SKYBound Risk Disclosures

DEFINITIONS

“DAO” means the advisory governance body established under the DAO Constitution.

“SKYBound” refers collectively to (i) SKYBound Travel Platform; (ii) SKYBound Network and (iii) SKYBound DAO LLC and the DAO.

“SKYBound Travel Platform” means the consumer facing membership and travel booking platform operated by Skybound Travel and described in the Terms of Service.

“SKYBound Network” means the underlying network infrastructure on which Proof-of-Impact events, member engagement, and SKY token activity are recorded.

“SKYBound DAO LLC” means the Wyoming organized decentralized autonomous organization limited liability company.

“Node” means the digital infrastructure that authorizes the holder to deploy and operate the software required to perform engagement validation, Proof-of-Impact verification, and rewards-processing tasks within SKYBound.

“Node Licenses” mean the contractual licenses governing the operation of Nodes.

“Node operator” means the holder of a Node.

GENERAL RISKS

SKYBound Network is a pre-revenue project with no operating history. SKYBound DAO LLC has not previously launched a public blockchain.

SKYBound Network is still in its preliminary phase. The live, fully operational blockchain on which live transactions will be processed and recorded (the “Main Net”) has not been released, no blocks have been produced, and no users have paid gas or service charges. Consequently, there are no historical metrics such as uptime (the percentage of time the blockchain operates without interruptions), Node operator retention (how many Node operators continue to participate over time), security incidents (breaches or attacks on the network), or transaction throughput (the number of transactions processed per second) on which prospective license holders or token recipients can base an assessment of future performance. No technical milestones that underpin revenue (final security audit, public test-net hardening, Main-Net genesis, and feature roll-outs) has been reached. Any slippage in these milestones could materially delay network launch, shrink the first-mover window, or necessitate costly redesigns.

Execution risk is amplified by the fact that SKYBound DAO LLC has not previously delivered or operated a public Layer 1. A Layer 1 blockchain is the foundational layer of a blockchain network, functioning as the base infrastructure where transactions are processed, validated, and finalized independently, without relying on external networks for security or consensus. Both Layer 1 and Layer 2 represent scaling solutions designed to improve blockchain transaction speeds, but they operate fundamentally differently: Layer 1 scaling solutions often involve changes made directly to a blockchain’s core programming that enhances its native ability to handle varying transaction volumes, meaning it remains a fully independent blockchain like Bitcoin or Ethereum whereas Layer 2 scaling solutions are supplementary programs, networks, or other blockchains that take on some of a primary chain’s work (similar to how Polygon processes transactions for Ethereum), execute these transactions separately, and periodically send the consolidated data back to the main chain to be permanently recorded. Building a regulated, work-rewarded blockchain demands deep expertise in distributed-systems engineering, cryptography, economic game theory, and protocol-level governance disciplines that differ markedly from traditional financial services or SaaS operations.

Lack of direct experience increases the probability of design flaws, underestimated infrastructure costs, and misaligned feature priorities. In addition, management must rely on third-party auditors, external security researchers, and community testing to validate code quality – controls that, while valuable, may still fail to uncover lateral defects before critical functionality goes live. If unforeseen vulnerabilities or architectural shortcomings emerge after launch, they could force emergency network upgrades requiring all Node operators to simultaneously update their software or even chain resets that erase recent transaction history and restart from an earlier point, eroding stakeholder confidence and slowing adoption at the most vulnerable stage of the project’s lifecycle.

Near-term liquidity depends almost entirely on one-time community Node License sales, leaving the project highly sensitive to market conditions and broader “crypto-winter” downturns.

Until SKYBound Network begins processing on-chain transactions, its primary source of working capital is the upfront fee paid by the Node operators who purchase non-transferable Node Licenses that grant the right to validate platform interactions and engagement events, earn digital rewards in the native token (“SKY”), and participate in the DAO. Although management has reported indications of interest for a significant minority of the targeted 2,000 licenses, these are non-binding and may be withdrawn or renegotiated.

The funding model is doubly exposed to macroeconomic shocks and cyclical downturns in digital-asset markets. Historically “crypto-winter” periods have featured token-price declines of seventy percent (70%) to ninety percent (90%) and share contractions in venture funding and Node operator attrition across multiple Layer 1 ecosystems. A similar downturn would not only reduce the fiat value prospective operators are willing to allocate to license purchasers but also depress the SKY-denominated emissions that are anticipated to later supplement node rewards.

