> For the complete documentation index, see [llms.txt](https://specs.enzyme.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://specs.enzyme.finance/topics/known-risks-and-mitigations.md).

# Known Risks & Mitigations

Fund owners are fully-trusted.

Migrators (assigned by the fund owner) are also fully-trusted since they can arbitrarily change all fund configuration.

Asset managers (assigned by the fund owner) are also fully-trusted. See End users.

All three of these roles can drain funds by default.

Beyond those, the primary risk category (not including griefing) in terms of the behavior of various actors is:

* Opportunistic investors

Different fund setups will have different levels of trust for investors.

E.g., a DAO treasury might only have a single investor who is ostensibly the same entity as the owner. Or, it might be a public fund with completely anonymous and untrusted investors.

E.g., an individual fund owner might be a well-known party for whom reputation serves as a natural mitigation for investors. Or, they might be completely anonymous and untrusted, in which case investors must assess for themselves whether they trust the fund owner and its asset managers.

In order to not sweepingly apply the strictest risk mitigations to all funds, the protocol is largely unopinionated about what constitutes a "safe" setup, but offers various configuration options and policies to craft bespoke setups that meet particular requirements.

### Opportunistic investors (arbitrage)

Investors can arbitrage temporarily mispriced shares or mispriced assets held by a fund by depositing and/or redeeming from a fund under opportune conditions.

*General mitigations for the below opportunities:*

* A `sharesActionTimelock` config option defines the seconds that must pass between a user's most recent deposit and their next transfer or redemption. Though 1 second is enough to prevent flash and sandwich exploits, the longer the `sharesActionTimelock`, the less of a guarantee that an arbitrage opportunity will remain open at the allowed time of redemption.
* Fees can run when depositing or redeeming shares that (conditionally) deduct an amount of shares, thus increasing their effective share price. E.g., for mitigating deposit arbitrage, funds that wish to use an additional arbitrage protection can use the `EntranceRateBurnFee` , which burns a % of the shares minted during deposit.

#### **Opportunity: mispriced shares due to untracked value during deposit**

There may be value that "belongs" to a fund that is not included in its share price, i.e., "untracked assets" in the `VaultProxy` (e.g., an airdrop) and unclaimed "external rewards" (e.g., accrued `COMP` rewards) (see "Holdings and Shares").

*Extra mitigations*:

* New assets acquired to the VaultProxy via the protocol are automatically added as tracked assets
* Asset managers should track any untracked assets (e.g., via airdrops or publically-callable rewards claiming functions) as quickly as possible
* In the case of accruing external rewards (e.g., `COMP`), asset managers are advised to track any reward token that they expect to earn ASAP, e.g., track `COMP` as soon as you lend or borrow via Compound for the first time.

#### **Opportunity: mispriced shares due to on-chain prices during deposit**

Due to the exclusive use of on-chain asset prices, there may be occasions where there is a deviation between on-chain and off-chain values of assets, and thus also share price.

Though the price feeds used in the protocol should be considered manipulation resistant, there are still occasions where prices are updated via transactions and can therefore be frontrun (e.g., Chainlink aggregator price updates). Furthermore, price updates might only occur when deviation thresholds are crossed (i.e., Chainlink aggregators), and even tight thresholds of <1% in a large enough fund could result in significant arbitrage opportunities.

If share price is "too low" (i.e., the total value of assets according to on-chain, internally-used prices is lower than the total value according to canonical prices), then new investors can deposit and essentially receive a discount.

#### **Opportunity: mispriced assets due to on-chain prices during specific asset redemption**

Similarly, to the extent that internally-used asset values deviate from their canonical values, the `redeemSharesForSpecificAssets()` redemption option can be arbitraged, by withdrawing one or more assets that are priced "too low" relative to other assets in the fund.

Though the use of a `sharesActionTimelock` prevents a user who is yet to hold shares from exercising this arbitrage opportunity, current investors for whom the timelock has expired can redeem at any time.

*Extra mitigations:*

* An exit fee charged only on `FeeHook.RedeemSharesForSpecificAssets` (i.e., not on in-kind redemption) that burns a % of shares being redeemed.