> For the complete documentation index, see [llms.txt](https://docs.buoy.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buoy.finance/for-depositors/risks.md). # Risks & Trust Model Buoy is built to minimize the trust you place in any single party — but no DeFi product is risk-free. This page describes, honestly, what can go wrong and what protections exist. ## What the contracts guarantee The strongest protections are structural — enforced by the smart contracts, not by promises: * **The Leader can never withdraw your funds.** Leaders (and their trading agents) can only trade the vault's capital on Hyperliquid. Every path that moves funds out of the vault leads exclusively back to the vault's own accounts or to depositors. * **The settlement service can't take funds either.** The fulfiller prices and settles requests, but fund destinations are fixed at the contract level — it cannot send vault capital to an outside address. * **Your position is on-chain.** Buoys are ERC-20 tokens in your own wallet. Locked withdrawal payouts are recorded on-chain as obligations of the vault. * **You always have an exit.** Any unsettled request becomes cancellable after the timeout — your funds cannot be stranded by an unresponsive service. See [Cancelling a Request](/for-depositors/cancelling-a-request.md). * **Price floors.** Every request carries a minimum you'll receive; settlement can never give you less. * **Vault contracts are immutable.** Once deployed, an individual vault's code cannot be changed. * **Deposit limits can't lock you in.** A Leader can restrict who deposits and how much (whitelist, caps, minimum leader share), but those rules are consulted only on the way *in*. The withdrawal path never asks them — being removed from a whitelist, or a vault sitting over its cap, cannot stop you from redeeming. ## Risks you are taking ### 1. Trading risk — the big one You are giving a trader leveraged access to perp markets with your capital. **The share price can go down, sharply, and a vault can in principle lose most or all of its value.** APR history, drawdown stats, and track-record length help you judge a Leader — but past performance guarantees nothing. Never deposit more than you can afford to lose. Note also that some vaults are run by **automated strategies** rather than a human trading discretionarily — including vaults operated by the Buoy team itself. Their descriptions say so. An automated strategy is not inherently safer: it removes hesitation, not market risk, and a bug or a regime change hits it exactly like it hits a person. ### 2. Withdrawal timing risk Withdrawals settle only once the vault has free USDC. If the Leader has the capital tied up in open positions, the protocol closes what it safely can automatically — but in adverse situations settlement can take longer and may depend on the Leader unwinding positions. Once your withdrawal is **Locked**, its dollar amount is fixed; the wait affects *when* you're paid, not *how much*. If the vault is down when positions must be closed to fund your exit, your payout can be reduced to reflect real closing costs — but never below your quoted minimum. ### 3. Operational trust in the fulfiller Vault valuation (NAV) is computed by the protocol's settlement service from live Hyperliquid market data, and requests are settled at that valuation. This service is operated by the Buoy team. You are trusting it to value vaults correctly and settle requests promptly. Mitigations: the valuation method is deterministic and mirrors Hyperliquid's own account values; every settlement is on-chain and auditable; the service cannot touch fund destinations; and the cancellation mechanism means it can delay you but never trap you. ### 4. Protocol administration The protocol admin can pause vaults (freezing deposits and withdrawals as a safety measure), adjust vault parameters such as the Leader or fee, and upgrade the shared entry-point contracts. This is standard for a young protocol and enables rapid response to incidents, but it does concentrate power — treat it as part of your trust assessment. ### 5. Smart contract risk As with any on-chain protocol, bugs in the contracts or in the underlying platforms (HyperEVM, HyperCore, the USDC bridge) could result in loss of funds. The contracts went through a security review and hardening pass before the production deployment — the findings raised are described in [Security & Trust](/protocol-deep-dive/security-and-trust.md) — but review is not proof, and this risk never reaches zero. ### 6. Trading-agent key handling To trade a vault, its Leader holds a HyperCore API-wallet key, and connecting a third-party trading terminal means handing that key to the terminal. The key **cannot withdraw funds** — that's the whole point of the design — so the worst case is unauthorized *trading* on the vault, which the Leader shuts off by rotating the agent. It's still a real operational surface, and one more reason the vault's track record and the Leader's professionalism matter. ### 7. Underlying platform risk Vault capital lives on Hyperliquid's infrastructure and is bridged between its EVM and trading layers. Disruptions to Hyperliquid itself — the exchange, the bridge, or the chain — would affect vaults too. ## The bottom line Buoy removes the classic "manager runs away with the money" risk by construction, and replaces it with market risk plus a clearly bounded set of operational trust assumptions. Read the vault's track record, size your deposit accordingly, and know that whatever happens, your exit path is enforced by code. For the complete role-by-role powers matrix and the code-level guarantees behind it, see [Security & Trust](/protocol-deep-dive/security-and-trust.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.buoy.finance/for-depositors/risks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.