Known Risks

#Smart contract risk

A bug in reward accounting, access control, signature handling, token transfer logic, v3 custody, share issuance, or withdrawal code could block access or lose assets. WeedSwap has not completed an independent audit.

#Price and liquidity risk

WEED, pool tokens, staking assets, and partner rewards can lose value. Thin liquidity can amplify price impact and make an exit expensive or impossible at the displayed price. APR does not offset a falling principal value.

#Concentrated liquidity risk

A v3 position may move out of range, stop earning trading fees, and become concentrated in one token. Impermanent loss can exceed fees and farming rewards. Range selection changes both exposure and capital efficiency.

#External token risk

A token may charge transfer fees, rebase, pause, blacklist, upgrade, or contain privileged functions. WeedSwap pool policy intends to reject unsupported behavior, but an external token can still change after review.

#Administrative key risk

Compromised role holders could pause activity or configure harmful values within their authority. Timelocks and contract wallets reduce some risks only after correct deployment and role transfer.

#Referral limitations

The referral reserve is finite, eligibility can change, and anti-abuse rules add friction rather than complete Sybil resistance. Commissions and invitee boosts can be clipped or stop without changing base rewards.

#Frontend, RPC, and indexer risk

The interface, RPC, or indexer can be stale, disconnected, or wrong. Live mode must show a blank marker when data is missing, but users should still verify material balances, allowances, events, and addresses on chain.

#Known limitations

• Same-token Greenhouse recovery can currently include staked principal.
• EmissionController pause time can accrue after resume.
• Referral eligibility can desynchronize across WeedChef pools.
• WeedV3Vault share issuance can transfer existing idle assets or fees to later depositors.
• Greenhouse and Garden rescheduling can erase uncheckpointed prior-program rewards.
• Empty WeedChef positions can pre-arm or retain a matured harvest timer through a zero deposit or full exit and restake.
• WeedV3Vault deposits and redemptions can fail while its position is fully out of range.
• Referral bindBySig does not require invitee authorization and can permanently bind an unbound invitee.
• LiquidityBootstrapVault does not enforce pair-specific position creation or NFT locking before releasing its reserve.
• Budget vault initialization does not bind the protected asset to WEED, allowing an administrator to initialize with another matching-balance token and recover the WEED allocation; WEED is also recoverable before initialization.
• WeedChef emergency withdrawal can change pool-stake and active-allocation denominators before checkpointing elapsed emissions, over-crediting remaining users or redistributing historical pool allocation.
• WeedChef emergency withdrawal does not reset optional Rewarder stake and can leave stale reward accrual.
• WeedReferral preview can crowd out an invitee boost with commission that the referral vault later clips to zero.
• WeedChef pool reconfiguration can leave old Rewarder stake stale and omit existing stake from a replacement Rewarder.
• Rewarder schedules trust an out-of-band fundedAmount without transferring or verifying reward tokens, can strand undistributed balances, and have no recovery path.
• Independent contract review is incomplete and remains a launch blocker.
• Vault math and Uniswap callback surfaces remain high-priority review areas.
• Browser write flows are intentionally incomplete and disabled.
• The local v3 fixture does not seed a complete deterministic liquidity and incentive flow.
• Indexer payload decoding and materialized financial aggregates are incomplete.
• Referral controls do not eliminate Sybil behavior.
• Aderyn analysis is blocked by an upstream toolchain build failure and is not marked passed.

#Current exposure