Risks and limitations

Token behavior matters

Admission is permissionless: token addresses must be distinct, nonzero contracts. That check does not prove that a token is honest or safe.

Taxed, rebasing, frozen, confiscatable, or dishonest tokens can prevent fulfillment. Exact balance checks do not eliminate those risks. A collateral shortfall makes exercise fail; cancellation or reclaim can return less than the original deposit.

There is no protocol insurance or administrator ability to repair token balances. Native ETH is not a settlement asset for the v1 primitive.

Separate escrows share code

Each option uses a separate escrow, which limits cross-option accounting exposure. Shared-code vulnerabilities can still affect every instance. Isolation is not an audit or a guarantee of safety.

Unsolicited token deposits create no option rights and do not change the exchange terms. Residual ERC-20 recovery after closure belongs to the issuer. Forced native ETH is outside that recovery interface.

Management affects future issuance

A registry administrator selects the collection version for new options. Existing collection rules are immutable, and retired versions continue servicing their existing options.

An administrator can select unsafe code for future issuance. Review the exact version and approvals; registration does not prove a security audit.

The primitive has a limited scope

The accepted v1 primitive does not itself specify sales, premium pricing, marketplaces, pools, oracles, fees, or cross-chain transfers. These guides do not establish liquidity, legal eligibility, deployment, audit, or production readiness.

Read the canonical specification for the complete trust assumptions and the terms guide for the fields to verify.