CAsoon
Protocol

Risks & Security

Two different kinds of risk: market risks, which you knowingly accept when you trade or lend, and smart-contract risks, which are ours to eliminate. Accepting market risk never makes an unfixed security issue acceptable.

Product status

Current deployment: Mainnet

OTC escrow
Internally reviewed and tested; not yet independently audited. Trade only amounts you can afford to lose.
Restricted
RENT lending
Live WITHOUT an independent audit. Internally reviewed and tested; exposure limits per token are deliberately low. Use only amounts you can afford to lose.
Restricted

Market risks — borrowing (oracle-priced)

Oracle-priced listings (approved tokens, Pyth) — you accept these when you borrow

  • You must return exactly the same quantity of the same token. If its price rises, buying it back costs more SOL — your loss is not capped by the rental fee.
  • If the price rises until your collateral ratio falls below the liquidation ratio, anyone can start a liquidation auction and receive your collateral at a discount of up to the auction's maximum bonus.
  • If you do not repay before the deadline, the position can be liquidated. If nobody liquidates it, after the auction and grace period (at least 13 hours) the lender claims your collateral up to the tokens' value plus the maximum auction bonus — and during a multi-day oracle outage, all of it.
  • The rental fee is paid up-front and is not refunded on early repayment.
  • Oracle prices (Pyth) can lag or briefly diverge from the market; liquidation decisions use them.

Market risks — lending (oracle-priced)

Oracle-priced listings (approved tokens, Pyth) — you accept these when you lend

  • Collateral does not guarantee that you get your tokens back. If the price spikes faster than liquidation can happen, or nobody can buy the tokens back, you receive the borrower's SOL collateral instead — possibly worth less than your tokens.
  • Borrowers may sell the tokens they rent, which can push the market price down while the loan is open.
  • Liquidation depends on third-party liquidators and on fresh oracle prices; during extreme volatility or liquidity shortages it can be late or fail.
  • Tokens that are rented out are not in your wallet until the position is repaid or settled.

Collateral does not guarantee full token recovery, especially during extreme volatility or liquidity shortages.

Market risks — borrowing (lender-set collateral)

Lender-set collateral listings (any coin, no oracle) — you accept these when you borrow

  • You must return exactly the same quantity of the same token before the due date plus the lender's grace period. If you do not, the lender can claim ALL of your collateral — regardless of the token's price, even if the tokens are worth far less than the collateral.
  • There is no price-based liquidation. If the price rises, buying the tokens back costs more SOL; your loss is not capped by the rental fee unless you give up the collateral.
  • Locking more than the required collateral does not reduce any risk: on default all of it goes to the lender; on repayment all of it is returned.
  • After the due date anyone can start the default timer. You can still repay until someone claims the collateral, which is possible as soon as the grace period ends.
  • The token has no oracle and no admin review. Mints with a freeze authority or dangerous Token-2022 extensions are rejected on-chain, but the token itself can be illiquid, manipulated or become hard to buy back.
  • The rental fee is paid up-front and is not refunded on early repayment.

Market risks — lending (lender-set collateral)

Lender-set collateral listings (any coin, no oracle) — you accept these when you lend

  • Your only protection is the SOL collateral you set. If the token's price rises above the collateral and the borrower does not return the tokens, you keep only the collateral — not the tokens or their value.
  • Nothing re-prices the collateral during a loan: no oracle, no liquidation auction. The only remedy is claiming all of the collateral after the due date plus your grace period.
  • Market values shown in the app are DEX reference prices (Jupiter) for display only; the program never reads them, and thin pools can be manipulated.
  • Borrowers may sell the tokens they rent, which can push the market price down while the loan is open.
  • Tokens that are rented out are not in your wallet until the position is repaid or settled. Starting the default timer, claiming the collateral and settlement are permissionless transactions somebody must send — you can send them yourself.

If the coin's price rises above your collateral and the borrower does not return it, you keep only the collateral.

Market risks — OTC

You accept these when you trade OTC

  • You trade at a fixed price you or the seller chose. Market prices elsewhere can differ before or after your trade.
  • OTC trades do not touch AMM pools, but buyers may sell afterwards, which can still move the market price.
  • Unsold tokens stay in escrow until sold, cancelled by the seller, or returned after expiry.

Smart-contract & operational risks

Disclosed — never waived by user consent

  • The RENT lending program has NOT been independently audited. An undiscovered bug could cause loss of escrowed tokens or collateral that no market move would explain.
  • The program upgrade authority and the protocol admin can change future risk parameters and pause new activity; they cannot move escrowed assets.
  • Accepting these risks does not permit us to leave known security issues unresolved. Known issues and their status are listed on the Risks page.

Security protections

What the programs enforce on-chain

Escrow
Tokens are held by vaults owned by program-derived accounts. Only the program can move them, and only to the buyer/borrower against payment or back to the owner.
Atomic settlement
An OTC buy pays the seller, pays the fee and delivers the tokens in one instruction — all or nothing. Closed offers cannot be filled, cancelled or expired twice.
Buyer / borrower limits
Every buy carries a maximum cost and every borrow a maximum fee, so a price change racing your transaction makes it fail instead of overcharging.
Token checks
Mints with dangerous Token-2022 extensions (transfer fees, hooks, permanent delegate, default-frozen, non-transferable) and mints with a freeze authority are rejected. Deposits are verified by the vault balance change.
Conservative collateral
Debt is valued at the higher of spot/EMA price plus the confidence interval; SOL at the lower. Initial ratio above the liquidation ratio (e.g. 200 % vs 150 %).
Oracle validation
Only fully verified Pyth price updates for the configured feed, within a maximum age and confidence width; borrowing is blocked when spot and EMA prices diverge too far.
Snapshotted terms
Risk parameters and oracle feeds are copied into each position when it opens; later admin changes cannot make an existing loan liquidatable.
Lender-set collateral
For coins without an approved oracle the lender fixes the SOL collateral and a 1 h – 7 d grace period. Both are locked into each position when it opens, so later edits only affect new rentals. No price can liquidate such a position — only non-repayment after the due date plus grace.
Exposure limits
Per-position and per-token caps on outstanding loans, and a minimum position size so liquidations stay economical.
Liquidation
Permissionless Dutch auction; liquidators must deliver the exact tokens. If nobody does, the lender receives the collateral after a grace period — no funds are ever stuck.
Emergency controls
A guardian can pause new offers, fills, listings and borrows instantly. Repayment, cancellation, expiry, settlement and default claims can never be paused.
No custody
The website and backend never hold your keys. Every transaction is simulated, then signed in your wallet.