Skip to main content

Known risks

This page exists so that nothing on this site is a surprise later.

The reward pool is finite and will run out​

Rewards come from a reserve of 30% of the supply plus the tokens committed by participants. No trading fee funds them. The reserve is finite and nothing refills it.

Be clear about the speed: at a 10%/day base and up to 20%/day earned — more if a rate grant is on, since it is added on top of that ceiling — the reserve depletes far faster than it would under small rates. Payouts are first come, first served and stop when the pool is empty. No duration is published because none would be honest — how long it lasts depends on how much is committed and how often people harvest. The number that matters is the remaining reserve the app displays.

In aggregate, bond holders collect their own deposits back plus the reserve — no more. Early bonds are partly paid with the deposits of later ones. Whoever arrives last collects least.

A bond's principal is never returned​

principal is the basis used to compute rewards, not a balance. Committed tokens join the reward pool and are paid back out to bond holders generally — not reserved for you.

Exiting costs 12.7% — without a commit bond​

3% tax plus 9.7% into a bond. You are paid, in ETH, for 87.3% of what you sell. During the launch window the tax is higher, so the total is larger.

The 10% is itself a setting, not a constant: the deploying key can dial the retention below its engraved 10% cap, down to zero and back up, but never above it. So the exit cost can only ever be lower than the figures above; what launch day advertised is the worst case the code allows.

A sale that fits inside the seller's exemption allowance pays the 3% tax only: no retention, no new bond. Two things temper the discount: the allowance is finite (five times what each of the seller's bonds opened with, cumulative for life, after which the full 10% returns), and the sell itself permanently strips the +5 boost from every commit bond the wallet holds.

Stated plainly, this is a deliberate transfer: exempt sales route nothing to the reward pool, so committed sellers stop feeding it. The exposure is bounded — total exempt volume can never exceed five times what was actually committed — but it does mean the pool is fed mainly by uncommitted sellers.

A contract that calls the router on behalf of several users is, as far as the hook can tell, the seller. An operator who commits tokens can therefore spend its own allowance on behalf of the people it routes — retention-free selling, financed by capital it has locked away for good and capped at five times that amount. Nobody can spend an allowance that is not theirs, and the total stays bounded, but the allowance is shareable in that specific sense.

Spending an allowance requires the wallet to be visibly the one selling: either the sale came through the official app, or the C4 sold left that wallet in the same transaction. That closes the obvious abuse — naming a stranger's wallet, or merely sharing a transaction with them — but one gap remains and is worth knowing. A contract you route a sale through is inside a transaction where you really are moving C4, so it can aim that movement at a sale of its own and spend that much of your allowance. It is bounded to what you moved, since the proof is spent rather than reusable, and any contract you have already approved for your tokens can take them outright, which is worse. The ordinary rule applies: do not route through contracts you do not trust.

The limit in the other direction: a route that pays the pool straight out of the seller's wallet at the very end of the swap has moved nothing at the moment the hook decides, so that sale pays the full retention even with allowance left. Routes that take the tokens first — the app's own router, and the usual aggregator shape — are unaffected.

Rewards are paid in tokens, so converting them to ETH pays an exit cost again.

The code is not externally audited​

An internal audit in July–August 2026 found and fixed two critical flaws (see the security review). That is not a substitute for a professional external audit, which has not been done.

Team powers​

Nobody, the team included, can withdraw or redirect the reward reserve: it sits in the distributor, whose only exit is paying bond rewards.

Several settings do stay in the deploying key's hands for the life of the protocol, and the architecture page spells out exactly what each one can and cannot do. In short: the emergency stop pauses claiming and compounding but moves nothing; the transfer lock can close bond transfers again after opening them; the retention dial can only ever make exiting cheaper than the 10% cap, never dearer; the rate grant and the rate floor can both raise what every bond pays, and take that raise back. None of them touches principal, balances or ownership, and none can push a position below the rate it already earned.

The one to weigh is the rate grant. It is not capped: it sits on top of the 20%/day ceiling rather than inside it. Two things follow, and both are yours to judge. A rate above 20%/day is a setting, not a promise the code makes; and because a higher rate pays out of the same finite reserve, a grant brings the day the pool runs dry closer. What the code still guarantees is the direction: the grant only ever adds, your stored rate never falls, and nothing can take a position below the rate it earned or make exiting cost more than the 10% cap allows.

The creator address receives the tax and is immutable. It must be able to receive ETH: a creator contract that rejects ETH would block trading.

Market and mechanical risks​

  • The launch price is read from the pool; a large trade moves it.
  • Whales can split sells to spread the friction.
  • Liquidity is thin at launch by design, so early trades move the price sharply.
  • The token has a fixed supply and no mint, but a large share of it sits in the reserve and will reach the market over time.

What "bond" means here​

The word is associated with a category of 2021 protocols that mostly collapsed. Covenant does not mint tokens to pay rewards — it cannot, the supply is fixed — but it does redistribute a finite pool. Judge it on the numbers above, not on the label.