Risk Disclosure

Read this before you use any tool.

1. Smart-contract risk. None of the TrustlessKit contracts has been externally audited yet. They have 455 automated Foundry tests (including fork and invariant suites) and clean static analysis, which reduces but does not eliminate the risk of bugs. A bug could result in total loss of escrowed funds in the affected tool.
2. Irreversibility. Settlement is atomic and final. There is no dispute process, no chargeback, no admin reversal.
3. Counterparty and asset risk. The Protocol guarantees the mechanics of the exchange, not the value of what you receive. A whitelisted token can still fall to zero, lose liquidity, or have its team disappear. Whitelisting is a technical review, not a recommendation.
4. Vesting risk. Vested tokens are delivered on a schedule you agreed to. You cannot accelerate it. The token's price during the vesting period may differ materially from the deal price.
5. Stablecoin risk. USDC and USDT are issued by centralised companies that can freeze addresses and may de-peg. The registry verifies the contract address, not the issuer's solvency or your address's standing with the issuer.
6. Dependency risk. Vesting (in OTCVault, TokenLaunch, Vesting and Bounty Board) relies on Sablier Lockup v4; DCA Vault relies on Uniswap V3 pools and their TWAP oracle. A vulnerability or manipulation in those protocols could affect streams and executions created through TrustlessKit.
7. Key risk. Loss of your wallet keys is loss of your deposits, refunds, and Sablier NFT. Nobody can recover them.
8. Network risk. Arbitrum One and Base are rollups with a centralised sequencer and an upgradeable bridge; BNB Chain has a small validator set. Network outages could delay, but not prevent, refunds, unlocks and executions.
9. Regulatory risk. Token trading may be restricted or taxed where you live. You are responsible for compliance.
10. Interface risk. The website could go offline or be compromised. Always verify the contract address you are interacting with matches the addresses published here and in the repository. The Protocol continues to function without this website.
11. Fee-on-transfer and rebasing tokens are unsupported in every escrow tool. Deposits of such tokens revert; if a token later adds such behaviour, transactions involving it may fail and refund at expiry.
12. DCA execution risk. DCA tranches are executed by anyone against a Uniswap V3 pool with a 30-minute TWAP floor. Thin pools, oracle lag and MEV can still cost you within the guard you set; a tranche that cannot clear the floor simply waits.
13. Owner-key risk (current). The owner and guardian of every contract on every chain is today a single deployer EOA (interim) — a Safe + 48h timelock migration is planned. A compromised owner key could raise future fees up to each contract's hard cap, change rails, routers or allowlists for future transactions, or pause creating new deals/locks/sales/bounties/plans. It could not move escrowed funds, alter existing terms, or block cancel, refund, withdraw and claim.