Everything that can go wrong.

Premium is paid only if a buyer fills. The keeper writes the call and lists it on Overcall. If nobody buys before the book closes (Fri 20:00 UTC in Overcall's current cycle; the registry's timestamps are what count), the week's premium is zero and the unsold calls expire worthless.

This is the most likely outcome on a thin book, and the book for weekly calls on a tokenised stock is thin.

The call the vault writes is not private to it. It is one of the NVDA options Overcall registers for the week, and anyone who writes the same option writes into the same series. Valorem assigns exercises across all writers of a series, by bucket, not to whoever sold the exercised call. So if buyers of calls that other writers sold exercise, part or all of the vault's position can be assigned even though its own listing never filled.

Anyone holding a call of the series the vault wrote may exercise it inside the exercise window (Fri 20:00 to Sat 20:00 UTC in Overcall's current cycle), and Valorem can assign that exercise to the vault whether or not the call was bought from the vault. Valorem takes the collateral at the strike and leaves the strike proceeds in USDG, credited to depositors in full: the protocol fee is charged on premium, never on strike proceeds. At launch the strike is the nearest Overcall rung 3% to 12% above spot at the write, so it takes a move, but not an enormous one.

Valorem assigns by bucket, not perfectly pro rata. The vault can be assigned on some of the contracts it wrote and not on others, so an exercised week usually ends as a mixture rather than a clean swap. Assignment reaches every contract the vault wrote, while premium comes only from the contracts it sold.

Deposits stay open while a call is live, until the exercise timestamp. A deposit then is priced at face value: the share price counts the NVDA locked behind the call and does not subtract what the call could cost. The new shares share that week's result, including any assignment.

A withdrawal settles instantly only while the vault is Idle with nothing written. Once a call is open, the collateral is locked in Valorem until expiry, so a withdrawal started mid-week is queued and completes after the week closes, not before. A queued redemption cannot be cancelled.

Plenty of products make an empty week look survivable by paying it in their own token. This one has no token to pay with. Depositors keep the premium left after Overcall's 5% and the 5% protocol fee, and that is the entire return path.

Stock Tokens are debt securities issued by Robinhood Assets (Jersey) Limited. They are not shares: no vote, no claim on Nvidia, and issuer credit risk on that entity. The issuer can freeze or restrict transfers, blocklist the vault, burn tokens from any holder including the vault, and upgrade the token contract, each from a single key with no timelock. The token can also pause its own price oracle.

The two events are different. A freeze stops anything that moves the token, including writing a call and closing the week. An oracle pause stops the vault writing and listing new calls, and nothing else: settlement never reads the oracle, so an open week still closes.

Premium and strike proceeds are paid in USDG, a third-party stablecoin, so you carry whatever risk USDG carries. It is upgradeable by an admin behind a 24-hour timelock that Stonkhouse does not control. A separate single key can pause USDG, freeze an address, and wipe the USDG balance of a frozen address, the vault's included.

Valorem Clear can charge 15 bps of written notional, paid in NVDA from the vault's balance on top of the collateral at each write, whether or not a buyer fills. It is off today, and the switch belongs to a third party. On a weekly out-of-the-money call that is not small change: the launch floor for a listing is 0.40% of spot, so 15 bps of notional can be a large share of a good week and more than all of a thin one.

Robinhood Chain runs a centralised sequencer with no uptime feed, so an outage shows up here as a stale price. The NVDA price feed follows US equity hours and stops over weekends and holidays; a gap longer than the vault's price-age limit (4 days at launch) blocks writing until the feed updates.

Overcall's listings API is a third-party service that can reject or drop an order. Any of these, in the hours before the book closes, means no visible listing when buyers are looking.

The Stonkhouse contracts are not deployed and have not been audited. An internal adversarial review across 13 surfaces raised 72 findings, of which 51 survived refutation. The contract defects recorded as fixed carry regression tests; the project's records do not say every surviving finding was fixed. That review was done by the people who wrote the code. It is not an audit, and it does not substitute for one.

Valorem Clear was audited by Zellic in 2022–2023 under its former name, OptionSettlementEngine. That audit covers Valorem, not this vault. Seaport, USDG and the Stock Token are third-party code outside anyone's control here.

The keeper is one hot key running a weekly state machine against a third-party cycle. It can crash, run out of gas money, or be looking the wrong way when the window opens.

Assume the keeper key is stolen outright. The attacker can propose a strike, a size and an order, and can cancel listings. Every one of those goes through the vault, which is the Valorem writer and the Seaport seller, authorises each listing by hash on chain, and checks every field against the current policy (the strike band, the premium floor, the utilisation ceiling and the contract cap) and against the compiled 21-day cycle limit and one-token lot size.

The vault admin sets policy inside compiled caps: the strike band, the premium floor, the utilisation ceiling, the protocol fee, the contract cap, the deposit cap, the price-age limit, the fee recipient, and whether to accept Valorem's engine fee. It can halt and unhalt writes and appoint the keeper and the Guardian. At launch the admin is a single deployer key, handed to a 2-of-3 Safe later. There is no timelock in v1.