Risks
This is a research project. The contracts are unaudited, nothing here is investment advice, and no token grants a claim on any skin. What follows is the list of things that can go wrong, in rough order of how likely they are.
The vault runs out
The most likely failure, by a distance, and not a failure of the code. The war chest fills at 0.70% of volume and a correction costs a percentage of reserves. A coin without trading has nothing to defend itself with, and no contract changes that. The arithmetic in full.
The reference price is wrong
The pipeline reads a single marketplace today. If that feed is wrong, every reporter reads the same wrong number, the median agrees with itself, and the vault defends a fiction with perfect discipline. The breaker catches a jump; it cannot catch a consistent error, and it cannot invent a second opinion.
The clearest thing we would fix next
A second independent price source, so a disagreement between feeds is detectable rather than invisible. Until that exists, treat the reference price as one marketplace's opinion.
Risks by layer
| Layer | What can go wrong | What limits it |
|---|---|---|
| Oracle | Colluding quorum, or a source everyone shares | Median, breaker, staleness — none of which is a proof |
| Vault | Unaudited code holding real funds | 35 Solidity tests, no withdrawal path, immutable parameters |
| Pons | A launchpad we do not control and whose ABI is unpublished | The adapter wraps three functions, all verified against a live curve |
| Market | A coin nobody trades | Nothing. This is the base case, not an edge case. |
| Keeper | Nobody calls defend() | The function is permissionless; anyone can, and gas is the only cost |
What is deliberately absent
- No redemption. You cannot exchange a coin for a skin. There is no skin. Nobody holds one.
- No admin withdrawal. Not a timelocked one, not a multisig one — the function does not exist in the contract.
- No upgrade path. A deployed vault is the vault forever. A change means a new coin.
- No pause. There is no address that can stop a vault defending, including ours.
Status
The oracle is live on Robinhood Chain mainnet. SkinPriceOracle is deployed at 0x45e409CA2b6688cE1db62Bf76Ae145e8DE32fbBC, block 70,636,354, with a quorum of one reporter. One reporter is not a quorum in any meaningful sense — it is a single point of failure, and it stays that way until more signers are added.
It carries one price: Desert Eagle | Printstream (Field-Tested) at USD 35.37, signed by the single reporter and cross-checked against the Steam median before publication. That figure is readable by anyone at the address above.
That price is republished automatically every thirty minutes, because the oracle marks a feed stale after an hour and a price published by hand dies quietly at the end of it. The signing key and the key that pays gas are separate, and the key that owns the oracle is in neither place.
Nothing else is deployed. No vault, no adapter, no coin exists on chain, so nothing is being defended and the keeper has nothing to run against. The market table on this site comes from a Skinport snapshot refreshed every six hours, not from the oracle.
Anyone can register an item. That call was restricted to the owner on the first oracle, which made every launch pass through us. It no longer is, and the proof is on chain: the skin above was registered by an address that does not own the contract. Declaring is free; being priced still requires a reporter, and there is one of those.
The oracle owner is presently a hot key on a workstation. It can register skins, change the quorum and clear the breaker. It is Ownable2Step, so it will be handed to hardware custody, and until that transfer is accepted the authority over this contract is worth exactly what that one key is worth.
Snapshot data last refreshed Sep 23, 2026 UTC.