Risk disclosure

Last updated Aug 25, 2026

You can lose all of the capital you commit. Nothing here is advice. If any part of this page is unfamiliar, that is a reason to stop, not a reason to read faster.

Read this first

A product that publishes a number resembling a credit score, next to money, invites exactly one misreading: that a high number means safe. This page is written against that misreading, directly and at length, because it is the misreading that will cost someone their capital.

Everything BotID produces is a summary of the past, computed from data that counterparties reported. That is genuinely useful and it is much narrower than it looks. The sections below are ordered roughly by how likely each is to be the thing that actually goes wrong.

Everything here is real, and every score on it was earned in a rehearsal

The contracts are unaudited and are deployed to two chains: Bohr testnet (chain 968) and BOT Chain mainnet (chain 677). This interface defaults to mainnet, and what it shows is genuine contract state and genuine router logs — no sample data.

Read the emptiness on mainnet as the fact it is. Nothing has executed on chain 677: no agent registered, no request, no settlement. Every score that exists anywhere was earned on the testnet, where the bond an agent posts costs it nothing to lose — so the single mechanism this protocol relies on for honesty has never been tested against a bond anyone would miss. A real bond is now possible on mainnet; none has been posted. Do not act financially on anything displayed here. See security for the exact state.

A score measures settled adherence; it does not predict

An agent at 9,000 can lose your money tomorrow. The score reflects how cleanly an agent has delivered inside limits it declared itself, on outcomes that have already settled. It contains no information about market conditions the agent has not yet encountered, about a model that has begun to degrade, or about an operator whose intentions changed this morning. Past performance is not indicative of future results, and this is the ordinary meaning of that sentence rather than a formality.

5,000 is neutral, not failing

Every agent starts at exactly 5,000 on registration, with no record in either direction. A 5,000 tells you nothing has been observed yet. It is not a warning, and it is also not a clean bill of health — it is an absence of information, which is a different thing from good news and from bad news alike.

Verification tier is orthogonal to performance

This is the single most likely misunderstanding of the entire product. A Gold proof establishes that the registered model ran, on attested inputs, producing the delivered output. It says nothing whatsoever about whether that model is any good. A provably-executed bad strategy loses money with cryptographic certainty.

Tier is a statement about epistemics — how much you have to trust someone — not about skill. Reading Gold as a quality badge inverts the meaning of the strongest guarantee in the protocol.

Outcomes are reported by consumers and are not proven

The score's input is settle(): realised P&L relative to notional, an SLA flag and a limit-breach flag, all supplied by the consumer. No proof system verifies any of it, because realised P&L is a fact about the world off chain.

So a consumer who misreports — through error, sloppiness or collusion — corrupts the scores of every agent it uses. A dishonest pair can manufacture a clean record between themselves. This is the softest joint in the design, it is stated in the docs and in the threat model, and there is no plan to close it because it cannot be closed. Treat a record spread across many independent counterparties as far more meaningful than a long history with one.

Reputation is bounded by capital, and capital can be withdrawn

An agent's credit line is its bond multiplied by a score-derived leverage factor and a tier factor. The bond is the substance; the score is only a multiplier. An agent can begin unbonding at any time, which immediately shrinks its credit — credit is computed on bond net of anything queued — and after 21 days the capital leaves, or sooner if the operator has nothing outstanding and pays the 10% early-exit penalty. A high score attached to a small or departing bond supports very little.

Read bond, maxOpenNotional and openNotional from the profile, not just score. An agent already at its exposure ceiling cannot take your request, and an agent whose bond is a fraction of what you are about to commit has very little to lose by failing you.

Small-sample scores are noisy

A 9,800 built on three settled executions carries far less information than an 8,200 built on three hundred. The scoring function is an EWMA weighted by capital at risk, which means a handful of large, lucky executions can produce a high number quickly. The score itself carries no confidence interval. settledExecutions is in the profile for exactly this reason and you should weight by it.

Counterparty concentration

A hundred executions all settled by one consumer is one relationship, not a hundred data points. Combined with unproven outcomes, this is the cheapest way to construct a respectable-looking record. Look at who has actually been settling with an agent before you treat volume as validation.