Lower token prices and reduced trading volumes could, in turn, postpone the network’s planned transition from predetermined token distributions to a system funded entirely by user-paid transaction fees, extending reliance on the finite pool of tokens reserved for network operations. If the DAO is forced to slow or pause development during such a downturn, it risks ceding market share to better-capitalized competitors, eroding brand credibility, and triggering a negative feedback loop in which diminished confidence further suppresses license sales and Node operator participation.

Selling node licenses before the technology is fully developed and available could expose the platform to legal risks.

Consumer protection agencies are vigilant to ensure companies deliver products and services for which consumers pay in advance. By pre-selling node licenses before delivery is possible, the DAO LLC risks not being able to fulfill its transactional commitment to pre-purchasers. The DAO LLC is dependent on revenue that has not yet been earned and software development that has not yet been completed. If revenue is insufficient to fund development, if development costs overrun budgets, if development runs into technological blockers or challenges, or if other unforeseen delays occur in development, the DAO LLC may not be able to fulfill its pre-orders or refund pre-orders as it has promised. In this case, the DAO LLC could face regulatory enforcement actions, civil litigation, or other legal exposure.

RISKS RELATED TO TECHNOLOGY & CYBERSECURITY

Novel hybrid consensus and commit-reveal oracle architecture may harbor undiscovered vulnerabilities that corrupt ledger state or halt block production.

SKYBound Network departs from a “plain” Cosmos-SDK chain by inserting a parallel commit-reveal oracle layer: licensed nodes first broadcast cryptographic commitments, then reveal the underlying payload in a second round. This design assumes honest-majority timing, deterministic ordering, and strict quorum participation, none of which has yet been validated under real-world latency, adversarial traffic, or partial-network partitions.

If timing windows are too tight or if bandwidth spikes delay reveal messages Node operators could arrive at different views of the pending oracle batch, producing conflicting block proposals. Such divergence forces a “last man standing” scenario in which one fork must eventually be abandoned, rolling back user transactions and damaging confidence in finality. Worse, an attacker who controls a minority of Node operators might exploit race-conditions or message-replay gaps to inject fabricated commitments that pair with bogus reveals, seeding false data without exceeding classical one-third Byzantine thresholds – the fundamental security limit where the system remains secure as long as less than one-third of participants are malicious.

Commit-revel, a two-step process where nodes first submit encrypted data commitments then reveal the actual data, also introduces an economic layer: nodes are slashed – meaning they lose a portion of their staked tokens as a penalty – for inaccurate submissions. The staking logic for that slashing lives in custom Rust modules, which are programs written in the Rust programming that have not undergone formal verification, an arithmetic error or variable-overflow bug that causes numbers to exceed their maximum values and reset could miscalculate penalties, either allowing dishonest nodes to evade punishment or, conversely, slashing innocent operators and triggering legal claims. Because the oracle lawyer and core consensus execute in parallel, patching one side without the other risks breaking interface contracts or necessitating a blockchain fork where the network splits into incompatible versions, each of which would represent a highly complex governance maneuver.

Finally, external security audits, even by reputable firms, tend to focus on static code paths that represent normal execution flows. Timing-dependent faults, emergent behaviors that only appear when many operations occur simultaneously, and complier-specific edge cases often reveal themselves only after months or production stress. Should a catastrophic flaw appear after main-net launch, the network may need a coordinated Node operator halt and emergency binary upgrade where all operators must simultaneously stop the network and install new software, an operation that can take a long time to organize and expose all on-chain applications to settlement risk in the interim. Such fixes on other blockchain networks have had a material negative impact on those projects.

Dependence on external “Trusted Applications” that inject data into the oracle-ledger layer concentrates systemic risks; a single compromised application can propagate incorrect information across the entire chain even though oracle ledgers are run by licensed nodes.

SKYBound Network’s architecture assigns every licensed node the ability to operate oracle ledger nodes collect data, create cryptographic fingerprints of that data through a process called hash-commit, and later reveal payloads such as market quotes, compliance attestations, and AI analytics. To keep bandwidth manageable and reduce duplicate crawling of the same data sources, most nodes are expected to subscribe to a set of designated “Trusted Applications.” These applications operate outside the Network itself but remain subject to DAO governance rules, they collect raw data (e.g. price ticks from primary exchanges, sanctions updates, or corporate-action feeds) and broadcast it to the oracle-ledger network for aggregation.

