Risks

Last updated: 2026-05-08

Read this in full before considering any future interaction with the Onepot smart contract. Any interaction may result in the total loss of your funds. The contract is experimental software released as a public good. There is no entity, fund, or insurance that will compensate you for losses.

1. Smart contract risk

The Onepot smart contract is experimental code that has not been audited by a professional security audit firm. Two informal reviews have been performed (automated security tooling and an AI-assisted scenario-focused review). These are not a substitute for a professional audit. The contract may contain undiscovered bugs, vulnerabilities, or design flaws that result in partial or total loss of deposited funds.

2. Dependency risk

The contract relies on two external protocols. A failure, exploit, governance attack, or unilateral change in either protocol may cause partial or total loss of funds in the Onepot contract.

Aave V3 — depositors' principal is supplied to Aave and held as aUSDC. Risks include Aave smart contract exploits, aUSDC depeg, oracle failures, governance attacks, and Aave protocol pause.
Megapot — yield is used to acquire Megapot prize draw entries. Risks include Megapot smart contract exploits, Megapot operational failure, manipulation of the random number source, drawing rollover ambiguities, and unilateral changes by the Megapot operator.

3. Asset risk

USDC is a centrally-issued stablecoin. Its issuer (Circle) may freeze, blacklist, or seize addresses, including the contract's address or your address. USDC may also depeg from the US dollar. These events are outside the contributors' control.

4. Admin risk during the operational phase

Before the contract's admin keys are renounced, an admin (initially a multisig) holds a narrow set of powers. These powers cannot move user funds, but a compromise, mistake, or bad-faith action could pause the contract, mis-confirm a prize draw outcome, or trigger a permanent emergency exit (which keeps withdrawals open but disables the daily cycle). After admin renouncement, no party can intervene in the contract's operation, including in cases where intervention might benefit users.

5. Liquidity and exit risk

Withdrawals depend on Aave honoring the withdrawal call. If Aave is paused, undergoing depeg, or otherwise unavailable, withdrawals may revert. A separate emergency exit path accepts a partial amount returned by Aave, but if Aave reverts entirely, funds may not be retrievable on-chain until Aave recovers.

6. Prize draw outcome risk

Prize draw outcomes depend on the Megapot drawing mechanism, which is outside the contributors' control. Past outcomes do not predict future outcomes. The contract's on-chain outcome detection is partly heuristic; in edge cases it may misattribute or miss a payout.

7. Tax and regulatory risk

The legal and tax treatment of any future interaction with the contract is your sole responsibility. Interaction may be illegal in your jurisdiction. Regulatory authorities in your jurisdiction may classify the activity as gambling, securities, payment services, or other regulated activity, exposing you to penalties, taxes, or criminal liability. The contributors do not provide tax or legal advice.

8. Frontend risk

The reference frontend at this domain is provided as informational software. It is not the contract; it is one possible interface to the contract. Frontends may be unavailable, compromised, or display inaccurate information. Anyone may fork the source and host their own frontend. The contributors are not responsible for any third-party frontend, fork, or modification.

9. Phishing and impersonation risk

Be cautious of any party impersonating Onepot or its contributors. The only canonical sources are the GitHub repositories at github.com/0xStarny/Onepot-app and github.com/0xStarny/Onepot-Web-app---good. Always verify the smart contract address against the canonical repository before any interaction. The contributors will never ask for your seed phrase, private key, or to send funds to a personal address.

10. No insurance, no recourse

There is no fund, insurance, treasury, or contributor obligation to compensate any user for any loss. The contract is provided as-is under the MIT License. By interacting with the contract, you accept that you have no recourse against the contributors for any loss.

11. The acknowledgment you will sign before depositing

Once the contract is live, depositing requires a single off-chain wallet signature (free, no gas) over the canonical text below. Your signature is then attached to the same on-chain transaction as your deposit, as a permanent verifiable proof that you read and accepted these terms before depositing. There is no path through the contract to deposit without signing this acknowledgment.

The exact text the wallet will display:

Wallet:    0xYOUR_WALLET_ADDRESS
Timestamp: 2026-XX-XXTXX:XX:XXZ
Site rev:  abcdef1
Contract:  0xONEPOT_VAULT_ADDRESS
Network:   base-mainnet (chainId 8453)

This is a free off-chain signature — no gas, no transaction.
By signing, you confirm the acknowledgments below. The signature is recorded
on-chain together with your deposit transaction, as permanent, publicly
verifiable proof.

Please read carefully before signing.

──────────────────────────────────────────────

Onepot — Risk acknowledgment

I, the owner of the wallet above, acknowledge:
- Onepot is experimental open-source software, not audited by a professional security firm.
- I may lose all funds I deposit. Total loss is possible.
- Onepot is software, not a financial product, not a lottery, not an investment.
- The prize draws are operated by Megapot, an independent third party.
- I am responsible for compliance with my own jurisdiction's laws and tax obligations.
- I have read the Risks page and the Terms of Use.
- I am not currently located in, and not a resident of, a restricted jurisdiction
  (United States, France, United Kingdom).
- No fiduciary, advisory, custodial, or contractual relationship is created between me
  and the Onepot contributors by my interaction with this contract.

The canonical machine-readable specification of this text lives in docs/ACKNOWLEDGMENT_MESSAGE.md of the smart contract repository.

If after reading this page you believe you do not understand or cannot accept these risks, do not interact with the Onepot smart contract. See also the Terms, About, and Privacy pages.