risks & limitations

This page is written to be read before you form an expectation about what coverage is worth. It is not a disclaimer appended to a sales page; the limitations below are structural.

Coverage is not guaranteed

There is no promise that any particular loss will be settled, or settled in full. Coverage is the output of a mechanical process, and each stage of that process can produce nothing: detection can miss an event, a declaration can be successfully challenged, an address can fail an eligibility condition, and the reserve can be too small.

Treat coverage as a possibility that improves your position, not as a floor under it.

The reserve is finite

The reserve holds what fees have put into it, less what has been settled out of it. There is no facility behind it and no underwriter.

Two consequences follow.

A large event settles at a fraction. The per-event bound of 10% of the reserve means a severe event across many holders produces small individual settlements. The worked example in Claims & Settlement shows a verified loss of 250 USDC settling at 100 USDC — and that is with the reserve at full strength.

Events compete. Settlements draw the reserve down. An event that follows shortly after a large one is bounded by a smaller balance.

Detection can fail

Detection is threshold-based and the thresholds are a compromise. Specific ways it fails:

Novel mechanisms. An action that harms holders without crossing any tracked measure produces no declaration. The four categories describe what has been seen, not everything that is possible.

Events under the threshold. A withdrawal executed in many small steps, or a tax raised gradually, may never cross a threshold while still leaving holders unable to exit.

Calibration error. Thresholds are set per token against its own history. A token whose history is short or unusual can be calibrated badly in either direction — missing real events, or declaring on ordinary volatility.

Infrastructure failure. Monitoring is off-chain infrastructure. If it is down, events during the outage are not detected in time for the event block to be recorded accurately.

Verification can be wrong in both directions

A declaration can be made on an event that, on closer reading, does not qualify — and if it is not successfully challenged within the dispute window, it will be settled. A genuine event can be voided by a challenge that the evidence appeared to support.

The dispute window is one hour in the draft parameters. That is short enough to keep settlement fast and short enough that a challenge may not be filed in time.

Parameters can change

Holding period, per-event cap, dispute window and fee allocation are draft and subject to change. A change alters what coverage is worth for positions already held. Changes will be published before they take effect, but they are not frozen.

Smart contract risk

HERA is software holding a balance. It carries the risks all such software carries: implementation bugs, upgrade mistakes, dependency failures in the tokens and pools it reads, and failures in the chain itself. Audits reduce this risk; they do not remove it.

Eligibility excludes people who feel they should be covered

The conditions in Eligibility are strict by design, and they will exclude holders who took a real loss: someone who bought eleven hours before an event, someone who averaged down during one, someone whose address is linked to a deployer through a funding path they did not think about.

These exclusions are not oversights. Each one closes an abuse that would otherwise let the reserve be drained by the people it is meant to protect against. The cost is that the rules are sometimes unkind to honest holders.

What HERA is, stated plainly

A transparent, finite reserve, drawn on according to published rules, for a narrow class of observable events. It is a meaningful improvement on having nothing. It is not protection in the sense of a guarantee, and nothing on this site should be read as offering one.