> For the complete documentation index, see [llms.txt](https://docs.covenant.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.covenant.finance/protocol-mechanism/risks-and-mitigations.md). # Risks and mitigations This page describes the structural risks of holding Yield Coins or Leverage Coins in a Covenant Market and the mitigations built into the protocol. A shorter, user-facing risk disclosure lives at [Risks](/resources/risks.md). ## Oracle risk A Covenant Market depends on a price oracle to mark the Base Asset to market. The oracle defines the value of the collateral pool and the LTV of the market, and through the Latent Swap AMM it sets tranche prices and the implied funding rate. * **Failure mode:** if the oracle reports a stale or incorrect price, LTV is mis-set, the AMM mis-prices both tranches, and entry/exit at the mis-priced rate transfers value between participants. * **Mitigation:** the oracle is fixed at market deployment and cannot be changed for the life of the market. Each market is parameterized with a known oracle source whose properties (push or pull, on-chain or off-chain, fallback behavior) are visible to participants before they deposit. Markets with weaker oracles can be priced by the market itself: the Yield Coin's discount to NAV widens to reflect perceived oracle risk, which is the priced market's structural way of expressing disagreement with reported NAV. ## Junior buffer thinning The Yield Coin's safety margin is the depth of the Leverage Coin claim ahead of it. As LTV rises, the junior buffer shrinks and the senior takes on more residual exposure. * **Failure mode:** if leverage demand persistently exceeds senior supply and LTV rises toward `1`, the Leverage Coin claim approaches zero and the Yield Coin holder begins to absorb price risk on the Base Asset directly. * **Mitigation:** the Latent Swap AMM reprices leverage continuously as LTV rises. The implied funding rate climbs, leverage gets progressively more expensive, and senior capital is drawn in by the higher rate. At named LTV gates the protocol additionally throttles flow: the **High LTV gate** blocks Leverage Coin burns and Yield Coin mints (the two swaps that would push LTV further up), and the **Max LTV gate** blocks Leverage Coin mints as well, leaving only Yield Coin exits open. These gates prevent a death-spiral and give the system room to rebalance through new deposits before the senior buffer is exhausted. No individual position is force-closed. ## Workout rate at 100% LTV If the Base Asset's NAV falls below the Yield Coin notional, the market reaches 100% LTV and the collateral pool no longer covers the senior claim in full. The protocol activates a **workout rate**: a daily negative return paid by Yield Coin holders to Leverage Coin holders. * **Failure mode:** beyond 100% LTV, every additional unit of Base Asset NAV loss is borne directly by the Yield Coin. Without an incentive to exit, senior holders might otherwise wait, deepening the impairment for the holders that remain. * **Mitigation:** the workout rate is designed to incentivize an orderly senior exit. The negative carry pushes Yield Coin holders to redeem to the collateral pool at the current NAV, which lets the market resolve a permanent impairment rather than letting the position hang. The workout rate is a market parameter fixed at deployment (typically `-1% daily`). ## Funding drag on Leverage Coin holders A Leverage Coin holder pays funding continuously to Yield Coin holders through dilution of the junior claim against the collateral pool. * **Failure mode:** if the Base Asset's price stays flat and its native yield (if any) is below the implied funding rate, the Leverage Coin's notional claim erodes over time. A holder who entered expecting price appreciation can realize a negative return even if the price did not move. * **Mitigation:** funding is set by the market, not by governance. In cheap-funding environments the implied rate is low and carry is positive; in tight-funding environments the rate is high but the Leverage Coin's price is correspondingly lower at entry, so a holder can size the position against an explicit view on funding. The funding cost is visible in the Yield Coin's market price at entry. ## Liquidity and slippage on exit Single-tranche redemption (Yield Coin to Base Asset, or Leverage Coin to Base Asset) clears against the Latent Swap AMM curve. The AMM concentrates liquidity within a defined price band, but very large trades or trades at extreme LTV experience slippage. * **Failure mode:** a holder exiting a large position into a thin market realizes a worse price than the marginal market price. * **Mitigation:** holders of both tranches can pair-redeem matched notional against fresh Base Asset collateral with no AMM slippage. This is the cleanest exit path for users who want to unwind cleanly. Single-tranche exit is intended for holders who want to express directional rebalancing within a market. ## Smart contract risk Covenant is a deployed smart-contract system. Bugs, undiscovered vulnerabilities, or mis-specified parameters at deployment can result in loss of funds. * **Mitigation:** the Covenant Protocol has undergone multiple independent audits (see [Audits](/resources/audits.md)). The codebase is fully open-source and onchain. Once a market is deployed, its contracts are immutable: parameters cannot be edited, the oracle cannot be swapped, and there is no upgrade path. Admin authority is limited to a Pause function controlled by external Governance. ## Tradeoff of immutability The flip side of immutability is that bugs and parameter errors discovered after deployment cannot be patched in place. * **Mitigation:** the Pause function gives Governance the ability to halt deposits and withdrawals on a market in extremis. Funds remain redeemable through the existing collateral pool. New markets with corrected parameters can be deployed permissionlessly without disturbing existing positions. ## Systemic risk in the sUSDz Yield Fund Holders of `$sUSDz` (the Covenant sUSDz Yield Fund receipt token) are diversified across multiple Covenant Markets, but they are correlated through any common shocks across the underlying Base Assets. * **Failure mode:** a shock that simultaneously impairs multiple Yield Coins in the fund (e.g., a correlated oracle event, a broad RWA stress) can compress the fund's NAV faster than any single market would. * **Mitigation:** the fund's market selection and concentration limits are visible. Holders who prefer concentrated exposure to a specific Base Asset can hold that market's Yield Coin directly instead of `$sUSDz`. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.covenant.finance/protocol-mechanism/risks-and-mitigations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.