Risk Register

WHAT CAN GO WRONG

How to read this page

Vessel is experimental software on Monad testnet. It has no external audit. Its hedge venue is currently a simulation. This page names every risk the protocol team knows about, including the ones that make Vessel look bad, because a risk section that omits them is worth less than no risk section at all.

Each entry states three things: the mechanism, the mitigation that exists in the design, and the part of the risk the mitigation does not remove. Where a mitigation reduces a risk rather than eliminating it, the entry says so. Where a constraint is a design choice rather than a defect, the entry says that too.

Severities are the protocol team's ranking for the current testnet deployment. They will be re-ranked before mainnet. Ranking is by expected loss to Hull and Ballast holders, not by probability alone.

For the sequence of events inside each failure, see Failure modes. For the conditions under which the protocol halts new activity, see Stop conditions.

The register

HIGHFunding inversion

Vessel earns the perpetual funding rate. Funding is not guaranteed positive. When shorts pay longs for an extended period, the book's gross yield G is negative and the shortfall ordering applies: Ballast NAV absorbs the loss first, then the Reserve, and only then is Hull principal impaired. That last step is a credit event.

The Hull rate is a contract parameter, r_H = clamp(EWMA_30d(net funding APR) × (1 − h), 0, r_cap) with h = 40% and r_cap = 15% APR. The haircut and the 30-day EWMA mean the Hull rate lags and undershoots the realized rate, so Hull accrual is set below what the book has recently paid. That is the whole point of the haircut. It does not protect against a regime where funding stays negative longer than Ballast and the Reserve can absorb.

The Reserve target of 2% of TVL is a target, not a balance. Early in a series the Reserve is below target because it is funded from the protocol-fee split on positive yield. A funding inversion that arrives before the Reserve has filled meets a thinner cushion.

MITIGATION · Reserve target 2% of TVL funded from half the protocol fee; automatic de-risking; Hull haircut h = 40% in the rate formula. These reduce the risk. None of them eliminates it.

HIGHLiquidation and gap risk on the short leg

The short leg is a margined perpetual position. If the spot price rises fast enough, the position is liquidated before a keeper can top up margin. A liquidation converts a paper hedge imbalance into a realized loss and leaves the book net long until the short is re-established.

The design sets the liquidation price at least 40% above mark at leverage λ ≤ 2. Margin top-ups are permissionless keeper actions funded from the idle buffer. A buffer breach de-risks the book; it does not add leverage to defend the position.

A 40% buffer is large for a delta-neutral book. It is not infinite. A gap move that exceeds it, or a period in which no keeper transaction lands (see the keeper entry below), produces a liquidation regardless of the buffer. Rebalancing runs on band breach or a 4-hour timer, so the book can carry more than 1% net delta between rebalances during a fast move.

MITIGATION · Short-leg liquidation price sits at least 40% above mark; margin maintenance draws on the 10% idle USDC buffer; a buffer breach triggers automatic de-risking, never added leverage. Gaps can exceed every one of these.

HIGHVenue risk

The hedge lives on the venue's contracts. Today that venue is SimVenue SIMVENUE — SIMULATED behind the IVenue interface; Perpl is the next venue. Whatever the venue is, Vessel's short leg is a claim on it. If the venue halts, mis-settles, is exploited, or loses its collateral, Vessel's hedge is gone and its margin with it. Vessel has no recourse that is faster or stronger than any other venue user.

Perpl is live on Monad mainnet and testnet per its own documentation. That is a statement about its deployment status, not about its safety. Vessel has not audited Perpl and does not vouch for it.

The Proof of Hedge page lets anyone read the venue position that backs the book. That visibility lets a reader see a venue failure quickly. It does not prevent one.

MITIGATION · Position and margin state are readable on-chain and surfaced through Proof of Hedge. Observability is not immunity: a venue failure is a Vessel failure.

HIGHSimVenue period

While the hedge venue is simulated SIMVENUE — SIMULATED, the funding rate that drives every accrual on this protocol is settable by the SimVenue owner. That means the yield the book reports on testnet is a number an operator chose, not a number a market produced. The waterfall, the Hull rate formula, and the conservation invariant all run correctly on top of it, and none of that changes what the input is.

This is a trust assumption, and it is the largest one on the testnet. Anyone evaluating Vessel's economics on current testnet data is evaluating the mechanism, not the market. The design intends SimVenue as a development fixture. Its replacement by Perpl is the condition for the testnet numbers to mean anything about live funding.

The SimVenue contract source is not published in the public repository as of 2026-08-29; the repository contains only a README and LICENSE. The owner-settable rate is stated by the protocol team, not verified by the docs team against deployed code.

MITIGATION · None beyond disclosure. The testnet explicitly carries this trust assumption until the Perpl integration replaces SimVenue.

MEDIUMBasis risk

Delta neutral means the spot leg and the short leg offset each other in notional. It does not mean their prices move together. The perp mark and the spot price diverge, sometimes for long stretches, and the divergence is a gain or a loss the funding rate does not compensate.

Where the spot leg is a liquid staking token rather than the native asset, a second basis appears: the LST against its underlying. An LST depeg is a loss on the spot leg that the short leg, priced against the underlying, does not offset.

Whether a given Vessel series holds an LST as its spot leg is a per-series parameter. The litepaper does not enumerate the spot assets per series; that is unspecified in the public sources read for this page UNVERIFIED — PENDING GATE-0.

