> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ix.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk framework

> A structured view of IX RWA's material risks — category, description, on-chain mitigation, and residual exposure.

This is the structured, allocator-facing companion to the plain-language [Risk disclosures](/security/risk-disclosures). It maps each material risk to the specific on-chain mechanism that mitigates it and the exposure that remains. It is informational, not investment advice.

<Warning>
  IX RWA is on **Base Sepolia testnet** with simulated settlement. The mitigations below are implemented in code today; their **effectiveness with real capital** is established at the audited mainnet redeploy.
</Warning>

## Risk register

| #  | Risk                        | Description                                                                  | Mitigation (on-chain)                                                                        | Residual exposure                                                           |
| -- | --------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| 1  | **Market**                  | Compute rental rates and demand fall, lowering revenue and hardware value    | NAV marks hardware to live market rates; depreciation is reflected, not hidden               | Directional market risk is not hedged — NAV-per-share can fall              |
| 2  | **Liquidity**               | A liquid share token sits on illiquid hardware; mass redemptions exceed cash | Reserve floor + FIFO redemption queue + smoothing reserve; NAV locked at redeem time         | Queued exits wait for the buffer to refill; no instant secondary market yet |
| 3  | **Counterparty / operator** | Operators underperform, default, or a hosting venue (e.g. Vast.ai) fails     | Per-asset cost basis + operator recorded on-chain; quarantine drops a bad asset from NAV     | Off-chain operator performance is not on-chain-enforceable                  |
| 4  | **Valuation / oracle**      | A wrong or stale NAV misprices deposits and redemptions                      | `INAVOracle` seam + per-cohort bounds (`maxBps`) + staleness auto-pause + attestor gate      | An attested value can be wrong *within* bounds until corrected              |
| 5  | **Operational**             | Feeder / keeper / indexer failure stalls NAV updates or the queue            | Staleness pause fails safe; chain-as-truth indexer rebuilds from events; roles are separated | Off-chain infra availability affects freshness, not custody                 |
| 6  | **Smart-contract**          | A bug in the vault or peripherals                                            | UUPS upgradeability, `ReentrancyGuard`, `Pausable`, storage `__gap`s, test suite             | Unaudited on testnet — a third-party audit is a mainnet prerequisite        |
| 7  | **Governance / key**        | Privileged-key misuse or compromise                                          | Least-privilege named roles; upgrades → multisig + timelock at Phase-2; no ambient owner     | Testnet admin retains direct control until the Phase-2 lockdown             |
| 8  | **Fee / dilution**          | Streaming management fee dilutes holders; params can change                  | Fees follow ERC-4626 (preview == actual); bps capped at 100%; changes are event-logged       | Management fee is a continuous drag; parameters are admin-settable          |
| 9  | **Regulatory**              | Tokenized-RWA treatment varies and evolves by jurisdiction                   | Non-custodial, transparent, verifiable design                                                | Eligibility / access rules may apply at mainnet                             |
| 10 | **Custody / key**           | Loss of your wallet keys                                                     | Non-custodial — IX RWA never holds your keys                                                 | IX RWA cannot recover lost keys or funds                                    |

## How the mitigations compose

```mermaid theme={null}
flowchart TD
    F[Bad or stale input] --> B{Oracle bounds maxBps}
    B -->|move too large| REV[Reverts]
    B -->|within bounds| S{Staleness maxAge}
    S -->|stale| PAUSE[Vault pauses pricing]
    S -->|fresh| A{Attested?}
    A -->|no attestation| REV
    A -->|attestor + evidenceHash| NAV[NAV updates on record]
    Q[Diverging asset] --> QUAR[Keeper quarantine → drops from NAV]
```

No single control is load-bearing on its own: bounds cap the size of an error, staleness stops pricing against a dead feed, the attestor gate puts every move on record, and quarantine removes a bad asset entirely.

## Where to verify each claim

* **Valuation & oracle** — [Transparency & NAV](/protocol/transparency-and-nav), [Proof of Reserve](/protocol/proof-of-reserve)
* **Liquidity & redemptions** — [Fees & terms](/protocol/fees-and-terms), [Ownership & IX-CORE](/protocol/ownership-and-ixd#redeeming-instant-or-queued)
* **Smart-contract & governance** — [Security model](/security/security-model), [Governance](/security/governance)
* **Reporting & assurance** — [Reporting & assurance](/security/reporting-and-assurance)