Risks

The river is old and mostly calm. It isn't safe. This page lists what can go wrong, who carries it, and what limits it.

Cross and stake only what you can afford to have at risk.

At a glance

Risk	Who carries it	What limits it
Pool depth	Travelers wait; stakers wait to unstake	FIFO queue with live ETA; reclaim; queued unstakes paid first
Sequencer liveness	Travelers wait; stakers can take a loss	Reclaim; caps; guardian pause
The ferryman key	Stakers	Per-crossing and hourly caps; guardian pause; exact-match escrow
Late confirmations	Stakers	1-hour reclaim delay; confirmation wins during the delay; losses booked
Canonical bridge and messaging	Stakers, and travelers with waiting deposits	Outside CHARON's control
Challenge period changes	Stakers	Settlement window and vesting are read from contracts
Smart contract bugs	Everyone	No admin withdrawal in the escrow; caps on the pool
Ticker confusion	Anyone trading OBOL	One address, listed on the status page

Pool depth

The exit pool can front only the HYPE it holds idle. HYPE that has been fronted stays on the river until its withdrawal settles, which takes at least the challenge period. So a pool's daily capacity is roughly its size divided by the settlement window in days.

For travelers:

• When idle liquidity can't cover your crossing, it waits in the queue, first in, first out. The ETA counts only idle HYPE and HYPE already on the river. A busy day can push it out to the next settlement.
• You can leave the queue at any time: request a reclaim, wait out the 1-hour delay, and withdraw your full deposit with no toll.
• A crossing larger than the pool's per-crossing cap can't be fronted at all. The escrow's maxCrossing keeps you from boarding one.

For stakers:

• When most of the pool is on the river, unstakes are paid partly now and partly through the unstake queue. Queued unstakes fill from incoming settlements before any new crossing is fronted, so the longest you wait is about one settlement window.
• A shallow pool earns tolls only on the volume it can carry. Tolls follow crossing volume, and there is no fixed return.

Sequencer liveness

Elysium orders transactions through a sequencer. CHARON relies on it in three places.

Deposits. If the sequencer is down or slow, your deposit isn't included until it recovers. Elysium lets transactions be forced in through its delayed inbox on HyperEVM, which takes longer.

Acting on soft confirmation. The ferryman fronts a crossing once the sequencer has included the deposit, before Elysium posts that state to HyperEVM. If the sequencer later drops or reorders a deposit the pool has already paid, the escrow never records the crossing, and the pool carries the loss. The per-crossing and hourly caps bound how much can be exposed at once.

Confirmation delivery. The pool's confirmation reaches the escrow as a parent-to-child message, which the sequencer also includes. If delivery stalls past a traveler's reclaim delay, see the next section.

During an outage the guardian can pause ferrying, and the pause shows on the pool status page. Travelers' deposits stay in the escrow, reclaimable as before.

Late confirmations

Each payout's confirmation has to reach the escrow before the traveler's reclaim delay ends. If a traveler requests a reclaim, the payout goes out, and the confirmation arrives after the 1-hour delay, the traveler can reclaim a deposit they were already paid for. The pool loses that amount.

What limits it:

• The delay itself. A reclaim can't complete until an hour after it's requested, which gives the confirmation an hour to arrive.
• Confirmation wins. A confirmation that arrives during the delay completes the crossing as ferried and closes the reclaim.
• Public reclaim requests. Every request emits ReclaimRequested on the escrow, so a crossing with a pending reclaim is visible before anyone fronts it.
• Booked, not hidden. A late confirmation for a reclaimed crossing is reported in the next settlement batch and written off (see How losses are booked).

The ferryman key

The exit pool fronts HYPE when a single permissioned address, the ferryman, tells it to. The pool can't check Elysium in real time, so it trusts that instruction for payment. It can't trust it for settlement: HYPE comes back only for crossings the escrow confirmed.

If the ferryman key is compromised, an attacker can make the pool pay out up to its caps before the guardian pauses ferrying. What limits it:

• Per-crossing cap and hourly outflow cap, enforced by the pool and shown on the pool status page.
• Guardian pause. A separate guardian address can stop ferry() at once.
• Exact-match escrow. A forged payout never unlocks a traveler's deposit, because the escrow releases only on a confirmation that matches its own record.

The ferryman and guardian addresses are read from the pool and shown on the pool status page.

Canonical bridge and messaging

Settlement runs through Elysium's standard withdrawal path, and confirmations run through its parent-to-child messaging. CHARON doesn't control either, or Elysium's data availability. If the bridge halts or a withdrawal can't be executed, HYPE on the river can't return to the pool, and the exchange rate reflects that only once a loss is booked.

Challenge period changes

Elysium can change its challenge period. A longer one keeps HYPE on the river longer, which lowers daily capacity and stretches queue ETAs. The pool's settlement window and toll vesting period are read from the contract and shown on the stake page, so changes are visible.

Smart contract bugs

CHARON is smart contracts, and smart contracts can contain bugs. The escrow has no admin withdrawal and no upgrade path, so a mistake in it can't be patched in place. The pool's caps limit how fast HYPE can leave it.

How losses are booked

A loss isn't hidden in "on the river." When the escrow sees a confirmation it can't match, or a confirmation for a crossing that was already reclaimed, it reports the amount in its next settlement batch. The exit pool writes that amount off, and the OBOL exchange rate falls by the same share for every holder.

Ticker confusion

Other tokens use the OBOL ticker. CHARON's OBOL is only the contract listed on the pool status page, and only the exit pool can mint it. Check the address before you trade.