While this model preserves decentralized validation – multiple nodes must still agree on the hash-commit before a reveal is accepted – it centralizes data origination in a limited number of application endpoints. If any Trusted Application’s Application Programming Interface (“API”) keys, which function as secure digital passwords for system-to-system communication, are stolen, Domain Name Service (“DNS”) records are hijacked, or software is updated with malicious logic, every downstream node that relies on that feed will dutifully commit the falsified payload. Because the commit-reveal protocol checks only that the hash matches the later reveal, syntactically correct but economically false data can clear consensus with a super-majority of honest nodes still singing blocks.

The effects cascade rapidly. Smart contracts that depend on the polluted oracle channel stable-coin over-collateralization, margin calls, risk-rating for tokenized bonds will trigger on-chain transfers within the same block height. Correcting the ledge after finality would require a hard-form rollback, or contract-specific claw-back logic, each a governance-intensive, credibility-damaging process. Even if economic losses are reimbursed, counterparties may sue Node operators for negligence, arguing that the Node-License framework implies heightened duty of care in vetting their data supply chain.

Attempts to mitigate risks, such as requiring multiple independent data sources to agree before accepting information, conducting random verification checks against alternative reference sources, and using time-weighted median calculations to smooth out anomalies reduce, but do not eliminate the risks. During thin-liquidity windows overnight sessions or in niche asset classes data diversity may be purely notional; all Trusted Applications can ultimately trace back to the same handful of primary venues. Furthermore, implementing sophisticated anomaly-detection logic at the node level increases compute overhead, potentially discouraging small operators and undermining decentralization goals.

In the event of a systemic Trusted Application compromise, the DAO could face regulatory scrutiny for inadequate third-party vendor management, breach notification obligations under data-integrity statutes, and reputational loss that impairs future license sales and institutional onboarding.

Introducing CosmWasm smart-contracts, cross-chain bridges, and other extensibility layers greatly enlarges the attack surface that hackers can potentially exploit.

CosmWasm is a framework that enables developers to create and deploy smart contracts on the blockchain. It unlocks powerful composability allowing third-party teams to build lending pools, payment rails, NFT platforms, and AI agents directly on-chain but every contract deployed brings its own programming vulnerabilities and security risks. Re-entrance attacks where malicious contracts repeatedly call functions to drain funds, unchecked external calls, integer-overflow errors that occur when numbers exceed their maximum values, and improper authorization checks have collectively drained billions of dollars across Ethereum, BNB Chain, and other ecosystems. CosmWasm’s multi-language tool-chain and WebAssembly (“Wasm”) metering add complexity: subtle discrepancies between Rust compiler versions or Wasmer runtimes can yield divergent execution paths, defeating audit assumptions.

Cross-chain bridges that connect different blockchains to enable asset transfers pose an even higher single-point-of-failure risk. Most rely on multi-sig Node operators requiring multiple signatures to approve transactions, light-client proofs, or optimistic rollups that assume transactions are valid unless proven otherwise; each model has suffered critical exploits from the Ronin and Harmony multi-sig key thefts to design flaws in Nomad’s optimistic verification.

Post-incident recovery is slow. Contracts are immutable unless explicitly upgradable, yet upgrade paths themselves can be hijacked (via “evil delegatecall” patterns) or blocked by governance deadlock. Even after a fix, liquidity and developer mindshare might migrate permanently to competing chains deemed “safer,” undercutting one of SKYBound Network’s main growth levers.

Continuous security auditing, bug-bounty programs, and formal-verification tooling reduce but do not remove the threat. Audits catch known antipatterns; they rarely simulate adversaries chaining multiple low-severity bugs across modules. Bug-bounties pay only if hackers behave ethically, an assumption that collapses when exploit value reaches eight or nine figures. Formal verification is expensive, time-consuming, and currently infeasible for many complex Wasm contracts.

Centralized storage and on-chain referencing of license-holder KYC/AML data expose the network to privacy law conflicts and high-impact data-breach liability.

Node onboarding captures passports, corporate registration documents, proof-of-address scans, beneficial-owner declarations, and sanctions-screening results. This trove sits in an off-chain database operated by the DAO’s compliance vendor, while a hashed reference is written to the blockchain for auditability. A breach of the off-chain store whether via credential stuffing, insider threat, or supply-chain compromise would reveal sensitive data on hundreds or thousands of operators, many of whom run mission-critical infrastructure for other customers. The reputational fallout could deter future license applicants, pushing Node operator counts below decentralization targets and prompting regulators to question whether the DAO exercised “reasonable” safeguards.

