User guide · Page 08
Risks and Disclosures
On this page
Magic Internet Finance is new software that holds real assets on Solana, and every Internet Wizard is a real financial position wearing a very good hat. This page lists, plainly, what can go wrong: the code, the markets, revenue drying up, swaps failing, third-party services wobbling, who holds which keys, what marketplaces do and do not enforce, when fees actually count as yours, and what this project is not. Read it before you conjure. Nothing here is a forecast, and nothing here is legal, financial, or tax advice.
The short version#
| Risk | What it means for you | What the protocol does about it | What it cannot do |
|---|---|---|---|
| Smart-contract | New code can have bugs; worst case is stuck or lost funds | Invariant tests, bounded parameters, no instruction can spend principal, independent review planned before public funds | Make bugs impossible; tests are not an audit |
| Market | MIFI, SOL, and tokenized BTC can fall in price | Returns exact token amounts on dispel | Guarantee any dollar value |
| Activity | Revenue can slow to zero | Labels each revenue source separately | Create revenue when nobody conjures or trades |
| Execution | Swaps can fail, slip, or wait | Rejects out-of-bounds swaps; SOL stays pending | Guarantee a price or a schedule |
| Integration | Meteora, Metaplex Core, Jupiter, Pyth, RPC, IPFS can degrade | Degraded modes; settlement and dispel keep working | Control third parties |
| Authority | Upgrade and admin keys exist | Multisig, bounded parameters, disclosed inventory | Remove the trust placed in key holders |
| Marketplace | Royalties are advisory; vaults change | Refresh-before-buy guidance, 100% of collected royalties to Mana | Force any marketplace to pay or protect you |
| Timing | Entitlement is set at receipt, not at trade time | Frequent claiming; visible "claimable, not received" | Eliminate the window entirely |
Smart-contract risk#
The MIFI program, keeper, indexer, and renderer are new code. New code has bugs until proven otherwise, and "proven otherwise" is a high bar.
An independent security review of the financial program is planned before it holds public funds. Until that review is published, treat the program as unreviewed. Passing tests, including the randomized accounting-model tests, are evidence of care, not an audit. If anyone (including us) points to a green test suite and calls it an audit, that is a red flag.
What the design tries to guarantee, in plain words:
| Intended invariant | Plain meaning |
|---|---|
| Principal is untouchable | No admin, keeper, renderer, or swap instruction can move the 100,000 MIFI in a Wizard's vault. Only dispel by the owner returns it |
| Liabilities are backed | SOL owed to Wizards never exceeds the SOL sitting in the reserve |
| Receipts count once | Every SOL receipt is recognized exactly once; every settlement leaves the reserve exactly once |
| One share, one exit | Transfer moves one position; dispel removes one share and cannot pay twice |
| Redemption is never pausable | Conjure, execution, and ingestion can be paused; settle_wizard and dispel cannot |
These are intentions enforced by code and checked by tests. A bug in the code, the tests, or the assumptions behind them could still cause loss.
Practical steps: start on devnet, then start small. Verify the program id, mint, and collection from official project channels before signing anything (this guide deliberately does not print addresses). Nobody from the project will DM you first.
Market risk#
Dispel returns tokens, not dollars. You get back exactly 100,000 MIFI plus whatever else your Wizard's vault holds. What those tokens are worth is up to the market, which does not consult us.
- MIFI can fall in price, including to near zero. Locking tokens into Wizards reduces freely circulating supply but does not create demand or burn supply.
- SOL can fall in price. Pending and retained SOL is SOL.
- Tokenized BTC (Orange Spell) is a tokenized representation of bitcoin on Solana. It is not native bitcoin in a bitcoin wallet. The configured tokenized BTC asset (shown in the app with its issuer, mint, and decimals) depends on its issuer's or bridge's custody model. Depending on that model, the asset may carry issuer controls such as a freeze or upgrade authority, may trade at a discount or premium to bitcoin, and may be redeemable for native bitcoin only through the issuer, on the issuer's terms. MIFI does not custody bitcoin and cannot make an issuer honor anything.
- NAV is an estimate. The app shows token balances first and an estimated NAV second, built from reference prices with a timestamp and a stale flag. A Wizard's market price on a marketplace can differ from its estimated NAV in either direction.
