Security and risks

Design choices

• No admin path to user funds. There is no withdraw, no sweep, no pause, no emergency function. The owner can change the fee within the cap, the treasury and the two waiver values. That is the complete list.
• No upgrade path. No proxy, no delegatecall, no initializer. The code at the address today is the code forever.
• Checks, effects, interactions. Every state write happens before the token transfer that follows it, and a hand-written guard blocks reentry into contribute, release and refund.
• Pull refunds. No function iterates over contributors, so no pot can become too expensive to unwind.
• Balance-delta accounting. Contributions credit what arrived, not what was asked for, so a fee-on-transfer token cannot leave the contract owing more than it holds.
• SafeERC20 everywhere. Tokens that return nothing instead of a boolean are handled correctly.

Tests

62 Foundry tests, all green before deployment, plus an end to end script that runs the whole lifecycle against a local anvil chain. The suite covers solo versus shared, the deadline second itself, exact-target release, overshoot, partial refunds across several contributors, double release, refund after release, wrong callers on every guarded function, 6 decimal and 18 decimal assets, the waiver on and off, a fee-on-transfer token, a token that reverts on balanceOf, three reentrancy attacks through a malicious ERC-20, and three fuzz tests over amounts, contributor counts and fee settings.

git clone https://github.com/sachouliax/cairn
cd cairn/contracts && forge test
./script/e2e-local.sh

What can go wrong

• Price. A pot denominated in a stock token is worth whatever that token is worth on the day it is released. Cairn holds tokens, it does not protect their value.
• The asset itself. You are trusting the ERC-20 you picked. If a token can freeze balances, blocklist addresses or change supply, that behaviour applies inside the pot too.
• A goal that is never met. Your money sits in the contract until the deadline, then you refund it. Pick deadlines you can live with.
• The beneficiary.Release pays the address recorded at creation. Check it before you contribute to somebody else's pot, because it cannot be changed afterwards and contributions cannot be withdrawn early.
• Your keys. A share is recorded against an address. Lose the address, lose the refund.
• Timestamps. Deadlines use block time, which a sequencer can nudge by a few seconds. Do not build anything that depends on the exact second.

Not audited

Cairn has not been audited by a third party. It is a small contract with a large test suite and no upgrade path, deployed as is by one person. The source is verified on Blockscout, so you can read exactly what is running before you send anything to it. Do not put in more than you are willing to lose to a bug.

Not affiliated with Robinhood Markets, Inc. Tokenized equities carry risk. Nothing here is investment advice.