The design also risks regulatory incompatibility with privacy regimes. Under the EU GDPR and similar laws, data subjects have rights to rectification to correct inaccurate information and erasure to have their data deleted. Once a hash of a personal document is committed to an immutable ledger, true deletion is impossible. Supervisory authorities could interpret this as non-compliance, levy fines up to 4 % of global turnover, or order geo-blocking of European participants preventing them from accessing the network, fragmenting the Node operator set and liquidity pools.

Conversely, sanctions-screening demands continual updating. If the DAO fails to propagate a newly added Office of Foreign Assets Control (“OFAC”) designation promptly, a blacklisted entity might continue operating a node or providing oracle data, implicating every counter-party block signer in a potential facilitation offense. Because each full node stores a complete chain history including sanctions-status hashes, retroactive removal is unworkable; the DAO would need to demonstrate robust preventative controls or face enforcement.

Implementing end-to-end encryption, periodic key rotation, zero-knowledge proofs for credential validity, and differential-privacy techniques can mitigate but not nullify these hazards. Each added safeguard complicates onboarding workflows, increases gas costs for identity attestations, and must itself be audited for side-channel leaks. The DAO therefore operates under a narrow margin for error: secure enough to satisfy regulators and enterprise users, yet streamlined enough to avoid deterring the very Node operators whose participation secures the blockchain.

RISKS RELATED TO GOVERNANCE & THE ECOSYSTEM

Large license holders could obtain significant voting power and capture the DAO’s governance mechanisms, effectively controlling the network’s decision-making processes.

The DAO operates partially as a decentralized autonomous organization where token holders vote on network decisions and is intended to balance influence among staked SKY, licensed-node ownership and anti-whale limits designed to prevent any single party from gaining too much control, yet its own white paper concedes that voting weight ultimately tracks token and license holdings, subject only to “address caps per entity.” Wealthy early participants or corporate syndicates acting through multiple subsidiaries could accumulate a decisive share of both assets, especially while license sales and token emissions are still ramping. Once a single bloc controls quorum, it could:

• Redirect treasury flows to projects it owns, starving rival proposals;

• Amend slashing rules or Node operator-seat caps to entrench its dominance; or

• Veto upgrades that reduce its economic advantage (e.g., re-weighting gas-fee splits).

Because DAO resolutions are designed to be enforced by immutable smart contracts, minority stakeholders would have little practical recourse short of organizing an emergency fork, a remedy that fractures liquidity, confuses regulators and undermines confidence in the blockchain’s finality guarantees. Even if legal “governance caps” survive litigation, enforcing beneficial-ownership disclosure across global shell entities is notoriously difficult, leaving a persistent capture vector.

Low DAO voter turnout could delay urgent governance proposals (including security patches or compliance updates), and concentration of governance tokens in early adopters could give a small group of holders disproportionate influence.

DAO proposals, including critical security patches or compliance updates, require minimum participation thresholds set in its Constitution. If a majority or plurality of Node operators view governance as burdensome or lack the technical background to evaluate upgrades, proposal turnout could drift below quorum, freezing the protocol in a vulnerable state for days or weeks. A similar risk exists in the design of the consensus layer DAO proposals, including critical security patches or compliance updates, require minimum participation thresholds set in its Constitution. A similar risk exists in the design of the consensus layer: the DAO Constitution sets a 10% participation quorum for binding governance votes, a 60% supermajority for ordinary Constitutional amendments, and a 75% supermajority for emergency amendments. To moderate concentration, the Constitution caps any single holder (including affiliated wallets and entities acting in concert) at 40% of total token supply during the first six months following the Minimum Viable Product Launch, 30% during the next six months, and 10% thereafter. Despite those guardrails, governance tokens may still concentrate among a relatively small group of early adopters, particularly during the front-loaded Year 1 emission, and that concentration could allow a few holders to drive — or block — proposals (including security or compliance amendments) before the long-term concentration caps fully phase in. The Company also retains a limited veto authority over DAO proposals under the Constitution, so even a successful DAO vote may not be implemented if the Company exercises its veto on the bases enumerated in the Constitution.

During holidays, regional outages, or sustained network downturns, the pool of active Node operators willing and able to perform engagement-validation work could thin. A smaller active operator base could slow processing of Proof-of-Impact events, increase the proportion of work concentrated in a few operators, and — if accompanied by low DAO voter turnout — leave the platform without a timely governance response to operational, security, or compliance issues. Until DAO membership and Node-operator participation reach steady-state levels, the network is more vulnerable to participation shortfalls than a mature platform would be.