- Liquidity is not guaranteed. Selling 100,000 MIFI after a dispel depends on pool depth at that moment. Selling a Wizard depends on someone wanting to buy one, and a Wizard's market price can fall below what you paid for it or below its estimated NAV.
Your Wizard's MIFI is locked while it is active. You cannot sell that MIFI without dispelling the Wizard or selling the Wizard itself.
Activity dependence#
The Mana Pool is filled by activity. Not by magic, despite the name.
| Source | Where it comes from | What stops it |
|---|---|---|
| Conjure fees | New Wizards being conjured | Nobody conjures |
| Trading fees | Swaps on the MIFI/SOL pool, paid to protocol-controlled LP positions | Nobody trades, or the venue stops paying fees to us |
| Royalties | Marketplaces that choose to honor the advisory royalty | Marketplaces do not pay, or nobody resells |
| Direct deposits | Anyone sending SOL to the reserve | Labeled separately; never presented as trading revenue |
Rewards depend on new participants and on trading. Conjure fees come from new conjures. Trading fees come from trading. If activity stops, revenue stops, and Wizards simply hold what they already hold. The Mana page shows the mix by category so you can see how much came from each source.
Two smaller points that surprise people:
- Every active Wizard has exactly one share. More Wizards means each share of the same revenue is smaller. Rarity, age, art stage, and spell choice never change share weight.
- Revenue that arrives while zero Wizards exist goes to a visible bootstrap reserve. It is not allocated to the first Wizard as a windfall. Any later policy for it would be explicit and visible before it takes effect.
Sub-lamport rounding remainders from division become nonclaimable accounting dust. It is tiny, it is disclosed, and it is not anyone's.
Execution risk (spells)#
Orange and Infinity spend your pending SOL on a swap. Swaps happen on a live market and can fail, slip, or wait.
| Failure | What you see | What happens to your SOL |
|---|---|---|
| Price moved beyond the slippage bound | Execution rejected on-chain | Stays pending in your Wizard's vault |
| No executable route (Jupiter or pool unavailable) | Keeper skips your Wizard | Stays pending |
| Oracle stale or uncertain (Orange) | Execution rejected on-chain | Stays pending |
| Amount below the minimum viable swap | Not attempted yet | Accumulates until it is economical |
| Keeper offline or out of budget | Executions pause | Stays pending; you can self-execute and pay the network fee |
How the bounds work, briefly. Each execution is capped by a per-execution maximum and a minimum. Infinity checks output against the pool's spot price with a maximum price-impact bound. Orange checks output against Pyth SOL/USD and BTC/USD reference prices with maximum age, maximum deviation, and confidence bounds. The keeper cannot set an arbitrary near-zero minimum output. If the flash-fill route is used, the transaction fails as a whole if the second half is missing, and the lamports never leave.
Residual risks the bounds do not remove:
- A pool's spot price can be nudged in a prior transaction. The per-execution cap and the keeper's off-chain pre-check limit the damage; they do not make it impossible.
- Only the Wizard's owner or the configured keeper can trigger execution. That limits who can time your swap, but it does not stop other traders from moving the market around it.
- All three spells receive the same gross SOL entitlement for the same period. Realized outcomes differ with prices, slippage, pool fees, and timing. No spell has a multiplier. Infinity "compounds" tokens in your vault; it never increases your share of revenue.
- Changing spells affects unprocessed and future SOL only. It never sells what you already hold. Queued jobs for the old spell are rejected by a strategy nonce.
- Orange is unavailable until the tokenized BTC asset is configured. Until then, the app will not let you select it.
Network fees for keeper executions are paid from the protocol's operating budget, never deducted from your entitlement. If that budget runs dry, the keeper waits and you may execute your own spell and pay the network fee yourself.