MITIGATION · The delta band of 1% of gross notional and the 4-hour rebalance cadence limit how far the book drifts. Spot-versus-mark divergence and LST depeg are not hedged.

HIGHUnaudited contract risk

No external audit of any Vessel contract exists as of 2026-08-29. The public repository holds a README and a LICENSE; there is no published contract source, no ABI, and no deployed address a third party can verify against source. The conservation invariant ΔNAV_Hull + ΔNAV_Ballast + ΔReserve + fees = G is enforced in code and fuzzed per the litepaper, and that is an internal test, not a review.

A bug in the waterfall, the subordination check, or the venue adapter is an unbounded loss until reviewed. The Security section of these docs states the exact scope of what has and has not been reviewed. The ordering is fixed: audit, then mainnet.

UNAUDITED · TESTNET ONLY — external review gates mainnet. Do not deposit anything you cannot lose.

MITIGATION · External review gates mainnet. Until it completes, no mitigation exists other than not deploying real capital.

MEDIUMLiquidity

Hull is illiquid to maturity by design. A series has a fixed maturity (4 weeks at launch), redeems principal plus the fixed yield at maturity, and offers no early redemption path from the protocol. Early exit is a secondary sale of the transferable token, at whatever price a buyer offers. The fixed maturity is what makes the Hull rate a fixable contract parameter and what makes the series shaped for Pendle-style markets. It is not a limitation waiting for a fix.

Ballast exits are constrained by design too. Withdrawals carry a 48-hour cooldown and are refused whenever they would break the subordination floor B / (H + B) ≥ 20%. In a stress period, when Ballast holders most want out, the floor is most likely to bind, because Ballast NAV has already absorbed losses. That is the junior tranche doing its job. A Ballast holder should size their position on the assumption that exit is unavailable during exactly the periods when it is most wanted.

MITIGATION · Hull is transferable, so a holder who needs out sells the token. Ballast exits are governed by the cooldown and the subordination floor, which is the mechanism that protects Hull.

MEDIUMRegulatory exposure on vUSD

vUSD is a stable asset minted 1:1 against the delta-neutral book and overcollateralized by Ballast plus the Reserve. It is not live. Issuing a dollar-denominated claim on a yield-bearing book is a regulated activity in some jurisdictions and an unclear one in others; the classification can differ between vUSD and the staked svUSD variant.

The mitigation is sequencing: no vUSD contract is deployed, no privileged mint path exists in any Vessel contract, and legal analysis is a stated precondition of mainnet issuance. The residual is that a jurisdictional finding could block or reshape Phase 3 entirely. Hull and Ballast do not depend on vUSD.

MITIGATION · vUSD is Phase 3 and post-audit. Jurisdictional analysis precedes any mainnet issuance.

MEDIUMKeeper and gas operations

Margin top-ups, rebalancing, and funding harvest are keeper actions. On Monad, a transaction is charged its gas limit, not its gas used: gas_paid = gas_limit × price_per_gas. A keeper whose wallet is sized for gas-used semantics runs dry sooner than expected, and a keeper whose wallet sets a large fallback limit after a failed eth_estimateGas pays that entire limit on every call. Either way the crank stalls.

A stalled crank means margin is not topped up, the delta band is not enforced, and funding is not harvested. The first of those is the one that leads to a liquidation. Monad's 10 MON reserve balance floor per EOA and the throughput cap on low-balance accounts add a second failure surface for an underfunded keeper.

Because the crank is permissionless, no single operator's wallet is a single point of failure in principle. In practice, the number of independent parties running the crank on testnet is not published UNVERIFIED — PENDING GATE-0. See The Crank.

MITIGATION · The crank is permissionless: any address can run margin top-ups, rebalancing, and funding harvest. This removes single-operator dependence. It does not remove the need for someone, somewhere, to fund gas.

LOWOracle and NAV input risk

Severity: low to medium. Vessel's NAV is continuous and its accrual is daily, computed from quantities the contracts can read directly: the venue position, the margin balance, the idle buffer, and the funding paid. There is no oracle in the accrual path whose manipulation moves Hull or Ballast NAV on its own.

Two inputs remain external. The venue's mark price determines liquidation distance and rebalance triggers, and while the venue is SimVenue SIMVENUE — SIMULATED that mark is a simulation input. And the spot leg's valuation for the delta band depends on a spot price source that the public materials do not name; whether that source is a DEX quote, a venue mark, or a third-party oracle is unspecified UNVERIFIED — PENDING GATE-0. A wrong spot input can cause an unnecessary rebalance or delay a necessary one. It cannot by itself mint yield.

MITIGATION · Observables-first design: NAV is computed from on-chain position, margin, and funding state rather than from an external price feed. This limits the blast radius; it does not reduce it to zero.

What is not on this register

Smart-contract risk on the spot venue (Kuru, or the UniswapV2-compatible router in use on testnet) is covered per-integration under Integrations, where each dependency page carries a mandatory failure-mode section. Monad consensus and execution risk is covered on the Monad integration page. The register above lists risks that are Vessel's own, or that Vessel inherits from the hedge venue specifically.

Any risk a reader believes is missing from this page is a documentation defect. The contact channels are listed at vessel.wtf.

Related

• Failure modes: the sequence of events inside each of the failures above.
• Stop conditions: the thresholds at which the protocol halts new issuance and withdrawals.
• Subordination: the floor that turns Ballast into Hull's first-loss cushion.
• Reserve: how the 2% target fills and drains.