Risk Disclosure

Last updated: April 2026

READ THIS ENTIRE DOCUMENT BEFORE USING THE PROTOCOL.

FreeNatoCash involves experimental cryptographic software, zero-knowledge proof systems, and smart contracts deployed on blockchain networks. Using this Protocol carries substantial risks including but not limited to permanent, irreversible loss of all deposited funds. By proceeding, you acknowledge that you have read, understood, and accepted every risk described in this document and the Terms of Service.

Risk Categories

1.General Risk Warning

2.Smart Contract Risks

3.Zero-Knowledge Proof Risks

4.Deposit Note & Key Management

5.Financial & Market Risks

6.Regulatory & Legal Risks

7.Privacy Limitations

8.Bridge & Cross-Chain Risks

9.Governance & Token Risks

10.Network & Infrastructure Risks

11.Third-Party Service Risks

12.Desktop Application Risks

13.Testnet Limitations

14.Irreversibility of Transactions

15.No Insurance or Protection

16.User Responsibility

General Risk Warning

CRITICAL

Cryptocurrency and decentralized finance ("DeFi") involve significant risk. Privacy-enhancing protocols like FreeNatoCash carry additional, unique risks beyond those of standard DeFi applications. You should not use this Protocol unless you fully understand all risks described herein.

No Guarantees

We do not guarantee the safety, security, or availability of any aspect of the Protocol. We do not guarantee that your funds will be recoverable, that transactions will complete, or that the Protocol will function as expected. All use is entirely at your own risk.

You should only use funds you are prepared to lose entirely. Never deposit funds that you cannot afford to lose. The Protocol is experimental software and may contain undiscovered vulnerabilities.

Smart Contract Risks

CRITICAL

The Protocol relies on smart contracts deployed on blockchain networks. Smart contracts are immutable once deployed and may contain bugs, vulnerabilities, or design flaws that could result in the permanent loss of deposited funds.

Unaudited code: Smart contracts have not been audited by an independent third-party security firm. While internal reviews and testing have been conducted, undiscovered vulnerabilities may exist.

Immutability: Once deployed, smart contracts cannot be modified. If a critical vulnerability is discovered, funds locked in the contract may be permanently inaccessible.

Reentrancy & exploits: Despite following best practices (checks-effects-interactions, OpenZeppelin libraries), novel attack vectors may emerge that were not anticipated during development.

Composability risk: The Protocol interacts with other smart contracts (ERC-20 tokens, bridges, verifiers). Vulnerabilities in any integrated contract could affect the Protocol.

Upgrade risks: Any future upgrades to the Protocol carry risk of introducing new vulnerabilities or breaking existing functionality.

Zero-Knowledge Proof Risks

HIGH

The Protocol uses Groth16 zero-knowledge proofs built with Circom circuits. These cryptographic systems have specific risks and limitations.

Trusted setup: Groth16 proofs require a trusted setup ceremony. If the setup ceremony is compromised (toxic waste not properly destroyed), an attacker could generate valid proofs for invalid statements, potentially forging withdrawals.

Circuit bugs: Errors in the Circom circuit logic (constraint system) could allow invalid proofs to verify, enable double-spending, or leak private information.

Proof generation failures: Client-side proof generation depends on your device's computational resources. Insufficient memory, CPU, or corrupted WASM modules may cause proof generation to fail.

Cryptographic assumptions: Groth16 security relies on the hardness of the discrete logarithm problem on the BN254 elliptic curve. Advances in mathematics or quantum computing could theoretically undermine these assumptions.

Poseidon hash function: The Protocol uses the Poseidon hash function for Merkle tree commitments. While designed for ZK-friendliness and extensively analyzed, it is newer than established hash functions like SHA-256.

Deposit Note & Key Management

CRITICAL

When you deposit funds, the Protocol generates a cryptographic deposit note client-side in your browser. This note is the sole means of withdrawing your funds.

IRREVERSIBLE LOSS

If you lose your deposit note, there is no recovery mechanism. No one — not the developers, not any administrator, not any support team — can recover your funds. This is by design in a non-custodial protocol.

No server storage: Deposit notes are generated and stored exclusively on your device. The Protocol never receives, transmits, or stores your deposit note.

Backup responsibility: You are solely responsible for securely backing up your deposit note. Store it in multiple secure, offline locations.

Clipboard risks: Copying deposit notes to your clipboard may expose them to clipboard-reading malware. Clear your clipboard after use.

Browser storage: If you store deposit notes in browser localStorage, clearing browser data or using a different browser/device will result in loss of access.

Wallet private keys: Loss of the wallet private key used for the withdrawal address will also result in inability to access withdrawn funds.

Financial & Market Risks

HIGH

Price volatility: Cryptocurrency prices are highly volatile. The value of deposited assets may decrease significantly between deposit and withdrawal.

Gas costs: Blockchain transactions require gas fees. Network congestion can cause gas costs to spike unpredictably, potentially making transactions economically unviable.

