Risk disclosure

A zero-knowledge proving system is generated from secret parameters that have to be destroyed, and destroying them takes a ceremony. That ceremony ran on 23 September 2026 against the circuits this deployment uses: one contributor, then a public beacon taken from Robinhood mainnet block 70634115. Both keys verify against their constraint system and their powers of tau, the development keys anyone could have forged against are gone, and the deploy refuses a mainnet release that is not built on contributed keys.

One contributor is a real ceremony and far better than none, and it is not the same as many. Soundness now rests on a single machine having produced good entropy and destroyed what it held. If it did not, whoever holds those parameters can create a proof for a Draft that was never funded and take everything the clearing house holds, and nothing else in the system would stop them.

More contributors are needed before that risk is properly retired. This deployment runs on a test network.

The contracts and circuits have been through three rounds of review: two passes over the whole system, then a four-lens review of value accounting, admin powers and the credit integration, the circuit-to-contract boundary, and griefing and economics. The fixes were put through nineteen adversarial reviews, which reopened two closures and found three regressions. Those are fixed. The contracts carry 87 tests of their own, and the protocol is exercised end to end against a real chain with real proofs.

All of that was done by the people who built it, using tools they run. No outside firm and no reviewer from outside this project has read the contracts or the circuits. There has been no independent audit, no formal verification and no bug bounty, and a thorough self-review is not a substitute for any of them.

This matters more here than it would elsewhere. A defect in a zero-knowledge circuit does not look like an ordinary bug. It can let money be created from nothing, silently, with no transaction appearing unusual and no balance visibly wrong until the money is gone.

The contracts have no upgrade mechanism. A defect found after deployment can only be addressed by deploying a new set and asking everyone to move, and money in the old one may not be movable.

The verifiers are fixed at deployment. Changing a circuit means new verifiers, which means a new clearing house and a migration.

A Draft that has cleared cannot be recalled, reversed, cancelled or refunded by anyone. There is no chargeback and no dispute process.

A Draft written to the wrong payment details pays whoever those details belong to. Check them before you commit.

Your Account is derived from a secret held only on your device. There is no recovery, no reset and no administrator with a copy. Lose it and the balance is permanently unreachable by everyone, including you.

Anyone who obtains it owns the balance. A compromised device, a malicious browser extension or a screenshot of the secret is enough.

The system depends on the chain and its sequencer, the USDG token and whoever may freeze or seize it, the lending market credit is drawn from, the price feeds that market trusts, the RPC provider the interface reads through, and whatever infrastructure serves the page.

A halt, failure, censorship decision, misprice or compromise in any of them can cost you money, and none of it is within this project’s control to fix.

A chain reorganisation can undo transactions that appeared final. The index this interface can use does not handle one, and may need to be rebuilt after it.

Where the clearing house puts idle money to work in a lending market, its ability to pay you out depends on that market having cash. A market that is fully drawn, paused or at its cap can stall deposits and cash-outs.

If that market becomes unable to cover what it owes, the clearing house values its claim at what the market can actually pay, so the shortfall is shared rather than falling on whoever leaves last.

Credit drawn into an Account is a real debt on a public lending market, subject to that market’s interest rate and its liquidation rules. Collateral can be liquidated while the money drawn against it is already private and spent.

A Draft records no payer, payee or amount. Deposits are public with their amount and paying address, cash-outs are public in fixed denominations, and credit draws are ordinary public borrows.

Nothing here conceals your network connection. Whoever runs the clearing service you use sees the address and timing of every request your device makes, which is the sharpest link anyone can draw between you and your activity.

Patterns can identify you even when individual amounts are hidden. An amount only you ever move, or a timing habit, can be enough.

Test tokens have no value and cannot be exchanged for anything. The people who run a test network reset it at will, which destroys every balance on it.

The treatment of this kind of software varies by country and is changing. Using it may be restricted or unlawful where you are, and that can change after you have started.

Transactions may create a tax liability and a reporting obligation. Nobody reports on your behalf and nobody can.

If you are not willing to lose everything you put in, do not put it in. Nobody is able to make you whole, and nobody has promised to try.