What we can and cannot do to your money

Last updated: 13 October 2026

Most of what goes wrong in lending is not a clever exploit. It is someone with a key doing something you did not expect. So here is every power StaterFi holds over your money on the mainnet app, every power it does not, who holds the rest, and where to check each answer yourself.

Read this first. On the mainnet app your deposit sits in an established lending protocol on Ethereum, under your own address, not in anything of ours. The only StaterFi contract in the path is a small fee router that holds nothing between transactions. StaterFi's own lending market is in development and not on mainnet; it opens only after an independent security review, and every power listed for it further down is a design commitment you will be able to verify on-chain when it deploys.

The short version, for the mainnet app

Question	Answer	Why
Can anyone at StaterFi move your deposit?	No	It sits in the protocol's pool under your address. Only a transaction signed by your wallet can withdraw it, and StaterFi has no contract function that touches it.
Can StaterFi take more than the fee?	No	The fee router receives your borrow from the protocol, sends the fee to the treasury and the rest to you in the same transaction. The exact borrow allowance you grant it is the most it can ever move.
Can StaterFi switch this page off?	Yes	We can replace the borrow page with a notice, for example while a problem is checked. That cannot move, freeze or reach your deposit: it stays in the protocol's pool under your address, and any other interface to the same protocol reaches it with the same wallet.
Can the fee be raised without limit?	No	Capped at 10% by a constant in the contract. The owner can set it anywhere from 0% to 10%, never above. It is 3% today.
Can StaterFi change the protocol's limits, rates or liquidations?	No	Loan-to-value, liquidation thresholds, caps and interest rates are set by the protocol's governance. The app reads them live and shows them; it cannot alter them.
Can anyone stop or soften a liquidation?	No	The protocol's rules run on-chain when a health factor drops below 1. Nobody can intervene, including us. The app shows the price at which that happens before you borrow.
Can an approval be unlimited?	No	Every approval is for the exact amount of that one action. An unlimited approval is what a drainer needs, and the app never asks for one.
Is there a customer-service account that can reverse a transaction?	No	Nobody has that power, including us. This is the cost of self-custody, and we would rather you know it now.
Can the protocol change the rules of a market?	Yes	Its governance can change limits and caps, freeze or pause a market, or change a price feed. The app reads the current values on every load and shows a paused market as paused.

The fee router, exactly

Borrowing through StaterFi goes through one small contract of ours, the fee router. Here is everything it can do, and who can make it do it.

Function	Who can call it	What it does
`borrow`, `borrowETH`	You	Asks the protocol for your loan plus the fee, with the debt booked to you under the credit delegation you granted for that exact amount; sends the fee to the treasury and the loan to you, as plain ether for `borrowETH`. Nothing stays behind.
`setFee`	The owner	Sets the fee between 0% and the 10% ceiling. The ceiling is a constant and cannot be changed.
`setTreasury`	The owner	Changes where the fee goes. It cannot redirect your loan or your deposit.
`rescue`	The owner	Returns tokens someone sent to the contract by mistake. Nothing in normal use leaves a balance there.
`receive`	WETH only	Accepts ether only from the WETH contract during an unwrap, so no ether can be stranded there by accident.

It is not upgradeable: the code deployed is the code forever. It is tested on every change, including against the protocol's real contracts on a copy of mainnet, and it has not been audited by an outside firm. Its address and verified source will be linked here the day it is deployed; until then the app offers deposits and withdrawals, and shows Borrow once it is live.

Where your deposit lives

Where it is: the lending pool contract on Ethereum, 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2, under your address. Plain ether goes in and out through the protocol's own gateway, 0xd01607c3C5eCABa394D8be377a08590149325722, which wraps and unwraps it inside each transaction.
What the protocol's governance can do: change loan-to-value and liquidation thresholds, set supply and borrow caps, freeze or pause a market, replace a price feed. These are public votes with their own timelocks, and the app reads the outcome live.
What it cannot do: take your deposit, or reverse a transaction.
What happens if the protocol fails: your funds are at risk and StaterFi cannot recover them, compensate you or intervene. The Risk Disclosure says this at length because it is the largest risk on the page.

StaterFi's own lending market, in development

StaterFi is also building its own lending market. It is not on mainnet and nothing on the app touches it. The ceilings below are constant values compiled into that contract: not configuration, not governance parameters. A vote cannot move them; only deploying a different contract can, and that contract would have a different address you would have to choose to use.

Ceiling	Value	What it prevents
Origination fee	≤ 10%designed at 3%	A fee rise that makes an open loan unaffordable to refinance.
Liquidation bonus	≤ 20%6.5–7.5% for Bitcoin	A liquidator being paid an arbitrary share of your collateral.
Borrow APR	capped per market100% stablecoins, 150% majors	A utilization spike compounding your debt without limit. Fixed at deployment, immutable.
Fixed-rate premium	≤ 20%designed at 1.5%	Locked-rate loans being priced arbitrarily above the variable rate.
Liquidation close factor	50%100% below health factor 0.95	Your whole position being closed over a small shortfall.
Fixed-loan term	7–365 days	A term so long the locked rate stops reflecting reality.
Listed markets	≤ 128	Unbounded growth in the per-account bookkeeping that tracks your collateral.

Its governance is designed the same way: every parameter change waits 2 days in a public timelock before it can execute, a guardian can pause in an emergency but cannot unpause alone, a stale or disputed price halts the market rather than guessing, and repaying is never governable and cannot be switched off. It opens on mainnet only after an independent security review, published in full, and only behind separate governance and treasury multisigs whose addresses will be linked here so you can check them rather than take our word.

What is still ahead

A page like this is worthless if it only lists strengths.

The fee router is not deployed yet. Borrowing through StaterFi switches on the day it is; until then the mainnet app is deposits and withdrawals.
Our own market is in development. Its independent review, its governance multisigs and its first-loss reserve are all ahead of it, and it will not hold a deposit on mainnet before they are in place.
Our fee is bad for short loans. 3% once is competitive over a year and expensive over three months. If you want to borrow briefly, a market with no origination fee will cost you less, and you should use one.
We cannot save you from a liquidation. The app shows the price at which it happens and a comfortable amount beside the maximum; borrowing less than the maximum is the only protection that exists.

Check it yourself

The protocol: read the pool and gateway addresses above straight off Etherscan, and compare them with the footer of the app before you sign anything.
The fee router: its verified source will be linked here on deployment, with the MAX_FEE_BPS constant and the feeBps value readable on-chain.
Our own market: the ceilings are the MAX_ORIGINATION_FEE_BPS, MAX_LIQUIDATION_BONUS_BPS, MAX_FIXED_RATE_PREMIUM_BPS and CLOSE_FACTOR_BPS constants in LendingPool.sol; the APR cap is maxRateBps, an immutable in InterestRateModel.sol. The code and its security assessment are available on request, and will be published with the independent review.