Whitepaper §11
11. Security and Failure Modes
Reproduced in full from the specification, unedited. Section 11 is where the design states what it has not proven.
Oracle capture. Control of the MCI is control of the unit. The defence is plural reporting with a median, a publicly reproducible basket so any observer can falsify a bad print, and circuit breakers that freeze the index and tighten minting on divergence or staleness. This raises the cost of capture sharply but does not reduce it to zero; oracle decentralisation is a permanent area of hardening, not a solved checkbox.
Collateral risk and the central failure mode. The honest worst case for any collateral-backed money is a violent, correlated drawdown — and for Humoney it has a specific shape: a systemic event that depresses collateral while simultaneously spiking food and energy prices raises the MCI at the very moment the Reserve is worth least. Four layers stand against it: over-collateralisation, the surplus buffer, the HMG recapitalisation backstop, and the metabolic-linked Reserve leg, whose value rises with the same prices that raise the index. The leg is what makes Humoney structurally better-defended here than a fiat- or basket-pegged design, because part of its backing moves with its obligation. It is a partial hedge, not a guarantee.
Governance and custody. The Metabolic Reference Basket and RH-BMR constant are the system's highest-value attack target, which is why their amendment sits behind the longest notice and highest threshold in the protocol. Real-world-asset and commodity legs add custodial and legal-recourse surface that pure crypto collateral does not; these dependencies are named, sized, and governed rather than assumed away.