# List of Assumptions The security model holds under these assumptions. Each item is an explicit trust decision; violating one voids the corresponding guarantees. 1. **The deal asset is a benign ERC-20**: no fee-on-transfer, no rebasing, ≤ 18 decimals. Balance-observation checks (`AssetMovementMismatch`) reject fee-on-transfer behavior loudly. 2. **Governance keys are secure and the timelock delay is respected.** The upgrader role can replace implementations after the delay; a compromised governance is out of scope. 3. **The attestation signer is honest about off-chain reality.** Facility marks (expected loss, collateral) are only as good as the signer. The contracts enforce signature validity, nonce monotonicity, and freshness. The underlying credit data remains a signer trust assumption. 4. **The keeper is available (liveness), though not trusted (safety).** Safety properties hold against a malicious keeper; liveness (servicing cadence, coupon funding, exit fills) requires an operating keeper. Prompt wrapper claim pokes after exit processing remain good hygiene (lenders get their cash sooner), but coupon attribution no longer depends on them — fill checkpoints stop a filled slice's coupon clock at the fill itself, whatever the servicing order. 5. **Interest computation is off-chain by design.** On-chain accrual records the servicer's computation. 6. **Off-mode NAV previews are views**: the optimistic preview path recomputes settlement without writing; gas-heavy view reads are preferred over cached stale marks. 7. **Class-token upgrades preserve ledger semantics** — specifically `cumCashIndex` monotonicity, which pinned wrappers depend on (see [Proxies & Upgradeability](/technical/proxies)). 8. **Gate implementations are policy-honest**: a gate that misclassifies eligibility affects who may enter/exit/receive. Queued and owed capital remains ungated by construction.