Risks and limitations

This page is deliberately unflattering. Everything below is a real limitation of the design, the deployment, or the environment Plouto runs in.

Protocol risks

No audit: No external security audit has been performed. An extensive test suite is not a substitute, and this documentation does not treat it as one. See audit status.
Locked principal: Principal cannot be withdrawn before maturity. There is no routine early exit, no early-withdrawal penalty option, and no secondary market for positions. A 90-day lock means 90 days.
Privileged roles: Until roles are transferred to a multisig behind a timelock, an admin key can pause staking, alter buyback safety parameters and grant roles. This is the largest open operational risk and is tracked as a launch blocker.
One-way initialization: setPloutoTokenOnce is irreversible. If the wrong token were registered — despite the validation — it could never be changed.

Revenue may be zero: Rewards depend entirely on trading volume. A quiet market means no rewards, indefinitely. See empty-volume behaviour.
No price guarantee: Supply contraction does not guarantee price appreciation. It changes the supply side of a market; demand is not something a contract can produce.
Buybacks are observable: Executions are public transactions and can be traded against. Bounds limit the damage per execution but do not eliminate extractable value. See slippage protection.
Reward dilution: Your share falls as others stake. A projected share shown at open time is a snapshot, not a forecast.

Pons sweep timing: Fees are unavailable until Pons sweeps them into escrow. Plouto cannot force this and cannot read the pending amount. Post-graduation this may additionally depend on the Pons sweep operator.
Pons redeployment: Plouto's references to the Pons factory and escrow are immutable. If Pons redeploys, those references become stale and there is no in-protocol migration path. Recovery would require a new Revenue Router and a Pons-side recipient change.
Pons audit status: Pons V2's disclosed audit status is external and not something Plouto can verify from chain state. Consult the official Pons documentation directly.
Phase gaps: During the Swept and Rescued phases there is no tradeable route, and the executor reverts rather than guessing. Buybacks pause until a route exists.

Reward dust: Every division rounds down, so the contract holds slightly more than it owes. That dust is distributable to future stakers but is not individually recoverable.
Estimated circulating supply: Cannot account for tokens in the Pons launch locker or the bonding curve. The true free float is lower than reported. See supply accounting.
RPC dependence: The interface reads chain state through an RPC. A failing or hostile RPC can make the display wrong. It cannot make a bad transaction succeed, because every contract re-validates its own preconditions.
Frontend spoofing: A cloned site could present malicious contract addresses. Verify addresses against the published list and Blockscout before approving anything.

Report it privately rather than publicly. See responsible disclosure.