Risk disclosure

What can go wrong.

Hourglass removes one risk, being liquidated because of a price move, and keeps every other risk of on-chain lending. This page lists them plainly. Read it before you deposit or borrow.

Last updated · October 2026

Summary

  • You can lose some or all of the funds you put into the protocol.
  • The contracts have had an internal review only. An external audit is pending.
  • The company that issues the stock tokens can pause, block or burn tokens at any address, including the Hourglass contracts. No code can prevent that.
  • Borrowers who miss their date lose their collateral at auction and get back only the surplus.
  • Lenders may wait up to about one term to withdraw, and can take a loss if an auction falls short and the safety module can't cover it.

Smart contracts

Hourglass is software. A bug could lock or lose funds. The contracts are tested (unit tests, fuzzing, regression tests for every review finding) and were reviewed internally on 3 October 2026, but they have not yet been audited by an external firm. Testing and review reduce risk; they do not remove it.

The contracts are not upgradeable in place. A fix would mean deploying new contracts and moving to them.

Stock token issuer

The stock tokens accepted as collateral are issued by a third party, not by Hourglass. The issuer's contracts let it:

  • Block any address from sending or receiving the token. If LoanManager were blocked, all collateral of that token would be frozen and loans against it could neither be repaid in kind nor auctioned.
  • Pause the token or its price. While paused, no new loan, rollover or auction can happen on that asset. Repaying still works, but the collateral can only move once the token is unpaused.
  • Burn tokens from any address (adminBurn).

If your own wallet is blocked, you can still repay and have the collateral sent to another address you choose. If the protocol's contract is blocked, there is nothing the protocol can do on-chain. Debt caps per asset limit how much any single token can affect a vault.

A stock token gives you the economic exposure the issuer describes in its own terms. It is not the share itself and may not carry voting or other shareholder rights.

For borrowers

  • Missing the date. If you don't repay or roll over by the due date plus 24 hours of grace, your whole collateral lot is sold at auction. You pay a 1% late fee and receive the surplus, which may be well below what the shares were worth before the sale (the auction can go down to 70% of oracle value).
  • No price liquidation does not mean no loss. If the stock falls a lot, repaying may cost more than the shares are worth. You are free to walk away, and the collateral will be auctioned.
  • Rollover is not guaranteed. A rollover needs a usable price, a vault with room, and LTV within limits at today's price. If the price has dropped, rates have risen, or new loans are paused, you may need to add collateral, borrow less, or repay.
  • Issuer pause near your date. If the token is paused around your due date you can still repay, but you cannot roll over until it resumes. Auctions can't start while it is paused.
  • Transactions. You need USDG and ETH for gas on the right network before your date. Wallet, RPC or network problems on the day are your risk; repay early if in doubt.

For lenders

  • Withdrawal waits. When most USDG is lent out you join a queue and are paid as loans repay. The usual wait is at most about one term, but loans that go to auction, issuer pauses or a blocked asset can make it longer.
  • Bad debt. If a stock gaps down past its LTV and the borrower walks away, the auction may not cover the loan. The USDG reserve pays first, then slashed GLASS. Anything left is a loss to the vault, shared by all depositors.
  • Variable yield. Each loan's rate is fixed, but the vault's yield changes with how much is lent out and at what rates. Past yield says nothing about future yield.
  • Concentration. Up to 20% of a vault can be lent against a single asset, and every asset depends on the same issuer.
  • Share price drops. When a loan's collateral falls below its debt ÷ 85%, an expected loss is taken out of the share price before anything is final. It is put back if the price recovers.

For $GLASS stakers

  • Up to 30% of all staked GLASS can be slashed for each shortfall event the reserve can't cover. Several events can each open a new budget.
  • Unstaking takes a 10-day cooldown and must happen in the 2-day window after it. Staked GLASS can't be sold during that time.
  • Rewards are a share of real fees in USDG. If there are few loans, there are few rewards.
  • GLASS trades on open markets and its price can fall to zero. Hourglass makes no statement about its value.

Oracle & chain

  • Oracle. Prices come from Chainlink. A wrong price could let a loan open at too high a value or an auction sell too cheaply. Price age, market hours and issuer flags are checked, but the price itself is trusted.
  • Weekend gaps. Stock tokens can trade while the US market is closed, but Hourglass uses the last official price until it reopens. Loans opened on a weekend get less LTV for this reason.
  • Sequencer. Robinhood Chain is a rollup with a single sequencer and no Chainlink uptime feed yet. If the chain stops, borrowers may be unable to repay during grace. The guardian can delay auctions by up to 7 days at a time in that case, but only if it acts.
  • Bridges and wallets. Moving assets to and from Robinhood Chain uses services Hourglass does not control.

Keepers & operators

  • Auctions, withdrawal queues and fee distributions need someone to send a transaction. The protocol runs a keeper, and anyone else can call the same functions. If no one does, things are delayed, not lost.
  • If no one checkpoints an auction during a short token pause, that time still counts on the auction clock, which can lower the sale price.
  • The GLASS buyback and the sale of slashed GLASS are carried out by an operator address, not by the contracts. These transactions are public but depend on the operator acting honestly and on time.

Governance

The admin can, after a 48-hour public delay, change listings, LTVs, rate bands, caps, fees (within hard limits) and addresses. These changes never alter open loans, but they do affect new loans and the future of the vaults. The guardian can pause new loans immediately. Both are multisig wallets controlled by the team. You should watch the timelock if you hold large positions.

USDG

Loans, deposits and rewards are in USDG, a stablecoin issued by a third party. Hourglass values USDG at exactly $1. If USDG lost its peg or was frozen, every position in the protocol would be affected.