Safety

Who can move your money

You can, always. Heron holds a limited permission, not your keys. That permission is restricted to specific venues, capped in size, and expires on its own. You can narrow it or cancel it whenever you like.

A permission that can only be switched fully on or fully off is not much use when you are nervous. Narrowing is usually what you actually want, so it is supported.

If Heron stops working

You can withdraw without Heron. Exiting uses the underlying protocols directly, with public information and a public network endpoint. Heron being offline slows nothing down.

The risks we are not going to talk around

Single owner. Your personal account has one owner. If you lose access to the service that holds your key, you lose access to the account. That is a lockout, not an inconvenience. It was a deliberate design choice and this is the cost of it.

Test network. Everything here runs on GIWA Sepolia. The tokens are test tokens. The yield is funded by a faucet, not by real borrowers, so it tells you nothing about real returns.

Price feeds are degraded. Heron reads prices from one source where the design calls for three independent ones. Fewer sources means less protection against a single bad price.

Nothing has passed our own admission check. Heron runs an internal check before a network is considered ready for real money. No network passes it today, GIWA included. We publish that rather than wait until it looks better.

Emergency exit

You can pull everything back to idle and withdraw. See Withdraw.