Risks & limitations

This page is not a disclaimer appended for legal cover. It is the page a sceptical reader should read second, and everything on it is a real property of how LootFi works today.

There is no backstop

There is no insurance fund. There is no buyback programme. There is no price floor and no price guarantee on any token. Nobody is obliged to buy your token, and no mechanism exists to redeem it for anything other than the specific skin behind it.

If a risk on this page materialises, there is no pool of capital that makes you whole.

1 · Custody risk

A private operator controls the Steam account holding your skin.

This is the largest single risk, and it is not mitigated by any smart contract. Robinhood Chain cannot see a Steam inventory, cannot enforce a trade, and cannot punish a custodian. Between the moment your item leaves your inventory and the moment you accept a return offer, an operator has physical control of the asset.

Concretely, this means:

• An operator who chose to could trade a custodied item away. The token backing it would still exist, and would no longer be redeemable.
• A compromise of a custody account is a compromise of the items in it. Steam account security is a human and operational problem, not a cryptographic one.
• A Valve action against a custody account — a trade ban, a lock, a suspension — freezes the items in it, for as long as Valve decides.
• If the operator stops operating, tokens remain on-chain and tradable, but nothing off-chain would be processing withdrawals.

What actually reduces this risk is that custody is auditable: each token maps to one specific asset, withdrawal is gated on the item genuinely being held, and the protocol refuses to mint against an item it cannot confirm. That makes shortfalls detectable. It does not make them impossible.

See Custody model and Trust & security.

2 · Reversal risk

Steam can undo a completed trade, and that unwinds more than the one trade.

Valve's trade protection exists so a compromised account's trades can be reversed. When a reversal happens, the items go back to where they came from — which means an item that was about to back a token can vanish from custody legitimately, with no fault on either side.

Two properties make this sharper than it first sounds:

• The blast radius is per account, not per trade. A reversal on a Steam account can unwind all of that account's protected trades in the same window, not only the one that triggered it. The protocol responds by freezing every open deposit for that account and re-verifying each one before anything is allowed to mint.
• A reversal after minting is the dangerous shape. This is exactly why the hold is waited out in full before a token is created, and why an item that cannot be confirmed in custody at mint time parks for review instead of minting.

If a deposit of yours is reversed, no token is created and the item is back where it started — which is the correct outcome, but it is not instant and it is not something you can appeal to us. It is Valve's process.

Do not attempt to reverse a deposit trade yourself

Filing a reversal on a deposit you made deliberately does not produce a faster refund. It freezes every other open deposit on your Steam account, delays them all while each is re-verified, and — if it succeeds after a token minted — produces a token backed by an item that is no longer in custody.

See Trade reversals.

3 · Upgradeability risk

All three contracts are upgradeable, and an owner address can upgrade them.

LootSkins, LootMarket, and LootToken are UUPS proxies with an Ownable owner. The owner can replace the implementation behind each proxy. A replaced implementation can change essentially any behaviour described on this site, including behaviour you relied on when you deposited.

The owner can also, without an upgrade:

• change the platform fee, within the on-chain hard cap of 10%;
• change the royalty rate and its receiver;
• change the per-token withdrawal fee;
• change which addresses may mint;
• change the metadata base URI;
• pause the marketplace;
• allow or disallow collections and payment currencies.

Verify the owner yourself rather than taking a claim about it

The owner of each proxy is public on-chain state. Read it on the explorer rather than trusting any page — including this one — that describes who or what controls it. Deployments has the addresses; Admin & upgrades enumerates every privileged function.

This is a genuine centralization risk and it is the standard one for an upgradeable protocol. It exists because custody-backed assets need a way to respond to Valve changing its rules. That justification does not make the risk smaller.

4 · Chain risk

Robinhood Chain, chain id 4663, mainnet only. Every transaction is real and irreversible.

There is no testnet deployment. There is no practice mode. A mistake made against these contracts is made with real value, and nothing can undo it.

• Burns are irreversible. deTokenize destroys the token in the block it mines. If your saved trade URL is wrong or your Steam account cannot receive a trade, the token is still gone.
• Transfers are irreversible. Sending a token to a wrong or contract-only address loses it, permanently. The redemption right travels with the token.
• Overpayment on a withdrawal is not refunded. deTokenize charges a fee per token and does not return excess value. Send exactly the fee. See Fees.
• Wrong-network transactions. Confirm your wallet is on chain 4663 before signing anything. Contract addresses are not portable across chains.
• The chain is an L2 with its own liveness properties. Outages, sequencer issues, and RPC failures are possible, and during one you may be unable to trade or withdraw even though the protocol is otherwise fine.

Additionally, buying your own listing is rejected on chain. fulfillOrder reverts with SelfPurchase when the buyer is the maker, so a wash trade cannot be executed by accident or on purpose. See Buy.

5 · Data risk

Prices, floats, and item stats come from third parties and can be wrong, stale, or absent.

Item metadata — float value, paint seed, stickers, exterior — is resolved through external CS2 data services. Reference prices shown anywhere in the interface come from external market data. None of it is on-chain, none of it is guaranteed, and none of it is a valuation.

Specifically:

• A reference price is not an offer. It is informational. Nobody is committed to buying at it, and it may diverge substantially from what a skin actually sells for on Steam or anywhere else.
• Stats can be missing. A token can mint before its stats resolve, or with stats that never resolve because the item type is not inspectable at all — graffiti, cases, and capsules have no float or pattern to look up.
• null means "not looked up", not "zero". An absent float is an absence of information. paintSeed: 0 is a real seed and sometimes a valuable one. Treating either as "no value" is a bug, and it is a bug that can cost money if you are pricing off it.
• Third-party services fail. During an outage the interface may show older data rather than no data.

Verify item stats independently before making a purchase that depends on them. See Metadata and Reference prices.

6 · Steam-imposed limitations you cannot route around

Not risks exactly, but hard constraints that surprise people:

• The ~7-day wait before minting is Valve's. It cannot be shortened.
• Escrow on your account is yours. If your mobile authenticator is too new, Steam adds days to the hold and nothing on our side removes them.
• Steam throttles automated requests. When it does, deposits and withdrawals pause. Retrying makes it last longer. See Limits & timing.
• Valve's rules can change. Trade protection, escrow durations, and API behaviour are Valve's to alter, at any time, with no notice to us.

What LootFi does not promise

To be explicit, since the absence of a promise is easy to miss:

• No guarantee that a token can be sold, or sold at any particular price.
• No guarantee of liquidity, volume, or the presence of buyers.
• No guarantee that withdrawal completes within any stated time.
• No compensation for a Valve action against your account or an item.
• No statement, anywhere on this site, about the value, distribution, or future use of LootToken.

Next

• Trust & security — what you must trust, stated precisely.
• Custody model — how custody actually works.
• Getting started — if you have read the above and still want to deposit.