Governance inertia compounds the problem: amending the DAO Constitution itself requires a 60% supermajority (or 75% for emergency amendments) and a 15% quorum, and lowering the quorum threshold or modifying the anti-whale concentration caps would itself require a successful vote. Should a malicious actor exploit a lull in turnout — for example, by circulating a phishing or otherwise misleading proposal during a quiet period — honest members could fail to mount a timely defense, resulting in approved changes with unforeseen consequences. Protracted governance delays or platform unavailability could draw regulatory scrutiny, impair member acquisition, and undermine the platform’s ability to deliver the engagement and rewards features described in the Terms of Service.

The SKY emission curve is steeply front-loaded, concentrating roughly half of total supply in Year 1 and creating sharp post-Year-1 reward dilution.

The Whitepaper specifies a fixed total supply of 500,000 SKY and a one-year halving emission (E₀ = 250,000) under which approximately 50% of total SKY is distributed in Year 1, 25% in Year 2, 12.5% in Year 3, and so on, converging asymptotically to the 500,000 cap. Node operators and members joining after Year 1 will compete for a meaningfully smaller pool of SKY emissions, and Node operator and member rewards measured in SKY may decline sharply year-over-year regardless of platform growth. The front-loaded structure may concentrate token holdings in early adopters (subject to the Constitution’s anti-whale concentration caps) and may create misaligned expectations between early and later participants.

SKYBound Network’s Proof-of-Impact validation depends on AI and oracle systems whose outputs may be inaccurate, manipulable, or contested.

The Whitepaper’s “Verification Layer” relies on a combination of AI models and oracle inputs to score and verify travel-related impact events. Like any AI/oracle system, these components may produce false positives (rewarding fabricated, exaggerated, or duplicative impact events), false negatives (failing to credit legitimate impact), inconsistent scoring across similar events, or systemic bias against particular traveler profiles, regions, or activities. Adversaries may attempt to game the verification logic — through coordinated activity, image or geolocation spoofing, fake supplier accounts, sybil patterns, or model-prompt manipulation — to harvest SKY rewards without delivering the underlying impact. Each successful exploit dilutes the SKY supply available to honest participants, reduces the credibility of Proof-of-Impact data, and may force SKYBound Network to revise scoring or reward parameters in ways that retroactively reduce member or Node-operator rewards.

Independent Node operators could fracture community alignment.

Independent operators, bearing hardware costs and regulatory exposure, could respond by demanding higher gas-fee shares or by voting against integrations they perceive as subsidizing corporate insiders. A drawn-out governance stalemate would chill third-party development: builders hesitate to expend resources on a platform where DAO politics rather than technical merit determine API stability and future rewards.

If tensions escalate, factions might fork the codebase into competing networks or initiate coordinated downtime to force renegotiation of reward curves. Either scenario splits liquidity, confuses asset-issuers, and complicates regulatory filings that rely on a single canonical ledger for audit trails. In turn, fractured alignment would undermine one of SKYBound Network’s core selling points, i.e., providing a unified, compliance-aware settlement layer acceptable to both traditional and decentralized finance participants.

Decentralized governance at the DAO offers non-DAO affiliated persons and entities the opportunity to pass proposals that could adversely affect the DAO or the SKYBound Network.

A fundamental design characteristic of the SKYBound Network is its decentralized governance. While decentralized governance offers exciting new opportunities for community-driven projects like SKYBound Network, DAO risks the DAO members undermining the company, the SKYBound Network, SKY tokens, or other aspects of the project, either through negligence or willful misconduct. By ceding some of its authority over the blockchain and token distribution, the DAO presents DAO members with the opportunity to take the project in unexpected directions, including directions that could adversely affect the company, the project, and other DAO members. The DAO’s protective mechanisms to guard against such measures may be insufficient to prevent DAO members from accomplishing them.

RISKS RELATED TO THE MARKET & COMPETITION

Established travel-booking platforms, loyalty programs, and other rewards networks may out-compete SKYBound for traveler adoption and engagement.

Online travel-booking incumbents such as Booking Holdings, Expedia Group, Airbnb, and Tripadvisor, along with other lifestyle membership clubs and travel-marketplace operators, already host very large traveler bases, established supply relationships with airlines, hotels, ground transportation, and experience providers, mature payment, fraud, and dispute-resolution systems, and entrenched customer loyalty mechanics. Switching costs work against a newcomer: travelers’ saved itineraries, payment credentials, status, points, and review histories already live with incumbents, and travel suppliers (especially airlines and hotel chains) have years of API and contract integrations with those platforms. SKYBound’s ability to attract a meaningful share of traveler activity will depend on convincing both supply and demand sides to migrate or duplicate that integration work, incurring onboarding delays, legal fees, and “unknown-unknown” operational risks; if those efforts stall, member acquisition could lag projections and Node operators may see lower-than-expected engagement-validation throughput.

