Risk

Contract and governance risk#

• Not audited. The contracts have not been audited. Settlement math has been replayed against reference data and accounting invariants are covered by tests; this is not a substitute for an audit.
• Upgradeable. After the 24-hour timelock delay, the 2-of-3 multisig can upgrade contracts, including in ways that could move all deposited USDT. Pending timelock actions are announced in the app.
• Adjustable reserve line. The timelock can change the LP reserve line, initially 5,000,000 USDT, with 24 hours' notice. Raising it pauses LP-surplus dividends. Lowering it releases LP cash only to SPAPER stakers through the dividend path. A line below 5,000,000 USDT only takes effect after the timelock separately enables wind-down (also 24 hours' notice) and all of the following hold: wind-down enabled, trading paused, no open positions and an empty payout queue. The contract checks all four conditions; an emergency pause alone never triggers it. If the line is set to 0, a timelock upgrade or a repointed staking address could reach all LP cash rather than only the part above the line. Both actions still require 24 hours' notice.

Operational risk#

• Single price signer. Settlement relies on one signer reporting the Binance USDⓈ-M index honestly. Every signed price is published for reconciliation, but a price cannot be verified by users before it settles.
• Operator trust. The relayer and the price signer are run by the same operator. The relayer decides batch timing and ordering within public rules and can delay intents.
• Price gaps. If signed prices stop, nothing settles. Positions are then settled or liquidated at the first fresh price, which may be far from the price at which they would otherwise have settled.

Trading risk#

• Full-margin liquidation. A liquidation forfeits the entire margin. At high leverage the liquidation price is very close to entry.
• No price protection on market trades. A market trade settles at the signed price of the settling block.
• LP starts at 0. The LP grows only from trader losses. Early winners are likely to be queued and may wait a long time for payment.
• SPAPER supply. Early supply share is inexpensive and can be acquired by deliberately losing.

Example: liquidation distance at 1000×#

Alice opens a 1000× BTC long with 100 USDT margin while the index is 80,000.

base        = 80,000 − 80,000 ÷ 1000        = 79,920
liquidation = 79,920 × (1 + 0.000476041…)   ≈ 79,958.05
distance    = (80,000 − 79,958.05) ÷ 80,000 ≈ 0.0524%

A decline of about 42 USDT in the BTC index, or 0.0524%, forfeits Alice's full 100 USDT margin.

Jurisdiction#

shadowpaper is not available to persons in the United States, China, Japan or any sanctioned jurisdiction.