration race

Near a bond’s maturity, a redemption and a validator top up race each other, and either can land first. If the balance is short when the redemption lands, the same transaction declares the default, even if the top up arrives one block later, and a declared default stands until every bond is paid in full. The mechanics are in Redeem at maturity and Default. For the validator the lesson is sizing the minimum duration against their own monitoring habit, for the holder it is that being early matters once a default is near.

On the marketplace

Trading adds risks of its own, and How trading works explains the mechanism behind each.

• A listing signed ahead of the current nonce arms itself later, so a cancel can sell at a price signed long ago.
• A signed listing or offer stays fillable until it expires or is cancelled on chain, re-signing off chain revokes nothing, and an improved replacement in the app leaves the earlier signature fillable too, at the terms its maker signed.
• A bond’s maturity value can change after a listing or offer is signed, through redemptions or a default claim, and a fill against the old value reverts.
• A contract wallet’s code runs inside a fill with the taker’s gas, and an offer can be written so every fill attempt burns that gas and fails. No funds move, the exposure is the gas.
• Equal maturity values do not mean equal assets, a defaulted coffer pays first come first served from whatever it holds.

Technology and the interface

The contracts are immutable, which protects everyone from changes and also means a defect stays a defect. A bond’s behaviour rests on the correctness of the contracts and of the consensus layer mechanisms they rely on, and a change to those mechanisms in a future network upgrade is outside anyone’s control here. The app can show stale data or be unavailable, the contracts keep working without it, and the figures the app presents, rates, estimates and countdowns, are computed off chain to help evaluation, they are not promises.