Two-sided network effects compound the challenge. Established travel platforms have spent years building dense traveler-supplier networks, recognized brands, and customer trust that newcomers cannot easily replicate. Unless SKYBound can attract a critical mass of travelers and local supply (lodging, experiences, guides, eco-tourism partners) quickly, it risks a cold-start problem in which traveler activity, Proof-of-Impact event volume, marketplace transactions, and engagement-validation work all remain low, and prospective members perceive a “ghost network” meaning a network with minimal activity that appears abandoned.

The knock-on effect is a self-reinforcing engagement gap: lower traveler activity reduces the volume of verifiable Proof-of-Impact events, which in turn depresses SKY-denominated marketplace activity, in-app purchases, and Node-operator fee generation. Under the project’s economic model, Node-operator rewards are scheduled to taper as the SKY emission curve halves and to shift toward in-app fee revenue. A slow ramp-up in traveler activity and supplier participation could jeopardize that transition and force reconsideration of the fixed-supply premise, including by requiring SKYBound to subsidize early operators or to revise its emission or fee model.

User resistance to higher in-app fees after scheduled SKY distributions taper could suppress transaction volume and weaken network activity.

SKYBound’s economic design has a fixed total supply of 500,000 SKY and a one-year halving emission curve (E₀ = 250,000) that distributes 50% of total supply in Year 1 and converges asymptotically to the 500,000 cap. SKY rewards Node operators and members for verifiable Proof-of-Impact events (e.g., supporting local businesses, sustainable travel behaviors, cultural and educational engagement, community contribution) rather than for block production or third-party oracle duties. Because the emission is steeply front-loaded — half of all SKY is released in Year 1 — Node-operator and member rewards drop sharply after the first year and continue to decline geometrically thereafter. As those distributions taper over the projected [applicable] release window, the costs of operating and maintaining nodes must be offset primarily by transaction (“gas”) charges paid by end-users.

Historical fee-market behavior across public blockchains shows that participants, especially high-frequency market-makers who execute many trades per second, arbitrage engines automated systems that profit from price differences and consumer-facing applications, are highly sensitive to per-transaction costs. When network fees rise, activity often migrates to lower-cost alternatives such as Layer 2 roll-ups or competing Layer 1s. Should SKYBound Network need to increase its base-gas schedule (e.g., to cover infrastructure expenses, attract additional validator capacity, or meet service-level objectives), some liquidity providers and tokenized-asset issuers might route orders or settlement flows elsewhere.

Reduced throughput would mean fewer overall transactions subject to gas charges, slowing the turnover of tokenized assets and limiting the breadth of on-chain markets. A decline in transaction count also decreases the absolute volume of gas charges available to reimburse Node operators for their verifiable work. If aggregate activity remains below the levels anticipated when emission curves were set whether due to broader market conditions or fee-sensitive migration network participation could contract, block intervals might lengthen, and the usefulness of the ledger for real-time settlement could diminish.

To maintain service quality without imposing prohibitive transaction costs, the DAO may need to explore operational efficiencies (e.g., state-compression techniques, fee-market redesign, or selective subsidy from treasury reserves). Each mitigation carries trade-offs: technical optimizations can be complex and costly to implement, while treasury subsidies draw down resources earmarked for ecosystem development and compliance initiatives. Persistent user aversion to higher gas charges therefore represents a material threat to overall transaction flow, validator engagement, and the network’s goal of providing a stable, high-throughput settlement layer.

RISKS RELATED TO REGULATORY & LEGAL MATTERS

Notwithstanding Skybound’s position that SKY tokens and Node Licenses are not investments and are not offered or sold as securities, regulators or courts could disagree.

Skybound’s public-facing materials take the position that SKY is a utility/digital-commodity-style token used to access in-app travel purchases, marketplace transactions, fees, staking, and governance, and that Node Licenses are participation licenses tied to verifiable engagement-validation work. The Node Disclosure expressly states that a SKYBound Node is not sold as an investment, does not represent an investment contract, ownership interest, share of equity, financial security, or profit-sharing agreement, and that purchasers should have no expectation of profit. The DAO Constitution requires each member to execute an acknowledgment certifying that no person acting on behalf of SKYBound has represented that the member will earn a profit, return on investment, or token liquidity. Notwithstanding these representations, the Securities and Exchange Commission (“SEC”) has historically pursued enforcement actions where node sales were marketed as profit opportunities and Node operators performed little or no work, and SKYBound has not requested no-action relief, filed a registration statement, or qualified for an exemption.

