> For the complete documentation index, see [llms.txt](https://docs.familio.trade/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.familio.trade/the-product/rules-and-safety-rails.md). # Rules and safety rails The vault is built around two promises the Solidity keeps: 1. The head can **never** withdraw a member's funds. The only way value leaves is an allow-listed swap whose output lands back in the vault, a pro-rata distribution members claim, or a member's own exit. 2. The head can **never** block an exit. `leave` / `leaveWith` ignore `joinsLocked` and `tradingLocked`. ## Single-trade cap (`maxTradeBps`) A **buy** may spend at most `maxTradeBps / 10_000` of the vault's **free quote** in one `swap`. 10\_000 = 100% (off). The create wizard's "single-buy cap" is this number. Sells are not capped, so getting out of a bag is always one transaction. At creation, passing `maxTradeBps = 0` is treated as 100%. After launch, `setCaps` rejects 0. ## Minimum head skin (`minHeadShareBps`) If this is > 0, `swap` reverts unless `shares[head] / totalShares` is at least that fraction. Members see it as a badge. If the head's share falls under the line (they left, or the family grew and they did not top up), **nobody can trade** until the head deposits more or members leave. The wizard allows 0–50%. The contract allows up to 100%. Friends families default to 0; KOL families default to 5%. Skin is measured on the **current** head. After a head transfer, the new head needs their own shares. ## Joins lock and trading lock `setLocks(joinsLocked, tradingLocked)` — head or co-pilot. * **Joins locked** — no new members and no top-ups. Exits still work. * **Trading locked** — no swaps (head included). The "I'm asleep" switch. Co-pilots can flip it, so a KOL can go to sleep and leave trading unlocked for the crew, or lock the wheel entirely. These are vault-level. They do not pause exits. ## Protocol-level trading pause The factory owner (protocol) can set `tradingPaused`. That stops **joins and swaps on every family**. It never touches exits and never moves balances. It is an emergency halt, not a custody switch. ## Time-boxed exit pause The factory owner can set `exitsPausedUntil`, at most **72 hours** from the moment of the call (`MAX_EXIT_PAUSE`). `leave` / `leaveWith` / `evict` revert until that timestamp. This is the only way exits pause, and it cannot roll: after a pause is scheduled, the contract requires **72 hours of open exits** past its scheduled end before another pause can start (`PauseCooldown`). Lifting a pause early does not shorten that gap, so a stuck-forever freeze is impossible by construction, not by policy. {% hint style="warning" %} An exit pause is a protocol incident, not a head tool. If you cannot leave, check the factory's `exitsPausedUntil` on the explorer before assuming the vault is broken. {% endhint %} ## Router allow-list Every `swap` and every join leg must go to a router the factory has `setRouter`'d, with a flag for whether that router pulls via Permit2. On Robinhood Chain that is currently Uniswap's Universal Router (Permit2), SwapRouter02 (plain approval), and familio's [PonsAdapter](/the-product/trading.md). A router that is not listed cannot be called. The vault never sends tokens to an arbitrary address. ## Token block list `tokenBlocked` at the factory is an emergency switch, not a policy list. **Nothing is blocked today.** Families trade what Robinhood Chain trades: memecoins, the Stock Tokens they are paired with (GME, NVDA, TSLA, SPY…), and the holder rewards those launches pay out — which arrive in the pair token, so a family holding a GME-paired meme collects GME. A blocked token could appear as neither `tokenIn` nor `tokenOut`, which would also stop a family selling a reward it had already received; that is why the list stays empty. If the treasury ever has to block a token (an exploit, a legal order), the check is on what the trust buys or sells, not on what a router passes through: a memecoin paired with GME is bought ETH → GME → meme inside `PonsAdapter` in one call, the vault's `tokenIn` is WETH, its `tokenOut` is the meme. See [trading](/the-product/trading.md#tokens-paired-with-a-stock). ## What the head still can do (and the risk) The head chooses what to buy, when to sell, when to distribute, and which bags to ignore. They can lose the vault to zero in the market. They can mark a valuable bag ignored and then join (a trust failure the code does not prevent). They can evict you — you still receive your full slice. They cannot take your slice for themselves. Read [Security](/developers/security.md) for the rest of the trust model. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.familio.trade/the-product/rules-and-safety-rails.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.