> ## Documentation Index
> Fetch the complete documentation index at: https://docs.denar.markets/llms.txt
> Use this file to discover all available pages before exploring further.
# Risk framework
> The risks Denar is built around — weekend gaps, oracle failures, bad debt — and the specific mechanism that bounds each one.
Equity collateral has a risk profile no crypto asset has. This page names each risk plainly and shows the specific mechanism that bounds it — no marketing, no hand-waving.
## The central risk: prices sleep, markets don't
Between Friday's close and Monday's open, a stock's on-chain price stands still while the real world moves. Earnings, news, macro — a stock can *gap* far beyond anything intraday. During that window, borrowing continues against the held price and liquidations can't react to information that doesn't exist on-chain yet.
**The buffer is the LLTV.** Crypto money markets run 80%+ loan-to-value because their prices never sleep. Denar runs **62.5%** on single stocks and **77%** on diversified ETFs — the gap to 100% is sized to absorb a violent weekend move before a position goes underwater. This is a deliberate, permanent design choice.
## The risk ladder, mechanism by mechanism
| Risk | What could happen | What bounds it |
| ----------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Weekend gap | Stock gaps past the LLTV buffer before liquidation can react | Conservative LLTVs; liquidation bonus attracts instant execution at Monday's price; bad debt, if any, is capped per market |
| Bad debt | Underwater position's shortfall written off to lenders | Isolation: loss lands only on that market's lenders; vault caps bound the exposure, and the two vaults never share it |
| Oracle failure | A feed goes wrong or silent | Staleness bounds pause the market; freeze-don't-guess design; independent USDG feed; monitoring with alerts |
| Corporate action mishap | Price and multiplier momentarily inconsistent | Issuer pause flag honored on every read — market pauses through processing ([proven live](/protocol/corporate-actions)) |
| Issuer risk | Stock tokens are issuer-operated and upgradeable; a prolonged pause freezes a market's liquidations | Isolation + caps bound exposure; curator can zero a cap instantly; monitoring alerts on pauses |
| Sequencer outage | Chain ordering halts; liquidations delayed for everyone | LLTV buffer absorbs the delay; sequencer guard ready for the chain's uptime feed |
| Liquidity crunch | Withdrawals exceed unborrowed liquidity | Adaptive rates make full utilization expensive and self-correcting; positions keep earning while waiting |
| Smart-contract bug | A flaw in the code | Minimal new code over a formally verified core; full test suite; every deployed contract verified on Blockscout with public on-chain source; external audit planned before caps rise |
## On-chain-native collateral: a different ladder
The risks above are the risks of *equity* collateral. [On-chain-native markets](/protocol/onchain-markets) swap almost all of them for a different set.
| Risk | What could happen | What bounds it |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Oracle manipulation | Someone pushes the Uniswap pool far enough, long enough, to move the time-weighted price and borrow against inflated collateral | The supply cap, sized below the cost of moving the pool; a 5-minute averaging window; a low LLTV that makes walking away unprofitable until the price is moved enormously |
| Liquidation lag | In a fast crash the time-weighted price stays above what a liquidator can sell at, so liquidating stops paying | Measured at 4.44% against a 15% incentive through a real −10.2%/8min move; the window is chosen for this, not only for manipulation resistance |
| Pool liquidity leaving | The pool thins out and the price becomes both wrong and unsellable | The oracle freezes below a liquidity floor and if the pool goes untraded; caps are sized to measured exit depth |
| Volatility | These assets move far more than equities, and around the clock | LLTV 38.5% — a position survives a 61.5% fall before bad debt; a separate vault so the loss never reaches equity lenders |
There is no weekend gap, no issuer risk and no corporate-action risk in these markets — those three simply do not exist for a token with no issuer and no closing bell.
## What cannot happen, by construction
**User funds cannot be trapped forever.** Repaying debt and recovering collateral works in every protocol state — including a permanently dead oracle. There is no pause button on repayment.
**One market cannot poison another.** Markets share no accounting. NVDA's worst day is invisible to the AAPL market's books.
**No fee can touch principal.** Fees apply to interest only, under hard-coded caps (25% core, 50% vault).
**Risk can't be raised silently.** Cap increases and other risk-raising admin actions pass through a public 1-day timelock. De-risking is instant.
## Current security posture, honestly
Denar launched after an internal adversarial security review (all findings fixed or consciously accepted and documented). The current phase is deliberately small: **10,000 USDG caps per equity market**, 20,000 on the PONS market, while the protocol accumulates live history. Before caps rise significantly: an external audit, and hardening of the operational key setup described in [Governance](/protocol/governance).
No protocol is risk-free. Audited components, guarded oracles, isolation, and caps reduce risk — they do not eliminate it. Never deposit or borrow more than you can afford to lose.