Risk Disclosure

You can lose everything you put in.

Digital assets are high-risk. You can lose some or all of what you hold, for reasons that have nothing to do with anyone's competence — a price move, an issuer's failure, a mistake you make once. Only commit what you can afford to lose entirely.

This disclosure is not exhaustive. It describes the risks we consider material today; new ones will exist tomorrow. It forms part of the Terms of Service.

Whoever holds the phrase holds the funds.

Your wallet is an Ed25519 key generated in your browser. Its 32-byte seed is surfaced to you once as a 24-word recovery phrase and stored on your device as ciphertext. There are three ways back into it, and none of them involves us holding anything that could open it:

1. The 24-word phrase. The root. It regenerates the wallet in full, anywhere.
2. Your passkey plus the stored backup. Cross-device restore from ciphertext we cannot read.
3. An optional recovery passphrase. A second, independent encryption of the seed, held only in the browser that created it.

What compromises a wallet

• Anyone who obtains your recovery phrase owns your funds. No phrase should ever be typed into a website, a support chat, a password manager note shared with someone, or a photo.
• Malware on your device, or a browser extension with access to this origin, can be sufficient. Script execution on the ccprime origin is total compromise of the wallet on it, which is why this site loads no third-party code at all — but your own device is outside that boundary.
• Phishing. Check the address bar before you tap a passkey prompt. Blueprint will never ask you for your recovery phrase or passphrase.
• If your authenticator cannot perform the WebAuthn PRF extension, the seed is wrapped under a passphrase you choose (PBKDF2-SHA256, 600,000 iterations). That is meaningfully weaker than hardware-held key material: an attacker who obtains the stored ciphertext can guess passphrases offline, at their own pace, at roughly the cost of one derivation per guess. A long, unique passphrase makes that expensive; it does not make it impossible. A passkey with PRF support is the stronger option wherever you have one.

Sending is irreversible

A transfer you sign and that settles cannot be recalled, reversed, or charged back — by you, by us, or by anyone. An asset sent to a wrong or mistyped address is gone. The interface prints party ids in full and never truncates one, precisely because a truncated address is how people lose money; read the whole thing before you confirm.

Prices move, and can go to zero.

• Digital-asset prices are volatile and can fall sharply, without warning and without a floor. Past performance says nothing about future performance.
• Canton-native instruments are, in general, thinly traded. A position that looks liquid at a small size may be impossible to exit at any size that matters, at any price you would accept.
• Some assets have no price history anywhere, because none exists to fetch. A chart on this site begins when we began recording it and grows from there; a short line is an honest one, not a stable one.
• The USD marks shown are read from one of three sources — our own Canton index, a public exchange listing checked against the pool ratio, or the on-network pool ratio itself — and are labelled with which. A mark is an indication, not a price you can transact at. An instrument with no readable source shows an em-dash, and is never estimated.
• A stablecoin is not a dollar. An asset marked at 1.00 is marked, not guaranteed, and can depeg.

You are holding somebody else's promise.

Most non-native assets on Canton are representations of an asset held somewhere else. Holding one means taking on the issuer's risk, its custody arrangements, its contract code, and the risk of both chains involved. Blueprint operates none of these routes and issues none of these assets.

• If an issuer becomes insolvent, is compelled to freeze assets, loses its reserve, or its contract is exploited, the asset on Canton may lose its peg or become worthless. There is no deposit insurance, and no claim against Blueprint.
• Redemption — getting the underlying asset back — is the issuer's process, on the issuer's terms, and may be restricted or unavailable. ccprime does not redeem.
• A bridged deposit is not instant. The USDC route waits for Ethereum finality before Canton mints — about 15 minutes — and value is in transit for that whole period, under Circle's control and not yours.
• The USDC deposit is addressed to your Canton party by a hash of its identifier. A wrong identifier produces a valid-looking address belonging to nobody and a mint that cannot be recovered. The encoder refuses to build the call at all unless its hash function passes a known-answer test at load — but it cannot tell whether the party you entered is the party you meant.

An automated market maker prices by size.

Routes are quoted against on-network liquidity pools. In a pool, the price you get depends on how much you are trading relative to how much is in it — so a larger order gets a worse average price than the quoted mid. That difference is slippage, and it is a property of the mechanism, not a fee anyone chooses.

