Known limitations

#V1 is not trustless

It depends on things it does not control. Each is named individually here rather than summarised into a reassuring sentence.

#Keeper liveness

Mirroring requires somebody to call sync. Nobody is obliged to. If no keeper runs, a vault stops mirroring and drifts from its source.

The drift is visible — divergence is shown with its reason — but it is drift. Calling is permissionless and carries a capped bounty, which makes it likely rather than guaranteed.

#Curated asset metadata

An asset's approval, and its recorded decimals, come from a human review. A wrong review means wrong pricing or a token that breaks pro-rata accounting. Decimals are cross-checked against the token contract; judgement is not.

#Price adapters

NAV depends on adapters returning honest prices. They are allowlisted and they revert rather than guess, so the failure mode is unavailable rather than wrong — but an adapter that is confidently wrong is inside the trust boundary.

#An upgradeable base asset

The base asset is WETH on Robinhood Chain, which is upgradeable by the chain's bridge governance. That is entirely outside this protocol's control and cannot be mitigated from inside it.

#An off-chain indexer for history

Activity, receipts and volume come from an indexer. If it is down or stale, history is unavailable. Live state is unaffected, because live state is read from chain on every request.

#Side-wallet farming cannot be prevented

Nothing can prove that an observed address is somebody's only address. A source can build a record on the watched wallet and trade against it elsewhere. The protocol does not claim to prevent this; it bounds the damage with caps and keeps every constraint visible.

#Not audited

No external security review has been performed. See Production gates, gate 4.

#Not deployed

Nothing has run on mainnet. The deploy script refuses chain 4663 outright.

#The premise itself is unproven

It has not been established that Fomo accounts hold Robinhood Chain positions — the assumption the product is built on. This is gate 1, it is open, and it is disclosed on the status page and in the footer rather than mentioned only here.

#Signing is wired; mainnet is not

Connecting a wallet, depositing, exiting in kind, requesting a base-asset exit, and claiming a settled one all work end to end against a real chain — discovery, chain check, exact approval where one is needed, simulation, signature and receipt.

What has not happened is a mainnet deployment. The deploy script refuses chain 4663 outright, and the production gates that would justify lifting that are all open.