The safety model
Bounded operator power. Fund operators actively manage capital, but within hard on-chain limits. Capital can only leave the Fund into Strategy wallets restricted to an allowlist of exact calls, or to explicitly whitelisted external wallets. The Fund can always pull assets back from a Strategy, and a Strategy can never call the Fund. Separated roles. No single key controls every dimension of a fund. Reporting, accepting, reviewing, allocating, configuring, and pausing are distinct roles that can be split across parties, and code-upgrade authority (ProxyAdmin ownership) is independent of all of them. See Access Control & Roles. Guarded pricing. Because one report settles a whole batch, the Oracle enforces a mandatory review delay, a staleness limit, and per-asset suspicious-price bounds. A price that moves too far is flagged and can only be accepted by a stronger role after review, or rejected and resubmitted. Snapshotted redemptions. A redeem batch’s payout is fixed at settlement, so later changes to fees or prices cannot alter what an already-settled batch is owed. Per-fund guardrails. Each fund can enforce TVL caps, per-batch caps, minimum sizes, a drawdown gate, a depositor whitelist, and an emergency pause via its RiskManager. Pull-based upgrades. Live fund contracts are upgraded only through their own ProxyAdmins, owned by the tenant. The protocol operator cannot push code into a deployed fund.Risks that remain
Market and strategy risk. Funds actively deploy capital. Strategies can lose money; when they do, the reported NAV falls and your shares are worth less. This is the primary risk and it is not mitigated by any of the mechanisms above. Operator and reporting risk. NAV is reported by an off-chain operator. A wrong, delayed, or dishonest report affects settlement pricing. Safety bounds and the review delay reduce but do not eliminate this — a report within the configured bounds is accepted as ground truth. Redemption timing risk. Settlement fixes what a redemption is owed, but payout depends on the operator returning capital to the Fund (unwinding strategies, or receiving bridged/external-wallet transfers). If capital is illiquid or slow to return, funding a redemption can take time. Custody trust in external legs. Assets pushed to a whitelisted external wallet or bridged to a StandaloneStrategy cannot be pulled back on-chain by the Fund — their return depends on the controller. This is operational trust, sized per fund. Smart-contract risk. The contracts may contain bugs despite testing and review. Upgradeability reduces the cost of fixing issues but adds its own risk surface (a compromised ProxyAdmin key could push malicious code). Key-management risk. The protocol’s guarantees depend on privileged keys (roles and ProxyAdmin owners) being held securely. Compromise of a high-power key — particularlyDEFAULT_ADMIN_ROLE or a ProxyAdmin owner — could put fund assets at risk.
Regulatory and jurisdictional risk. Access to specific funds may be restricted in certain jurisdictions, and the regulatory treatment of tokenized funds is evolving.
Before you deposit
Review the specific fund’s fee schedule, its configured risk limits, who holds its operational and upgrade roles, the assets it accepts, and its expected redemption timing. The protocol provides the rails; each fund’s risk profile is set by its operator.This page describes protocol mechanics and general risks. It is not financial, legal, or tax advice. Red Potion is not a lawyer or financial adviser; consult a qualified professional before making investment decisions.