There is a risk of the smart-contract being hacked, however our team works together with top auditors across the globe to mitigate this risk. Latest audit report will be available here.
Aspis uses Oracles to calculate the value of LP tokens that the user is getting on deposit, as well as calculate the performance fee. If these Oracles are hacked or manipulated, then there is a risk that hackers can abuse the system during these attacks and can wash the liquidity out of the Vault.
Untracked Assets Risk
To balance the interests of the investors and the manager, we're using withdrawal windows. If the manager has set up withdrawal windows in Vault, then it means that users are able to withdraw without Rage Quit only in certain periods. For this period it is highly recommended that the manager close all active positions in liquidity pools and convert assets to the ones that are supported by Chainlink oracles, which we're currently using to get the right calculation for the performance fee.
Vault's role is to reduce the risk of misbehavior from the manager's side as well as increase transparency and trust among all Vault's participants. However, not all risks can be programmed, so potential managers can always try to find ways how to misbehave. It is important to monitor actions performed by the manager to use Rage Quit if suspicious activity is noticed.
Currently, investors can restrict the manager to trade only on allowlisted DeFi protocols & DEXes and can trade certain assets/trading pairs. We're also working on adding slippage tolerance to prevent the manager from doing self-benefitting transactions using Vaults funds. This is coming next.