Risks and security

In one paragraph: Trion V2 is a derivatives system whose prices come from outside data, whose fills come from other users, and whose code has been reviewed internally but not independently audited. It is live on Robinhood Chain (4663) with USDG collateral: CMPT capped options from the activation time on the status page, traded on the desk at app.trion.market. This page lists what can go wrong, in the order you are most likely to meet it, so that no later page can be read as a promise of safety. The eleven plain-language disclosures are in Risk disclosures; this page adds the mechanism behind each.

Deployment status, stated plainly

• The shared V2 stack and the CMPT modules are deployed and verified on chain 4663; the option stack activates at the time listed on the status page. Only CMPT exists; the CMPT perpetual is deployed but not listed. The status page is the single list of what is live.
• The collateral is USDG (0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168, six decimals). It is a stablecoin with its own issuer and peg risk that Trion does not control. Older release prose called the collateral USDC; that was a documentation error, not a second supported token.
• The manifest the matcher, oracle and desk load is verified against the chain's genesis hash and an anchor block on every load; a manifest copied to another chain, or edited by hand, fails closed. The desk refuses any chain other than the one its verified manifest and the matcher agree on.
• The release notes (docs/RELEASE_V2.md §6) carry a register of fourteen internal review findings (REG-01…REG-14), several rated critical (signature replay in strategy execution, reservation clearing, worker-pool crash recovery, batch-revert rollback). Remediation code exists against many of them, but no third-pass closure review has signed any of them off. Do not read the old rows as "all still open", and do not read a later change message as "all fixed".
• Internal reviews and passing test flows are not an audit. No third-party audit report exists.

Price and source risks

• Freshness. DRAM and NAND sources update daily; a stale day is a stale price. The system halts rather than guesses, which means you may be unable to trade or withdraw with a position exactly when you want to.
• Trust. Two of three committee signers can publish any index that both can reproduce from their own observation databases. Each signer service holds one key, refuses to sign what it cannot recompute, refuses to sign two different payloads for the same sequence, and refuses sources without a licensing approval on file; that limits a single compromised signer or a dishonest coordinator, not two colluding signers. Source membership is governed, not open.
• Gaps. A move above 3% in one step halts the market. When trading resumes, it resumes at the new real index; there is no staircase of intermediate prices. A 50% gap lands on positions in full.
• Discontinuity in options. Strictly after expiry plus 72 hours with no fixing, permissionless severing uses a fresh, compatible positive NORMAL mark or, if that mark is unusable and the market is not HALTED, the maximum spread payout. HALTED blocks severing. A late fixing or the gated governance fallback can resolve the series; this fallback is not the historical expiry fixing.

Liquidity and counterparty risks

• Every fill needs a counterparty. On the V3 options book, Trion's own market maker quotes as an ordinary participant and may withdraw at any time; there is no obligation to quote and no house guarantee of an exit. On the perp design every fill, including liquidation fills, needs another user's order, and slow mode after 4 hours still needs real signed counterparties. Empty book means no exit.
• Adverse selection. Resting orders get hit when they are wrong. Rebates and DLMM fees reduce, not remove, this; a V3 resting order pays no fee and earns nothing for being stale.
• Backstop is only what was deposited. The backstop vault is finite and may be zero at launch. An unfunded vault provides no protection. After it is exhausted, profitable traders are auto-deleveraged, and a residual deficit is declared rather than covered.

Contract and software risks

• Contracts are non-upgradeable by design; a bug cannot be patched in place, only replaced with a new deployment and a user-authorized migration.
• The perp matcher and the V3 options book service are single-writer services operated by Trion. If one is down or censoring, you can still cancel or hard-revoke orders (cancelOrder, advanceEpoch) and withdraw free balances directly on chain, but you cannot trade or close positions until it returns. V3 fills are settled by Trion's matcher key; the contract lets that key execute only fills that respect each signed order's price, quantity, expiry, epoch and cancel state, and it can never move cash without a matching signed order.
• Signed orders are standing authorizations until expiry, cancel or revocation. Closing a browser does not cancel them.
• The desk refuses, rather than guesses, when the chain is wrong: the deployment getters in v2-config.ts throw for any chain id without a verified manifest, and every signing or sending helper re-checks the matcher's configured chain, the wallet state and a fresh eth_chainId before acting, without switching networks automatically. This is a browser-side guard; a modified or third-party client is not bound by it.
• Governance is a single address (0xc37e…e17c in the verified manifest), not yet a multisig with a timelock. Governance and all five fixing-council seats are Trion-held at launch. For the V2 series governance must also disable the market at the 24 h trading cutoff before each expiry; a missed action is an operational risk. On V3 the cutoff is enforced by the contract, and governance can list series, set fees, set deposit caps, pause deposits and fills, halt a series and withdraw accrued fees. No governance function debits or withdraws trader cash, but governance sets fees within each order's signed maxFeeBps and, only in the governanceSettle fallback (72 h after expiry while the oracle is HALTED), chooses the settlement price that decides how collateral moves between shorts and longs.

Network and governance risks

• Batch inclusion depends on the chain; a 100 ms flush target is not a confirmation guarantee. Reorgs roll back confirmed-looking fills and the engine replays. No confirmation-depth policy has been set from real chain evidence.
• Public RPC endpoints are not private; front-running of your revocation or withdrawal is not ruled out.
• Governance can halt markets, rotate signers and manage configuration within contract gates. It cannot rewrite terminal claims or withdraw reserved sleeve cash. OptionEngineV2.governanceSettle permits a discretionary price only for an unfinalized series strictly after expiry plus 72 hours, with no existing fixing and a HALTED oracle. A 3-of-5 council plus governance can set any X within the option caps through a bonded correction. These are governance trust assumptions for buyers and writers, not independent price evidence.

What you should assume

Reporting problems

No public bug-bounty programme or dedicated security contact is documented in this repository yet; the benchmark statement records the bonded fixing challenge as the formal dispute route and a non-bonded complaints channel as work in progress. Do not send funds to any address claiming to be a Trion support or recovery address.

Source trail: docs/spec/V2_ARCHITECTURE.md §1.2, §2.1, §2.4, §3.6, §4.4, §5.4, §6.1; docs/RELEASE_V2.md §6 (REG-01..REG-14); overdrive/deployments/v2/4663.json (governance, quote, verification anchors); overdrive/exchange/web/src/v2-config.ts (getV2PerpsDeployment, getV2OptionsDeployment), wallet.ts (requireV2Chain); overdrive/exchange/core/src/deployments.ts (parseVerification), v2-bindings.ts; overdrive/exchange/oracle/src/signer.ts, v2-runtime.ts (assertProcessKeySeparation, rightsApproval), publication-evidence.ts (reserveSignature); overdrive/src/v2/options/OptionEngineV2.sol (severSeries, governanceSettle); overdrive/src/v2/FixingCouncilV2.sol.

Repository-owned documentation · September 2026 · Educational material, not investment advice and not an audit.