Trust & What Could Go Wrong
We just walked the guardrails one by one - the caps, the marks, the pauses, the halts. This chapter steps back and asks the blunt question an outsider should always ask: who exactly am I trusting here, and where could this actually go wrong? No system is risk-free. The honest answer is that Own trusts a small, named set of actors within hard bounds, accepts a few trade-offs deliberately, and carries a handful of real risks it was built around mitigating. Let's take them in that order.
Who you're trusting, and how much
The protocol's design goal is blunt: no single actor can move value to itself, and the exit guarantee holds even if the market maker defaults. Here is the full cast, from most trusted to least:
| Actor | Trust level | What they can do - and the bound on it |
|---|---|---|
| Protocol admin | Trusted, delay-governed | Registers contracts, assets, oracles; sets the caps and dials. Changes go through the registry's transfer delay, moving to full timelock + multisig governance as the protocol matures. |
| Operator | Trusted, instant - but narrow | Emergency-only powers: pause trading, halt an asset, freeze a PSM wrapper, remove a bad signer. Cannot move funds. Speed where it protects, never where it pays. |
| Wrapper issuers | Semi-trusted | Their tokens form the reserve. A depeg marks the reserve down and the LP layer absorbs the residual; per-wrapper pauses and cross-issuer diversification keep any one failure small. |
| Vault Managers / makers | Semi-trusted | Quote flow, backfill reserves, run the lending books - and earn for it. LP collateral backstops their default; the maker-free PSM lane runs regardless. |
| Oracle & quote signers | Semi-trusted | Sign prices and quotes offchain. Fenced by deviation bands, staleness limits, single-use quotes, and the settle band. |
| The Keeper | Untrusted | Permissionless plumbing. Can't set a price or touch a balance. |
| LPs | Untrusted | Supply the insurance capital, earn the yield, carry first-loss risk - knowingly. |
| Traders | Adversarial | The contracts assume every minter and redeemer may be hostile, and check accordingly. |
Trade-offs the design accepts on purpose
Four choices an auditor - or a careful LP - should see stated rather than discover:
- The reserve holds custodial tokens. Yes: the very thing Chapter 1 criticized. The difference is that here it's one priced ingredient, not the guarantee - a failed issuer costs the system a marked-down reserve, not a broken token, and the roadmap spreads each asset's reserve across multiple issuers so none is ever load-bearing.
- LP losses are shared. A shortfall on any asset's residual is covered by the global collateral pool - all vaults' LPs share it. That's what makes the backing behind every eToken as big as the whole pool; the price is mutualized LP risk, compensated by yield.
- The in-house oracle starts with a single protocol-run signer. Bounded by the deviation and staleness fences, cross-checked by Pyth, and headed to an M-of-N signer set - but today, a trust point, named as one.
- Stablecoins are counted at a dollar. The lending math treats USDC at par; a depeg is invisible to debt valuation until marked. The collateral side, by contrast, is always marked.
And four structural facts to price in, which no amount of engineering removes:
- The worst-case exit is slow. A fully reserved asset exits instantly in-kind; but if the reserve is short and no maker quotes, the guarantee pays only after the claim window. Own promises exit at oracle value - not instant cash in every state.
- Capacity is collateral-bounded. Unreserved issuance can't exceed 65% of
the pool, period. When demand hits the cap, growth waits for more collateral
- deliberately.
- The flywheel runs in reverse too. In a cold funding regime the premium compresses, some collateral leaves, and residual capacity shrinks with it. The kink slows the unwind; the reserved slice of the backing doesn't care.
- Price exposure, not ownership. An eToken confers Tesla's price and dividends - not a shareholder's vote, and not access in restricted jurisdictions. The protocol layer stays permissionless; restrictions apply at the distribution layer, by apps and by makers choosing whom they quote.
The five real risks
Risk 1 - The price is wrong. Everything hangs off the oracle. So a price must clear five independent gates before it moves money: a registered signer's signature, freshness, forward-only timestamps, the deviation band, and - for every trade - the settle band around the mark. A failure has to beat all five at once, and the dual-oracle setup means Pyth stands beside the in-house feed.
Risk 2 - A backing layer fails. A wrapper depegs; crypto collateral crashes. The two layers fail differently and catch each other: a marked-down reserve reloads its residual onto the crypto pool automatically, and the crypto pool itself is held to the 65% rule with concentration caps per collateral type. The golden rule - never loosen the cap for growth - is what keeps this defense from eroding in good times.
Risk 3 - The maker or a Vault Manager misbehaves. Contained by construction: the standing backing sits in protocol-owned reserves, not on the firm's balance sheet; its signing damage is fenced by the settle band and single-use quotes; a default forfeits its spread business; and the holder's waterfall ends in force-execution against LP collateral - which is also the recourse if a manager's lending book sours.
Risk 4 - Borrowers over-leverage. The loop is the protocol's demand engine, and it's kept on a leash: 70% loan-to-value at open, liquidation past 80%, a small bonus for the liquidator, and the vault-wide lending book capped at 35% of collateral. Liquidations are self-healing - they shrink protocol exposure and vault debt in the same stroke - and any residual bad debt is settled the moment it's recognized, in the open.
Risk 5 - The contracts have a bug. The risk you can never fully eliminate. Own's posture: the contracts are open source, running live on Robinhood Chain, and have been through two independent audit rounds - core first, then the PSM/reserve and lending extensions - with findings fixed and regression-tested, and an invariant test suite hammering the books. Rounding always favors the protocol, and the pause/halt levers exist for the day something looks wrong anyway. Smart-contract risk remains, as it does everywhere onchain; size your exposure like it.
The one-line security posture
Everything in this chapter compresses to a single sentence worth keeping: any single layer of the backing - a wrapper issuer, a market maker, a collateral type - can fail, and the holder is made whole by the rest of the portfolio, enforced permissionlessly by the netting and the 65% rule. That is the difference between trusting a custodian and holding a claim on a diversified, code-governed balance sheet.
What just happened
- Trust is small and named: a delay-governed admin, a narrow instant-only operator, semi-trusted issuers/makers/signers inside hard fences, and a permissionless everything-else. No actor can pay itself.
- Four deliberate trade-offs: custodial ingredients in the reserve, mutualized LP losses, a single oracle signer at launch, stablecoins at par.
- Four structural limits: worst-case exits wait out the claim window, capacity is collateral-bounded, the flywheel can spin down, and you hold price - not shares.
- Five real risks - bad price, failed backing layer, misbehaving maker, over-leveraged borrowers, contract bugs - each met with layered, specific defenses rather than denial.
- The posture in one line: any single layer can fail; the portfolio, enforced by code, makes the holder whole.
Disclaimer. This book describes Own's design and uses illustrative figures reflecting market conditions around July 2026; actual results vary. Nothing here is an offer, investment advice, or a guarantee of returns. Synthetic stock exposure carries market, smart-contract, and counterparty risk. Own is not available to US persons or other restricted jurisdictions.