Relayer fees: Withdrawal transactions processed through the relayer incur a service fee. These fees may change without prior notice.

No FDIC/SPIC protection: Digital assets deposited into the Protocol are not protected by the Federal Deposit Insurance Corporation (FDIC), Securities Investor Protection Corporation (SPIC), or any equivalent government-backed insurance.

Impermanent loss: If participating in governance or liquidity provision, you may experience impermanent loss due to price divergence.

Tax obligations: You are solely responsible for determining and fulfilling any tax obligations arising from your use of the Protocol in your jurisdiction.

Regulatory & Legal Risks

CRITICAL

Privacy-enhancing cryptocurrency protocols operate in a rapidly evolving and uncertain regulatory environment. Using this Protocol may expose you to legal risks.

Sanctions compliance: Privacy mixers have been subject to sanctions by OFAC and other regulatory bodies. You are solely responsible for ensuring your use complies with all applicable sanctions laws in your jurisdiction.

Regulatory changes: Laws and regulations governing cryptocurrency, DeFi, and privacy protocols may change at any time. Such changes could make the Protocol illegal to use in your jurisdiction or subject to new restrictions.

Law enforcement: Transactions on public blockchains are permanently recorded. While the Protocol enhances privacy, law enforcement agencies may use chain analysis, metadata correlation, or other techniques to investigate transactions.

Geographic restrictions: The Protocol is not available in certain jurisdictions including the United States, EU member states, and others listed in our Terms of Service. Accessing the Protocol from a restricted jurisdiction is prohibited.

No legal protection: The Protocol does not provide any legal shield. If you use the Protocol for activities that violate applicable laws, you bear full legal responsibility.

Precedent risk: Legal precedents regarding privacy protocols are being established in courts worldwide. Adverse rulings could affect the legality, accessibility, or functionality of the Protocol.

Privacy Limitations

HIGH

While the Protocol is designed to enhance transaction privacy, it does not provide absolute anonymity. Users should understand the following limitations.

Anonymity set size: Privacy strength depends on the size of the anonymity set (number of deposits in a pool). Small anonymity sets provide weaker privacy guarantees.

Timing analysis: If you deposit and withdraw in close temporal proximity, or use predictable patterns, timing analysis may link your transactions.

Amount correlation: Deposits and withdrawals of uncommon or matching amounts in low-liquidity pools may be correlated.

IP address exposure: Without additional measures (Tor, VPN), your IP address may be visible to the frontend hosting provider, RPC endpoints, and the relayer.

Metadata leakage: Browser fingerprinting, wallet address reuse, and blockchain analysis tools may leak metadata that weakens privacy.

Blockchain permanence: All on-chain transactions are permanent and publicly visible. Even if the link between deposit and withdrawal is obscured, the individual transactions remain on the public ledger forever.

Bridge & Cross-Chain Risks

HIGH

Bridge exploits: Cross-chain bridges are among the most targeted components in DeFi. Bridge smart contracts hold significant value and have historically been exploited for billions of dollars.

Finality differences: Different blockchain networks have different finality guarantees. A transaction confirmed on one chain may not be immediately final, creating windows for exploitation.

Relayer dependency: Bridge operations depend on off-chain relayers to relay messages between chains. Relayer downtime, misconfiguration, or compromise could result in stuck or lost transactions.

Oracle manipulation: Cross-chain communication relies on oracles or relayers to verify state across chains. These can potentially be manipulated.

Chain reorganization: Blockchain reorganizations (reorgs) on either the source or destination chain could reverse bridged transactions.

Governance & Token Risks

MEDIUM

Not a security: The FNC governance token is a utility token for protocol governance. It is not a security, investment contract, or financial instrument. It confers no ownership, equity, dividends, or profit-sharing rights.

Governance attacks: If a malicious actor accumulates sufficient voting power, they could pass harmful governance proposals that modify protocol parameters.

Token value: The FNC token may have no monetary value. Its value, if any, is determined entirely by market forces and is not guaranteed by the Protocol team.

Vesting schedules: Tokens subject to vesting schedules may become worthless before they fully vest. Vesting does not guarantee future value.

Quorum risk: If governance participation drops below quorum thresholds, the protocol may become unable to pass critical updates or security patches.

Network & Infrastructure Risks

MEDIUM

Blockchain network failures: The underlying blockchain networks (Ethereum, BSC, Base) may experience outages, congestion, or consensus failures that prevent transactions from being processed.

RPC endpoint dependency: The Protocol depends on RPC endpoints to interact with blockchain networks. RPC provider outages or rate limiting could temporarily prevent access.

Frontend availability: The web interface may experience downtime due to hosting issues, DDoS attacks, or DNS problems. Your funds remain accessible via direct smart contract interaction.

Indexer delays: The event indexer that tracks deposits may experience delays or miss events, temporarily preventing withdrawals until the indexer catches up.

Server compromise: While the Protocol is non-custodial (your funds are in smart contracts, not on servers), compromise of backend infrastructure could affect service availability or expose metadata.

