Back to Mithqal

Risk Disclosure

Last updated: 2026-09-15

MITHQAL is currently operated by JOZOUR LLC during the institutional development phase. The constitutional architecture described throughout this documentation represents the intended institutional destination of the project. Planned entities do not yet exist and are not currently operating.

Plain summary: Mithqal is at a pre-mainnet, pre-audit, pre-licensed stage. The testnet demonstrates a working monetary-engine specification; it does not custody value, it has not been independently audited, and no MTQ is in mainnet circulation. The following disclosures are material.

1. Smart-Contract Risk

  • Contracts are deployed on Monad Testnet only. They have not been audited by an independent third party.
  • Certora formal-verification specifications exist but have not been executed (commercial licence pending).
  • Foundry fuzz-test specifications exist; the Foundry toolchain is not currently installed in CI, so the "69/69 PASS" figure should be treated as unverified pending an independent run.
  • The on-chain testnet self-audit was performed by the MITHQAL Formation Committee (the operator). It is a self-assessment, not an independent audit.
  • The Governance contract's anti-platform enforcement is currently a stub (`return false`) and must be implemented before mainnet.
  • `attestReserves()` allows the minter role to publish a reserve value; on mainnet this must be backed by an independent custodian attestation.

2. Regulatory Status

  • JOZOUR LLC is a New Jersey LLC (active). EIN assigned.
  • FinCEN Form 107 (MSB registration): preparation in progress; not yet filed. No MSB registration number exists.
  • NJ Money Transmitter License: not held; under evaluation.
  • No qualified custody arrangement is in place. The Safe Multi-Sig on Monad Testnet is not a qualified custodian under federal or state securities law.
  • No KYC/AML/OFAC screening program is in production. The "Mithqal Brain" compliance panel is an LLM-based advisory heuristic, not a sanctions-list or identity-verification product.

3. Operational Risk

  • A formation team is being assembled. Until the team is seated, a single operator holds all keys and credentials (key-person risk).
  • Multi-factor authentication is not yet enforced on the operator account; rate-limiting is in-memory and per-instance on Vercel.
  • A Content-Security-Policy header is emitted for all routes via next.config.ts (default-src 'self', script-src 'self' 'unsafe-inline' 'unsafe-eval'). The CSP permits 'unsafe-inline' and 'unsafe-eval' for scripts — this should be tightened with nonce-based CSP in a future hardening pass.
  • Operational database is single-region (us-east-1). No cross-region replication.
  • No 24/7 incident-response team. No cyber, professional-indemnity, or custody insurance is in force.

4. Data Risk

  • PII you submit to the optional Mithqal Brain compliance panel is forwarded to up to three third-party LLM providers (Google, Hugging Face, Groq). See Privacy Policy.
  • A historical iCloud SMTP credential was inadvertently committed to git history. It has been rotated; users should not rely on any cached copy.

5. Market & Monetary-Engine Risk

  • The currency basket weights are derived from static COFER, SWIFT, and BIS reference values, not from live feeds of those sources. Live gold/FX/crypto prices are fetched; currency structural weights are not.
  • Historical price references (e.g. gold 12 months ago) used in the momentum / SDP calculations are conservative constants; they are not fetched from a historical price API.
  • The dashboard's "live" reserve-ratio and supply figures currently reflect the testnet simulator ledger, not mainnet reserves. No mainnet reserves exist.

6. Forward-Looking Statements

Statements about future licensing, audits, custody arrangements, Council formation, and mainnet launch are forward-looking and subject to change. They are not commitments.

7. Acknowledgement

By using this site you acknowledge that you have read and understood the risks above. If you do not accept them, do not use the site or submit information via the intake form.