> For the complete documentation index, see [llms.txt](https://docs.elara.fi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elara.fi/risk-and-security/risk-management.md).

# Risk Framework

Risk controls sit at the Engine level. Allocation caps, drawdown limits and concentration rules are enforced before capital reaches an execution partner.

**Collateral and depeg risk.** This is the largest single exposure. All positions are stablecoin-denominated, so directional market risk is not the concern; issuer and depeg risk across the accepted basket is. ELUSD is backed by USDC, USDT and USDe. Diversifying across issuers protects against any single issuer failing, and simultaneously means the system carries independent depeg exposure to each of them. USDe is a synthetic dollar rather than a fiat-backed stablecoin and carries a materially different risk profile from USDC and USDT. Mitigation is active: the execution partner applies a stablecoin rating framework, concentration is managed, and positions can be unwound ahead of a dislocation. The Vault's price cap and floor prevent a depeg being arbitraged against the system, but they do not protect against a backing asset losing value permanently.

**Strategy risk.** The strategies generating yield can lose money. Concentrated liquidity positions earn well because they are narrow, and narrow ranges are exposed when an asset moves out of range. They operate with conservative guardrails and stop-losses, in live markets. Diversification across strategies and venues is the primary mitigation.

**Smart contract risk.** Contracts can contain defects. Elara uses staged rollouts, internal code review and third-party audit (Sherlock) to reduce this surface. Oracle price validation provides an additional layer at mint and redeem. There is no active bug bounty programme and no live post-audit coverage at present.

**Counterparty risk.** Execution partners hold and trade with allocated capital. Assets remain within the Utila vault infrastructure and partners operate within the applicable multisig and transaction policies, but the risk does not disappear. Future partners go through diligence before onboarding.

**Liquidity risk.** Instant access is limited to the buffer, which targets roughly 10% of total assets. Beyond it, redemptions are queued and settled as liquidity becomes available. There is no external DEX liquidity today, so redemption is the only exit. The buffer and gating design exists to prevent fire-sale liquidation, which means redemption is deliberately not unconditional.

**Administrative risk.** Administrative actions execute immediately. There is no protocol-wide timelock; the AccessManager delay mechanism exists but is currently set to zero. Contract administrators can change collateral configuration, fees, oracle sources and NAV composition. A pause operator can halt the Vault, ELUSD, sELUSD and staking, and ELUSD addresses can be blocklisted. All of these require multisig quorum and no single key can act alone, but they take effect without delay or notice.

**Oracle risk.** Pricing depends on the configured feed. If it goes stale or unavailable, `getPrice` reverts and minting and redeeming halt for that token until it recovers. The system fails closed rather than transacting on an unreliable price, which protects solvency at the cost of availability.

{% hint style="warning" %}
Elara does not guarantee any specific rate of return. There is no government backstop and no deposit insurance. While all positions are denominated in stablecoins and carry no directional market exposure, the trading and market-making strategies that generate yield involve execution risk, smart contract risk, and counterparty risk. Returns are a function of market conditions and execution quality.
{% endhint %}

**Who bears losses**

Strategy and NAV losses are borne by **sELUSD holders**. There is no reserve fund and no junior tranche. Nobody absorbs a loss before sELUSD does.

Mechanically, the daily NAV sync mints ELUSD into the staking pool when yield is positive and burns ELUSD from it when the result is negative, lowering the sELUSD share price for all holders.

Holders of unstaked ELUSD do not earn, and in normal conditions they are not affected by NAV movement. That is the trade, but it is not a ring-fence.

The daily sync absorbs a negative result by burning ELUSD from the staking pool, so the protection available to unstaked ELUSD is only as deep as the ELUSD sitting in that pool, which is the yield earned since launch. Where cumulative losses exceed that, there is nothing left to burn, and the loss reaches the collateral backing unstaked ELUSD. At that point ELUSD is undercollateralised.

sELUSD is a first-loss layer, not a ring-fence.