• A quote is a reading, not a promise. It reflects pool state at the moment you asked. Between quoting and settling, another trade can move the pool and change your result.
• Every quote returns a minimum output. Check it. It is the worst case the route will accept on your behalf, and it is the number that protects you when the pool moves.
• The pool charges its own fee, returned on the quote as feePct and already priced into the output figure shown.
• Routes can be multi-hop. Where no pool pairs your two instruments directly, the route goes through Canton Coin — which means two pools, two lots of slippage and two pool fees.
• Liquidity can disappear. A pool that quotes a route today may be too thin to fill it tomorrow, or gone. Where no route exists, the venue says so rather than quoting one.
• Quotes depend on a third-party liquidity venue answering. If it is unreachable, the interface shows nothing instead of a guess — a router that invents a price is worse than one that admits it has no venue.

What the ledger can and cannot do for you.

Canton settles delivery and payment in the same commit. Both asset legs and the fee leg land together or the transaction is rejected whole — so there is no state in which one side has delivered and the other has not, and no settlement window during which a counterparty can fail. Finality is at commit; there is no confirmation count to wait out.

That removes counterparty settlement risk. It does not remove these:

• The network can be unavailable, congested, halted, or upgraded. Canton MainNet is operated by its super-validator set, not by Blueprint. A trade you want to make may be impossible to make at the moment you want to make it.
• Transactions consume synchronizer traffic. If the traffic a relay depends on is exhausted, submissions fail until it is replenished.
• A transaction can fail. Nothing moves when it does — which is the safe outcome, but it is still an outcome you did not want at a price you may not see again.
• An outcome can be unknown. Where a submission reaches the ledger and its result cannot be established, it is marked for reconciliation and resolved by an operator. It is never retried and never assumed failed — which is correct, and which also means resolution is not instant.
• Ethereum and Bitcoin carry their own risks — reorgs, congestion, fee spikes, forks — for any route that touches them.

Not everything here is finished, and it says which parts.

What is live and reading real data: the instrument roster and its marks, routing and quoting across every ordered pair, the settlement tape, the non-custodial wallet's key generation and recovery, and the USDC deposit route, which executes in your browser against Circle's own contract.

ccprime's security model has been designed deliberately and reviewed internally, including adversarial review that found and closed real defects. It has not been audited by an independent third party. Weigh that when deciding how much to hold here.

Code you are relying on that nobody can guarantee.

• Canton's token standard, the registries that implement it, the pools that hold liquidity, and the bridge contracts are all software written by third parties. Any of it may contain defects, and a defect in any of it can cost you the assets that depend on it.
• ccprime itself is software and may contain defects. The design is intended to ensure that a defect on our side cannot spend your funds — the server holds nothing that can sign — but no such intention is a guarantee.
• An upgrade to Canton, to a registry, or to a pool can change behaviour that this product depends on, at a time not of our choosing.
• Cryptographic assumptions can weaken. A browser can ship a change that breaks a primitive this wallet needs.

The service can be unavailable when you need it.

• ccprime is provided as-is and as-available. It can be down for maintenance, for an incident, or because an upstream it depends on is down. You may be unable to trade, deposit, or read a balance during that time.
• Access can be rate limited, throttled, or suspended — see the Terms.
• Blueprint may discontinue the service. Because custody never existed, your keys and your Canton party survive that: as long as you hold your recovery phrase you can restore the wallet in other software. If you do not hold it, a discontinued service is a lost wallet.
• Third parties this product reads — the liquidity venue, the chain index, the registries — can be unavailable or wrong. Where they are, the interface shows nothing rather than something invented.

The rules are not settled, and they are not the same everywhere.

• The legal treatment of digital assets, self-custodial wallets, and trading interfaces differs by jurisdiction and is changing. A change in law or its enforcement could restrict or end your ability to use this service or hold these assets.
• ccprime performs no identity verification and no geographic screening. That the software works for you is not a determination that your use of it is lawful where you are. Establishing that is your responsibility.
• Transactions may be taxable events. Blueprint provides no tax reporting, issues no tax forms, and gives no tax advice. Keep your own records — every trade is independently verifiable on a public explorer.
• Assets on a public ledger are not bank deposits and are not covered by any deposit-protection or investor-compensation scheme.
• [[OPERATOR: any jurisdiction-specific risk warnings required of you — e.g. a prescribed retail-client warning]]

Nothing here is a recommendation.

Nothing on ccprime — no quote, mark, chart, roster, tape, or piece of documentation — is investment, legal, accounting or tax advice, or a recommendation or solicitation to buy, sell or hold anything. Blueprint is not your adviser, agent, or fiduciary, and takes no view on whether any transaction is suitable for you.

You are solely responsible for your own decisions and for obtaining independent professional advice where you need it.