This page is not a disclaimer. It is the list we would want to read before putting money into a protocol like this one, written without softening.
Corpus is new, its contracts have not been externally audited, and the yield that is supposed to repay your loan is currently zero. If you use it, use an amount you can afford to lose entirely.
1. The yield is zero today, so nothing repays itself
Every market currently routes collateral into a 1:1 custody vault, which holds tokens and earns nothing. Yield is defined as the appreciation of vault shares above the recorded principal; for a custody vault that is always exactly zero.
The practical effect: your debt will not go down unless you repay it. Harvest runs and returns nothing. Pending yield reads zero. Estimated time to zero is shown as "Not shrinking" because that is what it is.
We built the mechanism first and connected a vault that earns nothing, because no earning vault for Robinhood Stock Tokens exists on this chain yet. If you are here for self-repayment specifically, there is nothing for you to use yet. If you are here for a zero-interest loan with no maturity, that part works today.
2. Liquidation
Corpus is a collateralised loan. If your collateral falls far enough in value, part of your position is sold at a discount to a stranger.
You become liquidatable when collateralValue x liquidationThreshold / debt falls below 1.00. From the maximum LTV, that is a fall of 16.67% on the single-stock markets, 14.29% on QQQ and SPY, and 20.00% on TSLA. Single equities move that much on an earnings release with some regularity.
Corpus's liquidation is partial — only the amount that restores a health factor of 1.00 may be repaid — which limits the damage from any one event but does not prevent repeat liquidations as a price keeps falling. Each one costs you the liquidation bonus (5%, or 7.5% on TSLA) on the slice that is taken.
The buffer is yours to set: borrowing only half of your capacity on a 50/60 market moves the tolerable fall from 16.67% to 58.33%. Nothing in the protocol will warn you before a liquidation happens.
3. Gap risk across closed markets
The price feeds Corpus reads update while the underlying market trades. Equities do not trade continuously. A position that is healthy at Friday's close can be deeply unhealthy at Monday's open, with no opportunity in between to add collateral or repay based on the real price — because the real price does not exist until the market opens.
In a fast open, the sequence of events is: the feed updates, your position is already below a health factor of 1, and liquidators act within the same minute. You will not get a warning shot. Holidays make it worse: a three-day weekend is roughly 89.5 hours of darkness against a 65.5-hour ordinary weekend.
4. Oracle risk
Staleness. Corpus accepts a price for 80 hours after the feed's last update. If a feed goes quiet longer than that, borrowing, withdrawing with debt, and liquidation are all blocked for that market until it resumes. Deposits, repayments, harvests and claims continue. This means a stale feed can trap your collateral: if you have debt and want it out, you must wait for the feed, or repay the debt first (which is always allowed) and then withdraw.
Late liquidation. Because liquidation is blocked while stale, a position that goes bad during a closure cannot be liquidated until the feed returns. If the price has moved far enough, the collateral may by then be worth less than the debt, leaving residual debt that the treasury absorbs.
Bad data. The oracle rejects zero, negative and incomplete answers, but it cannot detect a feed that is confidently wrong. A materially incorrect price can either liquidate a healthy position or let an unhealthy one borrow. There is a single feed per asset and no secondary source.
Dependency. Corpus depends on a third party continuing to publish these feeds. If a feed is retired or the publisher stops, the affected market becomes borrow-only-blocked until the owner points the oracle somewhere else.
5. Swap and liquidity risk
Harvested yield has to be sold for USDG through an on-chain pool. Corpus requires the swap to return at least the oracle value of the yield minus 1%, and reverts the entire harvest if it does not.
That protects the price but not the execution. If the pool is thin or absent, harvests simply fail, and any self-repayment stops until liquidity returns. Because the failure path is a revert rather than a bad fill, you lose nothing except the repayment you were expecting. Repayments, withdrawals, borrowing and liquidation are deliberately written so that a broken swap does not block them.
Deposits are the exception. A market with yield waiting to be sold has to sell it before new collateral joins the pool, or the new deposit would take a share of yield earned before it arrived. So while the swap is failing, deposits into that market are refused and everything else keeps working. The same applies when the feed has not updated within the 26 hours the yield source will price a sale against. Neither costs you anything; both clear when the pool or the feed does.
6. Treasury and borrowing capacity
The USDG you borrow comes from a treasury the protocol holds, not from other users. Its balance is finite, and available capacity is the balance minus all unclaimed credit. When it runs out, new borrowing reverts until it is refilled. Nothing entitles you to borrow; capacity can be exhausted by other users at any time and is not reserved.