Integration risk#
MIFI stands on other people's software. When it wobbles, so do we, in specific and mostly recoverable ways.
| Dependency | Used for | If it degrades | What keeps working |
|---|---|---|---|
| Meteora DBC and DAMM v2 | Token launch, trading, LP fee source | Trading fees may stop or become unclaimable; a venue change could strand fee routing since the fee claimer and pool creator are fixed at creation | Conjure, settle, dispel, Sol Spell |
| Metaplex Core | The Wizard NFT and the burn restriction | A Core version change or unproven marketplace behavior could limit where Wizards can be listed | Ownership, transfers, dispel through MIFI |
| Jupiter | Orange Spell routing | Orange executions pause | SOL stays pending; Sol and Infinity unaffected |
| Pyth | Price references for Orange bounds and NAV estimate | Orange executions rejected; NAV shows a stale flag | Everything else |
| RPC (served through the app's proxy) | Reading chain state, sending transactions | The app cannot read or act | Chain state is unchanged; you can use another RPC or wallet |
| IPFS pinning and metadata service | Wizard images and metadata | New renders delay; site shows stale state | Previously pinned images remain content-addressed and retrievable; financial rights are unaffected |
| Indexer and database | Histories, lists, statistics | Views lag or go empty ("no data yet") | Never authoritative; ownership is rechecked on-chain for every action |
| Keeper | Claiming, ingesting, settling, executing | Venue fees stay claimable but not yet received; executions pause | Anyone can call ingest and settle; owners can self-execute |
Degraded modes are labeled in the app rather than papered over. Empty states say "no data yet" instead of showing a made-up number.
The burn restriction deserves its own line. A plain Core NFT can be burned by its owner, which would strand collateral. MIFI uses a Core Oracle plugin so that burns outside dispel are rejected while transfers stay unrestricted. This has to be proven against the exact deployed Core version and tested on devnet, including against marketplaces. If a marketplace turns out to be incompatible, the app will say so rather than pretend.
Authority risk#
Some keys can change things. Here is who holds what and what each can do.
| Authority | Holder (mainnet) | Can | Cannot |
|---|---|---|---|
| Program upgrade authority | Multisig, disclosed policy; timelock recommended | Replace the program code, which in principle reaches everything | — (see the caveat below; this is the largest single trust assumption) |
config.admin | Multisig | Change bounded parameters, pause conjure/execute/ingest, set the keeper, add art catalogs, withdraw from the protocol treasury, re-point metadata URIs | Change principal, decimals, mint, or collection; pause settle or dispel; touch any Wizard vault |
config.keeper | Operations hot wallet | Claim and ingest fees, settle Wizards, execute spells within program limits | Withdraw anything; pick a spell for you; move principal |
| Collection update authority | Program-derived address | Sign asset creation and burns inside MIFI instructions | No instruction exists to remove plugins, add permanent delegates, or hand the authority elsewhere |
| MIFI mint authority | Expected to be none after launch | — | Mint more MIFI (verify in the published authority inventory) |
| Protocol treasury | Program-derived address; admin withdraws | Fund operations and keeper network fees from the protocol's share of fees | Hold Wizard principal or Mana; those live in separate accounts |
Parameters the admin can change are bounded in the program:
| Parameter | Proposed launch default | On-chain bound |
|---|---|---|
| Conjure fee | 0.05 SOL | At most 1 SOL |
| Mana share of fees | 80% (20% protocol) | Between 50% and 100% |
| Dispel fee | 0 SOL | — |
| Per-execution maximum and minimum | Set from measured costs | Configurable |
| Slippage, oracle age, deviation bounds | Set from measured liquidity | Configurable |
| Pause bits | Off | Conjure, execute, ingest only |
What cannot change through configuration: the 100,000 MIFI principal per Wizard, the one-share-per-active-Wizard weight, the mint, its decimals, and the collection. Serials are never reused.
An honest caveat: a program upgrade could in principle change anything, including the items above. The mitigation is who holds the upgrade key and the disclosed policy around it, not arithmetic. The full authority inventory is published with each deployment; read it, and watch for a timelock.
Marketplace and royalty limitations#
Wizards are ordinary Core NFTs with unrestricted transfers, so they should list on compatible marketplaces. Some things to know:
- Royalties are advisory. The proposed 5% royalty uses Core's
Nonerule set. Marketplaces and wallets may pay it or ignore it. Never assume every resale contributes to Mana. Royalties that are actually collected go 100% to Mana. If a marketplace cannot pay to a program-derived address, the payment lands in the reserve and is still shared, but it is counted under direct deposits rather than royalties, because the program cannot tell the two apart. - Compatibility must be verified. Marketplace support for the burn restriction and for Core plugins varies by version. Anything unverified is labeled an integration gap in the app.