If the SEC, the Commodity Futures Trading Commission (“CFTC”), or a court were nevertheless to conclude that SKY or the Node Licenses constitute securities (whether on a Howey investment-contract theory, by reference to the SEC/CFTC’s March 17, 2026 Joint Interpretive Release’s digital-securities category, or otherwise), then every U.S. offer or sale, including any secondary-market trading and any ancillary distribution program (airdrops, referral incentives, ambassador rewards, testnet rewards, developer grants, or similar), would require registration or a valid exemption from registration. Registration imposes audited financials, periodic Exchange Act reporting, transfer-agent arrangements, and broker-dealer custody — burdens that may prove infeasible for SKYBound or its DAO. Retroactive remedies could include rescission rights for U.S. purchasers, civil penalties, and ongoing restrictions that bar SKY or the Node Licenses from retail markets, with corresponding negative effects on liquidity, member acquisition, and Node-operator economics.

Because the fixed-supply model eliminates inflationary incentives after the applicable release window, a registration-driven liquidity freeze could leave Node operators without sufficient gas-fee volume to cover operating costs. The DAO might then face pressure to redesign token economics compromising the “no new issuance” commitment or to geo-block U.S. traffic, fragmenting global liquidity and impeding the chain’s institutional ambitions.

The March 17, 2026 SEC and CFTC Joint Interpretive Release on digital assets creates new classification considerations for SKY tokens and Node Licenses, and the DAO’s position relies on non-binding interpretive guidance that the agencies could revise.

On March 17, 2026, the SEC and CFTC, as part of the joint “Project Crypto” initiative, issued a joint interpretive release classifying digital assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins, and digital securities (the “Interpretive Release”). Only the fifth category — digital securities — is itself subject to the federal securities laws. However, a digital asset that is otherwise a non-security can become subject to an investment contract (and therefore the federal securities laws) where the issuer offers it “by inducing an investment of money in a common enterprise with representations or promises to undertake essential managerial efforts from which a purchaser would reasonably expect to derive profits.” The Interpretive Release also addresses Protocol Mining and Protocol Staking, which it indicates do not, as described, involve the offer or sale of securities; Staking Receipt Tokens may, however, themselves be securities depending on the surrounding facts.

The DAO believes that SKY tokens are intended to function as a utility/commodity-style digital asset (used for in-app travel purchases, marketplace transactions, fees, staking, and governance) and that Node Licenses are participation licenses tied to verifiable engagement-validation work, neither of which is offered with promises of profit or return. The Constitution and the Node Disclosure each expressly disclaim profit expectations, ROI representations, and pecuniary rights. Notwithstanding those representations, the offer and sale of Node Licenses for monetary consideration, where the holder has the ability to earn SKY rewards, requires careful analysis under the investment-contract framework reaffirmed by the Interpretive Release, and the DAO has not received any formal SEC, CFTC, or judicial determination that SKY or the Node Licenses are non-securities.

Several risks remain even under the Interpretive Release’s framework. First, the Interpretive Release is non-binding interpretive guidance, not a formal rule, and a future SEC or CFTC could reverse its interpretive position without rulemaking; courts also retain final authority to apply the Howey test differently. Second, the CFTC is expected to act more aggressively post-Release in identifying digital-commodity platforms requiring registration, licenses, or compliance with the Commodity Exchange Act, and the pending CLARITY Act could expand CFTC jurisdiction in ways that affect the SKYBound ecosystem, including any future decentralized exchange functionality. Third, ancillary distributions of SKY (airdrops, referral incentives, ambassador or growth programs, testnet rewards, or developer grants) may each constitute a separate offer-and-sale event requiring its own securities-law analysis under the Interpretive Release, particularly where recipients provide consideration or services. Fourth, the Interpretive Release does not address Bank Secrecy Act, anti-money laundering, or state or federal payments-law obligations, each of which may continue to apply independently to the DAO or to Node operators. If the DAO’s good-faith reliance on the Interpretive Release later proves misplaced — whether through a change in agency posture, judicial reinterpretation, or evolving facts — SKY and the Node Licenses could be retroactively recharacterized as securities, exposing the DAO and Node operators to registration, rescission, civil penalty, and other enforcement risk.

