Skip to main content

Known risks

This page exists so that nothing on this site is a surprise later.

The reward pool is finite and will run out​

Rewards come from a reserve of 20% of the supply plus the tokens committed by participants. No trading fee funds them. The reserve is finite and nothing refills it.

Be clear about the speed: at a 10%/day base and up to 20%/day effective, the reserve depletes far faster than it would under small rates. Payouts are first come, first served and stop when the pool is empty. No duration is published because none would be honest — how long it lasts depends on how much is committed and how often people harvest. The number that matters is the remaining reserve the app displays.

In aggregate, bond holders collect their own deposits back plus the reserve — no more. Early bonds are partly paid with the deposits of later ones. Whoever arrives last collects least.

A bond's principal is never returned​

principal is the basis used to compute rewards, not a balance. Committed tokens join the reward pool and are paid back out to bond holders generally — not reserved for you.

Exiting costs 22.4% — without a commit bond​

3% tax plus 19.4% into a bond. You are paid, in ETH, for 77.6% of what you sell. During the launch window the tax is higher, so the total is larger.

A sale that fits inside the seller's exemption allowance pays the 3% tax only — no retention, no new bond. Two things temper the discount: the allowance is finite (five times the commit principal, cumulative for life, after which the full 20% returns), and the sell itself permanently strips the +5 boost from every commit bond the wallet holds.

Stated plainly, this is a deliberate transfer: exempt sales route nothing to the reward pool, so committed sellers stop feeding it. The exposure is bounded — total exempt volume can never exceed five times what was actually committed — but it does mean the pool is fed mainly by uncommitted sellers.

A contract that calls the router on behalf of several users is, as far as the hook can tell, the seller. An operator who commits tokens can therefore spend its own allowance on behalf of the people it routes — retention-free selling, financed by capital it has locked away for good and capped at five times that amount. Nobody can spend an allowance that is not theirs, and the total stays bounded, but the allowance is shareable in that specific sense.

Spending an allowance requires the wallet to be visibly the one selling: either the sale came through the official app, or the CVN sold left that wallet in the same transaction. That closes the obvious abuse — naming a stranger's wallet, or merely sharing a transaction with them — but one gap remains and is worth knowing. A contract you route a sale through is inside a transaction where you really are moving CVN, so it can aim that movement at a sale of its own and spend that much of your allowance. It is bounded to what you moved, since the proof is spent rather than reusable, and any contract you have already approved for your tokens can take them outright, which is worse. The ordinary rule applies: do not route through contracts you do not trust.

The limit in the other direction: a route that pays the pool straight out of the seller's wallet at the very end of the swap has moved nothing at the moment the hook decides, so that sale pays the full retention even with allowance left. Routes that take the tokens first — the app's own router, and the usual aggregator shape — are unaffected.

Rewards are paid in tokens, so converting them to ETH pays an exit cost again.

The code is not externally audited​

An internal audit in July–August 2026 found and fixed two critical flaws (see the security review). That is not a substitute for a professional external audit, which has not been done.

Operator powers​

The operator can decide when reserve tranches move to the distributor, and can stop releasing them. They cannot redirect them: the destination is frozen before any token can move, and the vault has no other exit.

The creator address receives the tax and is immutable. It must be able to receive ETH — a creator contract that rejects ETH would block trading.

Market and mechanical risks​

  • The launch price is read from the pool; a large trade moves it.
  • Whales can split sells to spread the friction.
  • Liquidity is thin at launch by design, so early trades move the price sharply.
  • The token has a fixed supply and no mint, but a large share of it sits in the reserve and will reach the market over time.

What "bond" means here​

The word is associated with a category of 2021 protocols that mostly collapsed. Covenant does not mint tokens to pay rewards — it cannot, the supply is fixed — but it does redistribute a finite pool. Judge it on the numbers above, not on the label.