Claimable credit is reserved out of that capacity, and so is harvested USDG that no position has settled yet: both are subtracted from what the protocol will lend or the owner can withdraw. The protocol therefore always holds at least the credit it owes, and claiming it is never blocked by other people's borrowing.
Residual debt from underwater liquidations reduces this balance. So can the owner, who can withdraw from it.
7. Smart contract risk
The contracts are new, unaudited, and hold collateral. They can contain bugs that testing did not find.
What we have done: unit tests over every function, guard, event and error; property tests over the liquidation and settlement arithmetic, including that the permitted repayment brings health back to within a rounding unit of 1.00 and that one unit more reverts; stateful invariant tests over multiple users, markets, price moves and yield events; and fork tests against the live chain, real tokens and real feeds. What we have not done: an external audit, a formal verification effort, or a bug bounty of any size.
The contracts are not upgradeable, which removes one class of risk — nobody can swap the logic under your position — and adds another: a bug cannot be patched in place. A serious bug would be handled by pausing and migrating, which is disruptive.
8. Admin powers
Corpus is not governance-free, and pretending otherwise would be dishonest. The owner address can:
- list new markets and change any market's max LTV, liquidation threshold, liquidation bonus and cap, including on markets with open positions;
- close a market, which blocks new deposits and borrows;
- replace the price oracle and the swap router;
- change the protocol's share of harvested yield, up to a hard maximum of 50%;
- change the fee recipient, the staleness window and the keeper;
- pause the protocol;
- withdraw USDG from the treasury.
A designated keeper address can also pause. Ownership transfer is two-step, which prevents a fat-fingered transfer to an unreachable address but does nothing about a compromised key.
Three limits are worth knowing. Parameter changes must satisfy maxLTV < liquidationThreshold and a bonus of at most 20%. The protocol's share cannot exceed 50%. And a pause can never block repayment, repayment on your behalf, claiming credit or funding the treasury — the operations that get you out are always available.
That still leaves a set of powers that could be used badly. A raised liquidation threshold does not endanger existing positions, but a lowered one does; and treasury withdrawal is unconstrained. Judge this as you would judge any protocol with a live admin key.
9. Vault and migration risk
Yield sources are ERC-4626 vaults, and the owner can replace a market's vault, which migrates the recorded principal and shares into the new one. A replacement vault is a new set of assumptions: it might lend your collateral, it might have its own bugs, it might not return the full principal on withdrawal.
Yield can never be negative in Corpus's accounting — a vault that loses value simply reports zero surplus and never increases your debt — but that is an accounting statement, not a guarantee of recovery. If a future vault loses principal, the shortfall appears when you try to withdraw.
When an earning vault is connected, we will describe what it does before it happens.
10. Token, custody and issuer risk
Robinhood Stock Tokens are not shares. They are tokens issued by a third party and backed by arrangements you should read for yourself. Everything that applies to the issuer applies to your collateral: custody failure, redemption restrictions, transfer restrictions, handling of corporate actions such as splits and dividends, and any pause or freeze mechanism the token itself may have.
USDG is likewise a third-party stablecoin. If it depegs, both your debt and the treasury are denominated in something that is no longer worth a dollar. Corpus has no reserve of its own and no mechanism to compensate for that.
11. Chain risk
Robinhood Chain is a young network. Availability, finality, censorship resistance, bridge integrity and gas markets are outside Corpus's control. If you cannot get a transaction included during a fast price move, you cannot repay or add collateral, and being unable to act is itself a loss.
12. Regulatory and jurisdiction risk
Robinhood Stock Tokens are not available to US persons and are restricted in other jurisdictions. Whether you may lawfully acquire, hold, borrow against or dispose of them where you live is your responsibility to establish, and Corpus does not check, advise on or accept any of it. Rules can change, and a change could make a position you already hold awkward to exit.
Tax treatment of borrowing against tokenised assets, and of the yield used to repay a loan, varies by jurisdiction and is not something we can tell you anything useful about.
13. Interface risk
The website is a convenience. It reads the chain directly and shows what the contracts say, but it can be unavailable, out of date, or serving a wrong build. The contracts are the protocol, they are verified on the explorer, and they can be used without this interface. If the numbers on screen disagree with the chain, the chain is right.
14. There is no insurance
No fund, no cover, no backstop, no recourse. If a bug drains the contracts, if a vault loses your principal, if a liquidation happens while you are asleep, if the issuer fails — nobody reimburses you.
The short version
Zero yield today. Liquidation is real and can strike across a weekend. The contracts are unaudited. An admin key exists and can do meaningful things. Your collateral is a third party's promise. Start small, keep the health factor high, and read your own transactions before signing them.