- The vault travels with the NFT. A listing shows a Wizard whose balances can change before the sale executes: the seller may execute a spell, change spells, or dispel (which burns the NFT and voids the listing). Refresh ownership and balances immediately before buying. An estimated NAV label is not a binding quote.
- Selling sells your entitlement too. Unsettled Mana belongs to whoever owns the Wizard when it settles. Nothing is reset or refunded to the seller.
- Escrow changes who the owner is. If a marketplace holds your Wizard in escrow, the on-chain owner is the escrow, so you cannot execute, change spells, or dispel until it is back in your wallet. Accrual continues regardless; the share does not care who is holding the hat.
- No transfer tax, no MIFI marketplace. The token has no transfer hooks. MIFI does not run its own exchange; listing happens on third-party venues with their own terms and risks.
Timing: receipt-time entitlement#
MIFI uses receipt-time entitlement. Your share of a fee is fixed by who is active at the moment the SOL is received and ingested by the protocol, not by who was active when the trade that generated it happened.
Consequences:
- Trading fees accumulate on the venue first and are not MIFI revenue until claimed and ingested. The app shows "claimable on venue, not yet received" separately from money that has arrived.
- Someone who conjures just before a large claim lands shares in it. Someone who dispels just before misses it. The keeper claims frequently (proposed default: roughly every 10 minutes and whenever the claimable amount crosses a threshold) to keep that window small. It cannot make it zero.
- Your own conjure fee goes to the Wizards that existed before you. New Wizards start at the current index with zero historical entitlement.
- Revenue that has been received is allocated immediately; it is never held back until a processing threshold. The proposed default of executing spells when aggregate pending SOL reaches 10 SOL or on a periodic scan applies to swap execution, not to who is owed what.
Other limitations worth knowing#
- At most 10,000 Wizards can be active at once. When the cap is reached, conjure is unavailable until someone dispels.
- Dispel is final. That serial and that character are never minted again.
- The permanent art-identity reservation account's rent is non-refundable and is shown in the conjure quote. Other account rent is returned on dispel under the documented refund policy.
- The target exit is a single atomic transaction. If transaction limits force a two-step
EXITINGpath on the deployed version, the app will say so; in that state the Wizard cannot be transferred, earn, or execute, and completion pays only the fixed recipient. - Artwork labeled PROTOTYPE is programmer-drawn placeholder art that proves the rendering system. It is honestly labeled in the app and is to be replaced by an artist-approved catalog before mainnet. Art, stage overlays, and trait rarity are cosmetic and never affect rewards.
Not affiliated#
Magic Internet Finance is a new project inspired by the internet wizard aesthetic. It is not affiliated with, endorsed by, or a continuation of any prior "Magic Internet Money" project or token, any Bitcoin organization or foundation, or any exchange. The issuer of the configured tokenized BTC asset is an independent third party. Meteora, Metaplex, Jupiter, Pyth, and the RPC and pinning providers are independent services MIFI integrates with, not partners, unless stated otherwise.
Bitcoin is the lore. Solana is the settlement network. Nobody here speaks for either.
Jurisdiction and taxes#
This is general information, not advice.
- Digital assets are regulated differently in different places, and some places restrict or prohibit them. You are responsible for knowing whether you may use MIFI where you live.
- Conjuring, dispelling, changing spells, spell executions (which are swaps), transfers, and sales may each be taxable events in your jurisdiction. Rules and rates vary widely.
- Keep records. Wizard profiles and the archive retain transfer history, spell history, executions, and timestamps to help, but they are not tax documents.
- Talk to a qualified professional in your jurisdiction if you are unsure. We are wizards, not accountants.
Before you conjure#
- Confirm the program, mint, and collection addresses from official project channels.
- Read the quote line by line: principal, non-refundable action fee, refundable and non-refundable rent, network fee.
- Decide whether you are comfortable if MIFI, SOL, or tokenized BTC falls sharply.
- Understand that revenue depends on conjures and trading, and may stop.
- Try it on devnet first.
Related pages#
Source: docs/guide/08-risks.md. This page describes a protocol still being built; values marked "proposed default" may change within on-chain bounds, and nothing here is a forecast.