Risk Disclosure

LAST UPDATED 25 AUGUST 2026

What Lodestar does and does not remove

Lodestar has no price-based liquidation. There is no health factor, no liquidation price and no keeper watching your position for a margin call. A price crash on its own cannot take your collateral.

That removes one risk. It does not make the product safe, and it introduces others:

• The deadline is real. If you do not repay by your due date plus the grace window, anyone can settle your loan permissionlessly and you can lose your collateral. The calendar replaces the liquidation price; it does not replace vigilance.
• Lenders cannot always exit. Capital lent out on a fixed term is not available for redemption until it comes back. See below.

Risks for everyone

Smart contract risk

The contracts were reviewed by Pashov Audit Group and the report is published in full. No Critical and no High severity findings were reported. An audit is not a guarantee. It is a time-boxed review by humans of a specific commit. Undiscovered vulnerabilities may exist, and a loss caused by one is permanent and unrecoverable.

One Medium finding (M-03) was acknowledged rather than fixed, for reasons set out in the published report. You should read that section before depositing.

The contracts are immutable

The core contracts cannot be upgraded, paused or patched. This protects you from a team changing the rules after you commit funds. It also means that if a bug is found, it cannot be fixed.

Oracle risk

Collateral is valued using Flare's enshrined FTSOv2 price feeds. If a feed becomes stale, is suspended, or reports a wrong price, valuations and settlements are affected. A collateral that cannot be priced blocks lender withdrawals entirely until pricing resumes, because the protocol refuses to price an exit against a book it knows is stale. This is deliberate, and the consequence is that an oracle outage pauses exits rather than degrading them.

Governance and admin powers

A 3-of-5 multisig can change risk parameters, add or disable collateral, set exposure caps and repoint which price feed values a collateral. That last power is meaningful and is constrained by the multisig rather than by a limit in the contract. Do not treat the oracle as a bounded input.

Mitigating this: every borrower-facing term is frozen into your loan at the moment you open it, including the grace period, the settlement floor curve, the penalty and the yield skim. A later parameter change cannot rewrite a loan you have already taken.

Token and counterparty risk

• USD₮0 is the unit of account. “Lenders made whole” means whole in USD₮0, not in dollars. If USD₮0 loses its peg, lenders bear that loss. No USD₮0 to USD price feed is wired.
• FXRP is issued by the FAssets system. Its behaviour, including the possibility of a transfer fee being enabled by FAssets governance, is outside our control.
• Liquid staking tokens. sFLR is valued using its provider's on-chain staking rate. That rate provider is an externally upgradeable contract controlled by its own operator. A haircut and a rate-of-change clamp bound the damage, but the trust is real and cannot be removed while the collateral is supported.

Regulatory risk

The legal treatment of decentralised lending protocols is unsettled and changing. Future regulation, enforcement or a court decision in any jurisdiction could restrict access to the Interface, affect the value of assets involved, or otherwise materially affect you. Access may be blocked from your jurisdiction at any time without notice.

If you are lending

You can lose principal

If a borrower defaults and the collateral sells for less than the outstanding principal, the shortfall is realised transparently in the vault share price and is socialised across lenders. Nothing is hidden and nothing is made good by us.

The first-loss reserve is not insurance

A reserve funded from protocol fees absorbs shortfalls before lenders do. It is a fair-weather cushion, not a crash backstop. It is thin relative to the book, it is a single-use pot, and in a correlated crash it depletes and lenders take the raw remainder. Your real protection is the loan-to-value ratio, not the reserve. Do not treat it as insurance, because it is not.

Exit liquidity is limited and first-come, first-served

You can only redeem against the pool's idle balance. Principal that is currently lent out on a fixed term cannot be redeemed until the loan repays or settles. In a rush for the exit, later redeemers are temporarily unable to withdraw. That is correctly priced rather than lost, but if you need your capital on demand, this product is not suitable for you.

Yield is not guaranteed

Lender returns come from borrower origination fees and, where enabled, collateral yield. If nobody borrows, you earn nothing. Displayed rates are historical or estimated, vary with utilisation, and are not a promise.

If you are borrowing

Missing the deadline is the whole risk

After your due date plus the grace window, your loan can be settled by anyone. Settlement sells your collateral behind a descending price floor anchored to the oracle. Lenders are repaid first, a penalty is charged, and any surplus returns to you. Set your own reminders. We may not be able to warn you, and no warning is owed to you.

Settlement can happen at an unfavourable price

The floor curve decays over time after default to guarantee that settlement can complete even in a falling market. The longer a defaulted loan remains unsettled, the lower the acceptable price becomes. Settling later is worse for you than settling earlier.

Your collateral is locked for the full term

You cannot withdraw collateral before repaying. If the collateral appreciates, you cannot realise that gain until the loan closes.

Fees are charged at origination

The origination fee is netted from what you receive and is earned in full at the moment the loan opens. Repaying early does not refund any part of it. Early repayment returns principal only.

Operational and personal risk

• Your keys are your responsibility. Lose them and your position is unrecoverable by anyone, including us.
• Phishing. Check the domain every time. We will never message you first, never ask for a seed phrase, and never ask you to sign something over direct message.
• Network risk. Flare could experience congestion, reorganisation, downtime or a consensus failure, any of which could prevent you acting in time.
• Front-end risk. The Interface could be unavailable or compromised. The Protocol can be used directly from a block explorer without it, and knowing how to do that is your safety net.

Nothing here is advice

This page is information, not financial, legal or tax advice, and not a recommendation to use the Protocol. Only commit assets you can afford to lose entirely. If you do not understand a risk described above, do not proceed until you do.

Questions: legal@lodestarprotocol.xyz. Vulnerability reports: security@lodestarprotocol.xyz.