Isolation prevents a trader from withdrawing borrowed assets. It does not make lender principal guaranteed. Price gaps, malicious tokens, oracle manipulation, vanishing liquidity, keeper failure, contract defects, and compromised governance can all create losses larger than trader collateral.
Never market JuiceGram as risk-free, guaranteed APY, principal-protected, or unsecured leverage.
| Threat | Repository control |
|---|---|
| Forged Mini App identity | Telegram HMAC validation, auth-date expiry |
| SIWE replay or cross-user binding | Stored one-time nonce, exact message match, Telegram resource, expiry |
| Bot Wallet database disclosure | AES-256-GCM ciphertext with per-wallet random IV and identity/chain/address AAD |
| Bot Wallet action replay | Expiring PostgreSQL action, atomic pending-to-processing claim, Telegram update deduplication |
| Bot Wallet key substitution | Decrypted private key is checked against the stored address before every signing session |
| Bot Wallet nonce collision | PostgreSQL advisory lock serializes writes for each Telegram user and chain |
| Mainnet key custody | Chain 56 refuses the local AES provider; this testnet release has no enabled mainnet signer |
| Optional external-wallet replay | Stored one-time SIWE nonce, exact message match, Telegram resource, expiry |
| Misreported transaction | Sender, target, and decoded function validation before recording |
| Borrowed-fund withdrawal | Manager holds and swaps credit; no trader transfer path |
| Borrow or concentration spike | Vault cash, cap, utilization, leverage, and position-size checks |
| Oracle stale or invalid | Chainlink round validation, adapter max age, manager max age |
| TWAP manipulation | Configurable window, harmonic-mean window liquidity, spot/TWAP divergence breaker |
| Active-market reconfiguration | Token and fee tier cannot change while a market has open positions; liquidation bonus is snapshotted |
| Reentrancy or lingering approval | Reentrancy guards, safe transfers, exact router approval reset to zero |
| Keeper monopoly | Permissionless liquidation; keeper has no privileged role |
| Single keeper outage | Mainnet readiness requires two distinct, fresh keeper signer heartbeats |
| Organizer steals pooled funds | Group organizer has no withdrawal or arbitrary-call path |
| Sandwich on aggregate buy | Role-restricted executor, private builder RPC, oracle-derived minimum output |
| Failed or abandoned group | Permissionless cancellation and exact per-user asset refunds |
| Referral pyramid | One level only; immutable fee snapshot; combined group fees capped at 200 bps |
| Webhook retry | Durable update state with retry lease and processed state |
| Admin key compromise | Delayed default-admin transfer, Safe-oriented governance, guardian role |
| Hidden bad debt | Explicit settlement and cumulativeBadDebt accounting |
| Bank-run promise | ERC-4626 withdrawal limit capped by current vault cash |
- A market token may implement blacklist, fee-on-transfer, rebasing, callback, or upgrade behavior that makes swap output or custody unsafe.
- TWAPs can be manipulated when liquidity and observation history are inadequate.
- Spot/TWAP divergence can fail closed and cause liquidation downtime.
- Chainlink or the lending-asset peg may fail.
- A price gap can cross the maintenance threshold before any transaction lands.
- BNB Chain congestion, reorgs, RPC censorship, or gas exhaustion can delay keepers.
- PancakeSwap routing liquidity can disappear between oracle observation and swap.
- Governance can configure unsafe parameters or a malicious token, oracle, or router through a new deployment.
- Bad debt socializes loss to vault shares.
- A private RPC reduces public-mempool exposure but cannot guarantee inclusion, confidentiality after settlement, or freedom from builder/validator misconduct.
- SIWE and Telegram binding proves key control, not legal identity or suitability.
- Bot Wallet is custodial hot-wallet infrastructure. API, runtime, master-key, deployment-account, database, Telegram-account, device, or operator compromise can cause loss. Telegram message deletion cannot undo screenshots or notification previews of an exported key.
- Two independent audits of all production contract bytecode and deployment args.
- Public bug bounty before unrestricted deposits.
- A reviewed KMS/HSM signer with non-exportable mainnet keys, authenticated encryption context, rotation, least-privilege IAM, dual-control recovery, and signing/audit alerts. The chain-97 local AES provider must not be promoted.
- Safe multisig with documented signers and a nonzero admin delay.
- At least two independent keeper operators and a third-party liquidation path.
- Per-market simulation for volatility gaps, liquidity withdrawal, reorgs, stale feeds, token tax changes, and failed swaps.
- RPC diversity and alerts for confirmation lag, cursor lag, stale feeds, keeper balance, utilization, bad debt, and pause events.
- Disabled-by-default markets and low initial global/market caps.
- Legal, sanctions, jurisdiction, lending, leverage, promotion, and KOL review.
- Explicit prohibition on wash trading, fake volume, pump coordination, and multi-level referral compensation.
- Published incident contacts, pause authority, recovery decision tree, and user notification templates.
- Contract unit tests and property/invariant suites pass.
- PostgreSQL migrations are tested on an empty and upgraded database.
- Wallet binding is tested with EOA and Safe/ERC-1271 accounts.
- Mainnet-fork swaps cover every proposed token, fee tier, and oracle adapter.
- Vault, manager, group-buy, and oracle bytecode verified on the explorer.
- Governance transfer accepted by the Safe; deployer privileges removed.
- Keeper chaos, RPC failover, stale oracle, and reorg drills completed.
- Deposit, open, close, withdraw, bad-debt, group execution, pro-rata claims, referral rewards, and full refunds reconciled against events.
- Bot Wallet create, restart recovery, wrong-key failure, Buy, Credit, Sell, withdrawal, duplicate confirmation, concurrent action, and key-export drills completed only with faucet assets.
- Independent audits and remediation reports published.
- Bug bounty active.
- Signed BNB testnet rehearsal evidence matches
TESTNET_REHEARSAL_SHA256. - Deposit, debt, position, and market caps set to deliberately small values.
- Only deeply tested markets enabled.
- Access is jurisdiction-restricted according to legal advice.
- A human on-call can pause new risk without gaining withdrawal authority.
- Caps increase only from observed execution and liquidation evidence.
- LP reporting separates realized borrow income, fees, incentives, bad debt, and immediately withdrawable cash.
- New meme markets start disabled, then progress through small isolated caps.
The repository passing tests is necessary but not sufficient for any mainnet gate.