> For the complete documentation index, see [llms.txt](https://onex-3.gitbook.io/onex-document/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://onex-3.gitbook.io/onex-document/risk-factors.md).

# Risk factors

## 18.1 Regulatory Risk

Regulatory environments evolve rapidly. A product that is compliant today may require modification following new guidance.

**Mitigation:** Modular architecture (each jurisdiction's rules in a separate module), licensed partner model (regulatory exposure rests with licensed entities), dedicated legal team across 5+ jurisdictions, geo-adaptive compliance engine (with mandatory legal review before rule deployment).

## 18.2 Smart Contract Risk

Contracts may contain exploitable vulnerabilities despite thorough auditing.

**Mitigation:** Dual independent audits, formal verification (Certora + K Framework), $1M+ bug bounty, time-locked deployment, circuit breakers, insurance fund ($200M coverage across four layers for ONEx Swap, separate coverage for Wallet).

## 18.3 AI Model Risk (including zkML)

AI credit models may exhibit bias, be inaccurate, or be gamed. zkML proofs guarantee computation integrity but do not eliminate model bias.

**Mitigation:** Quarterly bias audits, adversarial debiasing, user appeal mechanism for all credit decisions, model version control with rollback capability, accuracy transparency dashboard.

## 18.4 Quantum Computing Risk

Quantum computers could break current elliptic curve cryptography within 10–15 years (expert consensus range).

**Mitigation:** Hybrid PQC strategy using CRYSTALS-Kyber + CRYSTALS-Dilithium alongside classical cryptography. Proactive key refresh every 30 days. Signature scheme abstraction layer allows migration without redeploying core contracts.

## 18.5 Gradient Inversion Attack Risk

Federated learning gradients can potentially leak individual user data through gradient inversion attacks.

**Mitigation:** Secure Aggregation Protocol (server only sees summed gradients across all users), differential privacy (ε ≤ 1.0 per epoch) with mathematical privacy guarantee, gradient compression, gradient clipping.

## 18.6 Liquidity Risk

Insufficient liquidity during market stress can prevent users from executing transactions at reasonable prices.

**Mitigation:** JIT liquidity model, multiple liquidity sources (20+ DEXs + 10 CEXs aggregated), LP incentive program, dynamic transaction size limits during stress, TWAP oracles prevent manipulation-induced liquidity crises.

## 18.7 Key Management Risk

Loss or compromise of MPC shares could result in loss of access to funds.

**Mitigation:** 2-of-3 CGGMP21 threshold means any single share compromise cannot drain funds. Proactive key refresh every 30 days (old shares become invalid). Multiple recovery paths (device + cloud + guardian). 48-hour recovery delay with guardian notification. HSM-protected server shares (FIPS 140-3 Level 3).

## 18.8 Supply Chain Risk

Malicious code injected via compromised npm packages or build pipeline.

**Mitigation:** Cryptographic package pinning (package-lock.json), SBOM (Software of Bills of Materials) published quarterly, deterministic builds with hash verification, signed release binaries, reproducible build environment.

## 18.9 AI Model Manipulation Risk

Bad actors could attempt to poison the federated learning model by submitting adversarial gradients.

**Mitigation:** Gradient anomaly detection (outlier gradients rejected before aggregation), Byzantine-fault-tolerant aggregation, model versioning with rollback, public model hashes for independent verification.

{% hint style="warning" %}
**Disclaimer:** This risk disclosure is not exhaustive. Participants should conduct their own due diligence and consult qualified legal and financial advisors before making any investment decisions. Past performance of any metric cited in this documentation does not predict future results.
{% endhint %}