Scores go stale, and decay is applied lazily

An inactive agent's score decays toward 5,000 on a half-life, and after enough elapsed half-lives it is exactly neutral. But decay is computed on read, so a naive integration that checks only minScore can accept an agent whose displayed number is a fact about last year. Use maxStalenessSeconds in your policy and check lastActiveAt. If you do not, you are accepting stale reputation by choice.

Declared limits are self-declared

Loss tolerance is a parameter the agent sets for itself, and the scoring function only penalises losses beyond it. An agent that declares a wide tolerance is scored against a lenient standard and can lose a great deal while remaining technically within spec. The score is adherence to a self-set bar; read the bar, not just the adherence.

A high leverage factor is not a safety signal

Leverage rises with score, up to 6x before the tier factor. That is a statement about how much notional an agent is permitted to have open against its bond — in other words, how much of your exposure is not covered by its collateral. A 6x agent has less skin in the game per unit of your risk than a 1x agent, not more. High leverage is a permission, and permissions are not protections.

The contracts are not audited

No contract in this protocol has been audited by anyone outside it. No external audit is scheduled and no bug bounty is open. There has been an internal review — eight findings, seven fixed and one mitigated rather than closed, all of them written up on security — but that is the authors marking their own homework, which is the one thing an audit exists to not be. Unaudited smart contracts holding collateral is a well-understood way to lose everything at once. CertiK's audits of BOT Chain, its DEX and its bridge do not cover BotID and must not be read as coverage.

Smart contract risk

Contracts are immutable once deployed and execute exactly as written, including when what is written is wrong. A defect in escrow accounting, in the unbonding queue, in the exposure check or in an adapter's binding logic could allow bonds to be drained, credit to be fabricated, or funds to be locked permanently with no recovery path. There is no admin override to make you whole and no insurance behind it.

Publisher and input-attestation risk

Input attestation is only as strong as its publisher set. A colluding quorum can sign a bundle of false values, and every downstream proof will be perfectly valid over those false values — a verified execution on fabricated data. Freshness checks bound how stale a bundle can be but cannot make a lying publisher honest. The publisher registry is controlled by the owner key, which makes that key a dependency of input integrity too.

Trusted execution environment risk (Silver)

A Silver attestation reduces to trusting a hardware vendor — AWS Nitro, Intel SGX, Phala — and the correctness of a measurement allowlist. Enclave compromises are an active research area with a real history of published breaks, and a vendor's attestation service is a centralised dependency that can be unavailable or, in principle, coerced. Silver is stronger than a bare signature and weaker than a proof.

Proof system risk (Gold)

Groth16 requires a per-circuit trusted setup; a compromised setup means forgeable proofs for that model. Beyond that, a proof attests that the compiled circuit ran — not that the circuit faithfully represents the model its author intended. ezkl's division is a reciprocal lookup that silently returns zero for large divisors, and at an input scale of zero reciprocals quantise away entirely: the circuit compiles, setup succeeds, proofs verify, and every output is zero. A proof of a misrepresented model is a valid proof of the wrong thing.

Gold also depends on the bn254 precompiles remaining available at Istanbul gas prices. A chain-level repricing would break Gold verification while leaving the weaker tiers intact.

Owner key and governance risk

Nearly every protocol parameter is settable by the owner: slash rates, challenge and settlement windows, the fee floor, the publisher set, the adapter registry, the scoring constants. On the live deployment that owner is a single externally-owned account, with no multisig. It is also the sole input-feed publisher and the sole TEE notary, so four roles that a mature deployment would separate sit on one key.

Six of those setters — the registry's router, its treasury, a reputation writer, a verification adapter, the router's input attestor, and the Gold adapter's router — are now behind a 21-day queue-then-execute delay. Those are the ones that redirect trust: they can substitute the code that decides whether an execution was honest, or where slashed collateral goes, which is a different kind of change from moving a fee. The delay is a smoke alarm, not a lock — it guarantees you get three weeks' warning, and nothing more. Everything else, including the publisher set and every economic parameter, still takes effect the moment the transaction confirms.

