Statics' security model rests on three pillars: who can change the protocol (authority), how assets are protected (custody), and what the protocol assumes about the chain (liveness).

#Authority

  • One StaticsTimelock owns both diamonds. All Diamond cuts, economic configuration, lifecycle release, hook fee configuration, and treasury or guardian changes flow through it after delay.
  • Basket creation is owner-only while creationFee() is zero and exact-fee permissionless while it is positive. Neither state constitutes token certification.
  • Diamond cuts are the sole implementation upgrade mechanism. The intended final release removes Diamond-cut authority from both diamonds; until then, timelocked upgradeability can change protocol behavior after delay.
  • Reward-asset selection is a PositionNFT owner action and requires no governance admission.

#Custody

  • Shared custody increases the importance of exact reservations and hostile token analysis. The reservation equation requires the physical balance to cover the sum of all sub-account reservations.
  • A physical reservation deficit is a black-swan incident, contained through fail-closed checks and guardian quarantine rather than a routine socialized-loss waterfall. No claimant class is intended to absorb another class's loss during ordinary operation.
  • PositionNFT transfer moves all attached protocol rights and obligations.
  • Dollar Core collateral remains outside Diamond custody reservations — only fees explicitly transferred to the periphery enter shared reservations.

#Liveness and oracles

  • Dollar safety depends on configured oracle, sequencer, collateral, health, and governance parameters. A misconfigured or manipulated feed impairs or halts a profile; impairment latches exits until 48 continuous healthy hours are checkpointed.
  • Canonical liquidity inherits Uniswap v4, immutable-dependency, price-manipulation, inventory, and impermanent-loss risk.
  • Hook-owned permanent liquidity is intentionally non-withdrawable while its pool remains active.
  • No keeper runs automatically. Claims, LP activation, recovery, compounding, treasury distribution, and ExitOnly unwind depend on users, integrators, or externally motivated keepers.

#Composition and permits

  • Flash callbacks expand atomic composition but not authority. Receivers must defend their own pools, approvals, slippage, and minimum profit. Statics provides no receiver allowlist, generic router, callback privilege, or fee exemption.
  • Permit signatures authorize caller allowances, not a complete economic intent. Their signed value may exceed the current action input and remain reusable; a failed permit never substitutes another owner — the typed action still pulls only from msg.sender under ordinary allowance rules.

#Funding risks

  • Permissionless Risk incentive funding is restricted to the series collateral, Statics Dollar, and configured staking token, but funders still bear series, profile, consumption, rollover, and retirement timing risk.
  • Basket-loan recovery and Dollar expired-risk recovery have distinct caller-incentive formulas; other basket and liquidity maintenance has no guaranteed caller or protocol bounty.

#Testnet fixtures are not production trust assumptions

The public testnet's owner-mintable STATICS token, mock USDG and oracles, faucet, and two-minute timelock are fixtures. Historical internal audits, release-QA notes, and X-Ray reports cover earlier commits and are not independent production assurance for the reviewed revision.