Third-Party Service Risks

MEDIUM

Wallet providers: The Protocol integrates with third-party wallet providers (MetaMask, WalletConnect, etc.). Vulnerabilities or compromises in these wallets could affect your funds.

HoudiniSwap integration: The swap feature uses the HoudiniSwap Partner API. We do not control HoudiniSwap's infrastructure, liquidity, or operations. Their terms and risks apply separately.

Cloudflare: The frontend is served through Cloudflare. Cloudflare's service disruptions, policy changes, or compliance actions could affect access.

RPC providers: Blockchain RPC providers (Infura, Alchemy, Chainstack) may impose rate limits, experience outages, or change their terms of service.

Open-source dependencies: The Protocol relies on open-source libraries (OpenZeppelin, circomlibjs, snarkjs). Vulnerabilities in dependencies could affect the Protocol.

Desktop Application Risks

MEDIUM

Ad-hoc code signing: The macOS desktop application is ad-hoc signed and distributed directly from freenato.com. It has not been notarized by Apple or distributed through any app store. macOS Gatekeeper may warn about unsigned software.

Tor connectivity: The desktop app routes traffic through the Tor network for enhanced privacy. Tor may be blocked, slow, or unreliable in certain jurisdictions or network environments.

Local key storage: The desktop app stores encrypted keys locally on your device. Physical access to your device, malware, or loss of the device could compromise stored keys.

Auto-updates: Automatic updates are fetched from GitHub Releases via Tor and verified with EdDSA signatures. If the signing key is compromised, malicious updates could be distributed.

Testnet Limitations

INFO

The Protocol is currently deployed on the Ethereum Sepolia testnet. Testnet environments have specific characteristics and limitations.

No monetary value: Testnet tokens (Sepolia ETH) have no monetary value. Testnet operations are for testing and research purposes only.

Network instability: Testnets may be reset, reorganized, or deprecated by the Ethereum Foundation without notice.

Behavioral differences: Testnet behavior may differ from mainnet. Successful testnet operations do not guarantee identical mainnet behavior.

Faucet dependency: Obtaining testnet tokens requires faucets, which may impose rate limits, require authentication, or become unavailable.

Irreversibility of Transactions

HIGH

All blockchain transactions are irreversible once confirmed. There is no "undo" button, no chargeback mechanism, and no dispute resolution process for on-chain transactions. If you send funds to the wrong address, deposit into the wrong pool, or make any other transactional error, there is no way to reverse the transaction.

This applies equally to deposits, withdrawals, bridge transfers, governance votes, and any other on-chain interaction with the Protocol.

No Insurance or Protection

HIGH

Digital assets deposited into or interacting with the Protocol are not insured or protected by any government agency, financial institution, or insurance provider. This includes but is not limited to:

Federal Deposit Insurance Corporation (FDIC)

Securities Investor Protection Corporation (SIPC)

National Credit Union Administration (NCUA)

Financial Services Compensation Scheme (FSCS)

Any equivalent national or international deposit protection scheme

Any private insurance policy maintained by the Protocol team

User Responsibility

CRITICAL

By using the Protocol, you acknowledge and accept that:

1You have read and understood this entire Risk Disclosure document.

2You have read and agreed to the Terms of Service and Privacy Policy.

3You are using the Protocol entirely at your own risk.

4You are solely responsible for your funds, deposit notes, private keys, and wallet security.

5You understand that the Protocol is experimental software that may contain undiscovered vulnerabilities.

6You will not hold the developers, contributors, or operators liable for any losses.

7You have conducted your own research and due diligence.

8You are legally permitted to use the Protocol in your jurisdiction.

9You are not using the Protocol for any illegal, illicit, or prohibited purpose.

10You accept that no warranty, guarantee, or representation is made regarding the Protocol.

IF YOU DO NOT ACCEPT THESE RISKS, DO NOT USE THE PROTOCOL. Close this page immediately and do not interact with any FreeNatoCash smart contracts, services, or applications.

Risk Disclosure

Risk Categories

General Risk Warning

Smart Contract Risks

Zero-Knowledge Proof Risks

Deposit Note & Key Management

Financial & Market Risks

Regulatory & Legal Risks

Privacy Limitations

Bridge & Cross-Chain Risks

Governance & Token Risks

Network & Infrastructure Risks

Third-Party Service Risks

Desktop Application Risks

Testnet Limitations

Irreversibility of Transactions

No Insurance or Protection

User Responsibility

Related Legal Documents

Risk Disclosure

Risk Categories

General Risk Warning

Smart Contract Risks

Zero-Knowledge Proof Risks

Deposit Note & Key Management

Financial & Market Risks

Regulatory & Legal Risks

Privacy Limitations

Bridge & Cross-Chain Risks

Governance & Token Risks

Network & Infrastructure Risks

Third-Party Service Risks

Desktop Application Risks

Testnet Limitations

Irreversibility of Transactions

No Insurance or Protection

User Responsibility

Related Legal Documents