Skip to main content
A threat model is not the same as a list of risks. Risks are what can happen to participants in the game (see Risks). A threat model is what attackers might try against the contracts, and what the contracts do to refuse them.The pipeline assumes attackers are adversarial, well-funded, and patient. The defenses below are not “we trust people not to do this” — they are enforced at the contract level, with Foundry invariant tests proving they hold.

​
Adversaries

​
Why these seven

These are the categories of attack the contracts are designed to refuse — each one has named code paths and named tests. It is not a complete enumeration of every possible attack on a smart-contract system. It is the set the team has modeled explicitly and built defenses for.If you find an attack that doesn’t fit one of these seven categories, that’s exactly the kind of finding the voluntary disclosure window exists to surface.

​
What this model does NOT cover

  • Off-chain trust assumptions — the indexer, oracle, scheduler, and web app are out of scope for this on-chain threat model. Their failure modes matter, but they are not what the settlement contracts defend against.
  • Economic attacks at the game-design layer — wash trading, reflexive HP feedback loops, coordinated whale strategies. These are game-theory questions covered by HP component design, not the contract threat model.
  • Third-party dependencies — Uniswap V4 PoolManager, WETH9. filter.fun inherits their threat models without re-stating them here.