Risks

Contract risk

The contract is tested, including fuzzing of settlement, but it has not been audited. Deposit what you are prepared to lose.

Price reference risk

Blackpool's price is the pool's price. A thin pool can drift from the listing venue, and a determined actor can move it. The price guard voids a batch whose settlement price has jumped away from the batch average. Since version 2, a reference price also catches a price held away for a whole batch; a push sustained over many batches, or the first batch after an idle hour (when the reference is re-seeded), is still only bounded by the batch-average guard, each order's limit and the cost of holding the pool against arbitrage.

Reveal window

Self-revealed orders are public for about a minute before settlement. Encrypted orders (the default since version 2) skip that window, but become readable off-chain once their drand round is out, a few seconds before the keeper settles. Someone who reads a large imbalance can trade on the pool during that minute. The guard limits how far the settlement price can be pushed; it does not stop anyone from acting on the information elsewhere.

drand dependency

Encrypted orders can only be opened once the drand quicknet beacon publishes their round. If drand stalled, those orders would miss their batch and lose their 1 USDG bond; self-revealed orders are unaffected. The round is estimated from the L1 block pace, so it can land slightly before or after the reveal window closes; see Encrypted orders.

Issuer controls on stock tokens

Robinhood's stock tokens share one upgradeable implementation. The issuer can pause every token at once, block individual addresses, and change the token logic. A paused token cannot be deposited or withdrawn; a blocked address cannot receive it. Blackpool has no way around this, and would not want one.

Corporate actions

Stock tokens carry a UI multiplier for splits and similar actions. Blackpool works in raw token units, like the pool it reads, so a change in multiplier does not affect settlement. It does change what a raw unit means to you; the app shows both.

Liveness

Settlement and price sampling rely on someone calling settleWithReveals (or settle) and poke. The protocol keeper has settlement priority for the first 13 blocks of each settle window; after that, anyone can settle. A keeper will do it for every market. If it stops and nobody else steps in, batches are voided after 26 blocks and every order is returned: funds are never stuck, trades simply do not happen.