Risks

Read this first.

Brimstead is new software that moves real tokens and ETH. These are the risks we know about.

Smart contracts

• Independent review completed (no critical/high/medium findings); not a formal audit. A review does not catch everything; a bug could still lose funds.
• No admin, no upgrade. Nobody can pause the vault or change its rules, which also means nobody can fix a bug or rescue funds.

For writers

• If the stock closes above your strike on Friday, part of your tokens goes to the buyers. You give up all gains above the strike for the premium.
• You still carry the full downside of the stock. The premium does not protect you from a fall.
• Tokens a buyer has paid for stay locked until the offer resolves: normally after the Friday close, up to 4 days later if a refund is needed, and up to 30 days in the worst case.

For buyers

• If the stock does not close above the strike, you lose the whole premium.
• You are paid in stock tokens, not in cash, so their value keeps moving after settlement.
• Positions cannot be sold or transferred before expiry.

Weekend quotes

• Over the weekend, buys are checked against Friday's last Chainlink print. A writer's quote can be stale against Monday news. Writers can withdraw unsold tokens at any time to pull it.

Issuer controls

• Robinhood issues the stock tokens and can pause them, block any address (including the vault), pause their oracle, burn balances by admin action, and upgrade the token's code.
• A blocked buyer or writer only blocks that side's token claim; ETH still flows. A blocked vault or a paused token stops every token movement of that stock until it is lifted.
• If the issuer burns tokens held by the vault, the last people to claim that stock may be unable to claim.
• If the issuer pauses the oracle or schedules a corporate action around expiry, the offer is refunded instead of settled.
• The refund path checks the issuer's oracle-pause flag at the moment it is called, not at expiry. A pause that starts after expiry can therefore turn a settleable offer into a refund. A keeper settles offers as soon as the next Chainlink round after the close exists, which keeps that window short.

Price feeds

• Settlement relies entirely on Chainlink. A wrong price in the feed is used as is.
• The close is the last price Chainlink printed (feeds update on a 0.5% move or every 24 hours), so it can lag the true close by about 0.5% and be up to 26 hours old.
• Chainlink stock feeds run 24/5 and have weekend and holiday gaps. Writing pauses over weekends; settlement waits for the next round after the Friday close; a missing close leads to a refund after 4 days.
• The Friday close is the last feed round at or before 21:00 UTC. That is not always the same moment as the official exchange close; US daylight saving time moves the exchange close by an hour.

Network and wallets

• Robinhood Chain is a young network. Outages, reorganisations or high fees can delay transactions. The vault has no sequencer uptime check: an outage delays settlement and claims.
• You sign every transaction yourself. Check the contract address against the one on Docs and Blockscout.

$BRIM

• No promised returns. The BrimDrip stream depends on vault fees and on creator fees forwarded by hand by the team, and can be small or zero.
• Payments under 0.005 ETH wait in BrimDrip's queue until they add up, so small fees can take a long time to start streaming.
• The $BRIM address is set in BrimDrip once and cannot be changed. A mistake there would require new contracts.
• ETH forced into BrimDrip outside its normal paths is not counted and stays stuck. $BRIM must behave as a standard ERC-20.
• The token can lose all of its value.