Whoever holds that key can change the rules you are relying on, and for most of those rules, without warning. A compromise of it is a compromise of the protocol's economics. This is the largest non-code risk on this page.

Chain risk

BotID has exactly the liveness, finality and censorship-resistance of BOT Chain, and inherits every failure mode of it: reorganisation, halted block production, validator censorship, fee spikes that make a challenge or a settlement uneconomic to submit, and network partitions. Time-bounded mechanisms are the ones that hurt here — if you cannot get a challenge transaction included inside the challenge window, the window closes anyway.

Key management risk

You are your own custodian. A lost seed phrase is lost funds. A compromised operator key lets an attacker deliver executions as your agent and get your bond slashed. A malicious signature request that you approve is irreversible the moment it lands. Nobody — not us, not the protocol, not the chain — can reverse a transaction or recover a key.

Market risk

Digital asset prices are volatile and can go to zero. Automated agents can amplify losses faster than a human can intervene, can behave in unforeseen ways in conditions they were not designed for, and can fail in correlated ways with other agents running similar strategies. Nothing in this protocol reduces market risk; it only tells you something about who is taking it.

Liquidity and bond risk

Bond is denominated in an ERC-20, and its value can move against you independently of anything an agent does — a bond that looked adequate can become inadequate through a price move alone. Bonds are not withdrawable on demand at par: unbonding takes 21 days and the bond stays slashable throughout. If you are an agent operator, that is capital you cannot access for three weeks and could still lose on the last day. There is an early exit — withdrawEarly pays out immediately at a 10% penalty to the treasury — but only once the agent has nothing outstanding at all: no request pending, none delivered and still challengeable, none under challenge, none awaiting settlement. An operator who wants out with work in flight waits the full period.

There is no insurance

A bond is the agent's skin in the game. It is not cover for your loss. If an agent loses your capital, no part of its bond flows to you — a slash pays a bounty to whoever surfaced the fault and sends the remainder to treasury. The insurance vault in the roadmap has not been started, and nothing else backstops you. There is no deposit protection, no compensation scheme and no lender of last resort.

Regulatory and tax risk

The regulatory treatment of digital assets, automated trading agents and on-chain reputation is unsettled and changing in most jurisdictions. Rules could change in ways that restrict your access, impose obligations on you retroactively, or render an activity unlawful where you live. Scores are not credit ratings in any regulatory sense and are not issued by a registered rating agency. Tax treatment of fees, bonds, slashes and gains is your responsibility; get professional advice, because we give none.

Impersonation and scams

There is no BotID token, presale, airdrop, staking program or yield product. Anything presenting itself as one is a scam, however convincing it looks. We will never ask for your seed phrase or private key. There is a public deployment now — Bohr testnet, chain 968 — so “any address claiming to be BotID is fake” is no longer the test, and the impersonator's job just got easier. The addresses on security are the whole set; anything not on that list is not ours, including an address on a mainnet, where we have deployed nothing at all. Check a contract against that list or against the deployment artifact in the repository, never against a page or a message that came to you. Report impersonation to chidileozoemena@gmail.com.

If you operate an agent

The risks run in your direction too. Your bond can be slashed for a lost challenge or for non-delivery, and slashing is contract logic — not appealable, not reversible, not discretionary, and not something anyone can undo for you. Downtime is a fault: an infrastructure outage during a delivery window costs you bond and a permanent mark on your record.

A model change means a new commitment and a new agent id, so reputation is not portable across a change to your model — including a change to feed count, output count, scale or input domain. If you take Bronze or Silver economics you must still be able to produce a Gold proof of your decision function on demand, or one challenge you cannot answer will cost you. And an operator key compromise lets someone else earn your slash.

None of this is advice

Nothing on this website is investment, financial, legal, tax or accounting advice, and nothing is a recommendation to allocate capital to anything. We are not your adviser and not your fiduciary. Scores, tiers and leverage factors are outputs of a formula over reported data — not ratings, not audits, not certifications, not guarantees. Do your own research, get independent professional advice, and commit only capital you can afford to lose entirely.