Risk Disclosure

Everything that can go wrong

In force from 26 August 2026 · Version 1.0

1. What stage this is actually at

2. Smart contract risk

Smart contracts are software that moves value and cannot be patched after deployment. The contracts here are immutable: there is no proxy and no upgrade path. A defect found after deployment is fixed by deploying again at a new address, not by repairing the one in use.

Software of this kind can fail through:

• A logic error that testing did not reach.
• An economic assumption that holds until it does not.
• A dependency behaving differently from its documentation.
• A change in the underlying network.

86 tests pass at 94.4% line coverage across the three contracts, including invariant and fuzz tests. Coverage measures what was executed, not what is correct. It is evidence of care, not evidence of safety.

3. No external audit

No third-party security firm has reviewed this code. An internal review is published, and so is a list of what remains open — including items that are known and deliberately not yet fixed, with the reasoning for each.

docs/KNOWN-ISSUES.md · the internal review

An external audit is budgeted as part of a pre-seed round. That round has not closed, so the audit has not been commissioned and no date is claimed.

4. One key still controls it

5. The Shariah position

A scholar has reviewed the mechanism and given a letter stating that the technology is aligned with Shariah principles. That letter is not a certification and must not be presented as one.

• Formal certification is in progress through AmanX Advisory, follows mainnet, and no date is claimed.
• Whether any particular asset is permissible is a ruling, made by a qualified board — not by this software, and not by its assistant.
• The Majlis assistant explains mechanism and is built to refuse rulings. Its refusals are a design property, not a caveat.
• Scholars differ. A structure one board accepts, another may not.

Take the view of your own Shariah board. Nothing here substitutes for it.

6. This is not an offer of anything

Nothing on this site or in its documentation is an offer, solicitation or invitation to buy or subscribe for any security, token, fund interest, or financial instrument of any kind, in any jurisdiction.

• There is no token. None exists, none is planned for sale, and anyone offering you one is defrauding you.
• There is no fund, no pooled investment and no yield product.
• Material shared with prospective investors is provided privately, to people who qualify under the law that applies to them, and is not this website.

7. Business risk

Stated plainly, because an investor will find each of these anyway:

• No incorporated company. The project is currently one person. An entity will be formed; it does not exist today.
• No revenue. The intended service fee of 5 to 10 basis points is a designed model. It is not written into the contracts — there is no fee rate, no recipient, and no code that takes anything.
• Key person concentration. One person wrote the contracts, the SDK, the applications and this page.
• Letters of intent are not contracts. Four exist. Every one is conditional on the audit and on mainnet, none has produced revenue, and none should be read as a commitment to buy.
• Unproven market. Institutional demand for Shariah-compliant on-chain liquidity routing is a thesis, not a measured fact.

8. Regulatory risk

The regulation of decentralised finance is unsettled and moving. MiCA in the European Union, and the frameworks of the GCC jurisdictions this project is aimed at, may apply to activities like these in ways that are not yet settled and may change again.

No licence or authorisation is held in any jurisdiction. None is currently required for what is offered — an informational site, a non-custodial interface, and published source code — but that assessment could change with the rules, or with what the project later does.

Access may be restricted by jurisdiction in future. You are responsible for whether using this is lawful where you are.

9. Dependencies and technical risk

• Arbitrum — an L2 with its own sequencer, its own failure modes, and its own governance.
• Uniswap V3 — the position manager and router the engine routes through.
• Public RPC endpoints — which can rate-limit, lag, or return stale state.
• Your wallet — whose behaviour and security are not ours.
• Hosting platforms — GitHub Pages and Render, either of which can be unavailable.

TeleportV2 cannot currently be exercised at all: Arbitrum Sepolia hosts no Uniswap V2 deployment for it to route through. It is deployed and verified, and its tests pass against mocks.

10. Forward-looking statements

The roadmap, the stages, the certification path and anything else describing what is intended are statements about the future. They rest on assumptions that may prove wrong, on funding that has not closed, and on decisions by people who have not made them yet.

Nothing here is a promise that any of it will happen, and no date on this site is a commitment.