# Risks and mitigations This page describes the structural risks of holding Yield Coins or Leverage Coins in a Covenant Market and the mitigations built into the protocol. A shorter, user-facing risk disclosure lives at [Risks](/resources/risks.md). ## Oracle risk A Covenant Market depends on a price oracle to mark the Base Asset to market. The oracle defines the value of the collateral pool and the LTV of the market, and through the Latent Swap AMM it sets tranche prices and the implied funding rate. * **Failure mode:** if the oracle reports a stale or incorrect price, LTV is mis-set, the AMM mis-prices both tranches, and entry/exit at the mis-priced rate transfers value between participants. * **Mitigation:** the oracle is fixed at market deployment and cannot be changed for the life of the market. Each market is parameterized with a known oracle source whose properties (push or pull, on-chain or off-chain, fallback behavior) are visible to participants before they deposit. Markets with weaker oracles can be priced by the market itself: the Yield Coin's discount to NAV widens to reflect perceived oracle risk, which is the priced market's structural way of expressing disagreement with reported NAV. ## Junior buffer thinning The Yield Coin's safety margin is the depth of the Leverage Coin claim ahead of it. As LTV rises, the junior buffer shrinks and the senior takes on more residual exposure. * **Failure mode:** if leverage demand persistently exceeds senior supply and LTV rises toward `1`, the Leverage Coin claim approaches zero and the Yield Coin holder begins to absorb price risk on the Base Asset directly. * **Mitigation:** the Latent Swap AMM reprices leverage continuously as LTV rises. The implied funding rate climbs, leverage gets progressively more expensive, and senior capital is drawn in by the higher rate. At sufficiently high LTV the protocol halts both junior withdrawals and additional senior minting, which prevents a death-spiral and gives the system room to rebalance through new deposits. ## Funding drag on Leverage Coin holders A Leverage Coin holder pays funding continuously to Yield Coin holders through dilution of the junior claim against the collateral pool. * **Failure mode:** if the Base Asset's price stays flat and its native yield (if any) is below the implied funding rate, the Leverage Coin's notional claim erodes over time. A holder who entered expecting price appreciation can realize a negative return even if the price did not move. * **Mitigation:** funding is set by the market, not by governance. In cheap-funding environments the implied rate is low and carry is positive; in tight-funding environments the rate is high but the Leverage Coin's price is correspondingly lower at entry, so a holder can size the position against an explicit view on funding. The funding cost is visible in the Yield Coin's market price at entry. ## Liquidity and slippage on exit Single-tranche redemption (Yield Coin to Base Asset, or Leverage Coin to Base Asset) clears against the Latent Swap AMM curve. The AMM concentrates liquidity within a defined price band, but very large trades or trades at extreme LTV experience slippage. * **Failure mode:** a holder exiting a large position into a thin market realizes a worse price than the marginal market price. * **Mitigation:** holders of both tranches can pair-redeem matched notional against fresh Base Asset collateral with no AMM slippage. This is the cleanest exit path for users who want to unwind cleanly. Single-tranche exit is intended for holders who want to express directional rebalancing within a market. ## Smart contract risk Covenant is a deployed smart-contract system. Bugs, undiscovered vulnerabilities, or mis-specified parameters at deployment can result in loss of funds. * **Mitigation:** the Covenant Protocol has undergone multiple independent audits (see [Audits](/resources/audits.md)). The codebase is fully open-source and onchain. Once a market is deployed, its contracts are immutable: parameters cannot be edited, the oracle cannot be swapped, and there is no upgrade path. Admin authority is limited to a Pause function controlled by external Governance. ## Tradeoff of immutability The flip side of immutability is that bugs and parameter errors discovered after deployment cannot be patched in place. * **Mitigation:** the Pause function gives Governance the ability to halt deposits and withdrawals on a market in extremis. Funds remain redeemable through the existing collateral pool. New markets with corrected parameters can be deployed permissionlessly without disturbing existing positions. ## Systemic risk in the sUSDz Yield Fund Holders of `$sUSDz` (the Covenant sUSDz Yield Fund receipt token) are diversified across multiple Covenant Markets, but they are correlated through any common shocks across the underlying Base Assets. * **Failure mode:** a shock that simultaneously impairs multiple Yield Coins in the fund (e.g., a correlated oracle event, a broad RWA stress) can compress the fund's NAV faster than any single market would. * **Mitigation:** the fund's market selection and concentration limits are visible. Holders who prefer concentrated exposure to a specific Base Asset can hold that market's Yield Coin directly instead of `$sUSDz`. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.covenant.finance/protocol-mechanism/risks-and-mitigations.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.