Node Licenses may be treated as money-transmission or brokerage instruments, imposing multilayer regulation on operators.

The same passage cautions that the SKYBound Network “could… fall within the jurisdiction of the Commodity Futures Trading Commission… [and] state money-transmitter regulators if user-facing wallets hold custody of customer funds.” A license entitles the holder to validate blocks and receive gas-fee distributions an arrangement some states view as “stored value” or “money transmission.” At the federal level, FinCEN has advised that operating blockchain infrastructure for the benefit of others can qualify as money-services business (“MSB”) activity.

If individual Node operators are deemed MSBs, they must register with FinCEN, appoint compliance officers, file Suspicious Activity Reports, and maintain customer-information programs tasks ill-suited to a globally distributed volunteer base. In parallel, any moment when tokenized equity or bond settlement goes live could trigger Securities Exchange Act “clearing agency” obligations, while trade-matching logic might be viewed as an Alternative Trading System (ATS). Operators lacking the requisite licenses could face cease-and-desist orders, personal fines or even criminal sanctions in certain jurisdictions.

These overlapping regimes create complex, potentially conflicting compliance timelines. Delays in obtaining approvals could slow validator onboarding precisely when network throughput needs to scale; alternatively, licensing costs may dissuade small operators, concentrating validation in the hands of large, well-capitalized entities and eroding decentralization safeguards.

Wyoming DAO LLC protections may not shield token-holders from partnership-style liability.

Governance is organized under a Wyoming-registered DAO LLC whose Constitution is the controlling governance document for the rights and obligations of DAO members, subject to the Company’s Operating Agreement and the Company’s veto authority over DAO proposals. While the Wyoming statute grants limited-liability status to DAO members protecting their personal assets from business debts, U.S. courts have little precedent on how these protections apply when DAO members vote on treasury expenditures, protocol upgrades, or license-sale proceeds.

If a smart-contract bug, sanctions breach, or consumer-protection claim gives rise to litigation, plaintiffs may argue that token-holders who participated in governance acted as general partners and are therefore jointly and severally liable meaning each could be sued for the full amount of damages. Piercing the LLC veil holding members personally liable despite the LLC structure is rare, but the lack of case law combined with the public, immutable record of each wallet’s votes creates untested exposure. Even a somewhat credible threat of veil-piercing could chill institutional staking, reduce quorum, and tilt governance power toward a smaller pool of risk-tolerant actors.

To mitigate the risk, the DAO may consider liability-mitigation measures such as Directors & Officers insurance and segregation of operational entities; however, such measures have not yet been implemented, and any such policies could exclude claims arising from unregistered securities or sanctions violations. A court ruling that extends liability downstream would likely prompt exchanges and custodians to restrict SKY services until clarity emerges, constricting market depth.

Non-compliance with the EU’s Markets in Crypto-Assets Regulation (“MiCA”) could block European participation.

MiCA, effective as of 2024, requires crypto-asset service providers to secure authorization, maintain prudential reserves, and publish white-paper-level disclosures. The DAO states that it will activate “live trading… only after local legal opinions confirm that the Node License model… [meets] the applicable rules.”

If European regulators interpret validator gas-fee sharing or oracle services as “crypto-asset services,” then the DAO would have to appoint an EU-established legal representative, file audited accounts, and implement consumer-complaint processes, none of which is standard for a decentralized network. Failure or delay in obtaining authorization would require geo-blocking European IP addresses and wallet addresses, instantly fragmenting liquidity and complicating cross-border settlement of tokenized assets.

Moreover, MiCA designates certain infrastructures as “significant” once usage thresholds are crossed; reaching that threshold imposes enhanced oversight, internal-control audits, and prior-approval requirements for protocol upgrades. These supervisory hooks could slow governance decisions, making SKYBound Network less agile than purely global competitors and dampening its appeal to developers who prize rapid iteration.

Emerging U.S. “market-structure” rules for digital assets could impose broker-dealer-like duties on Node operators and oracle nodes.

SEC concept releases from 2023 to 2025 propose redefining “exchange” and “dealer” to cover communication protocols that facilitate trading of crypto assets. The business description flags the overlap, noting potential “market-structure for crypto-assets” rule-making that could affect future features.

Because the SKYBound Network’s roadmap contemplates on-chain quote anchoring and, subject to approval, tokenized-asset settlement, regulators might view licensed Node operators as de-facto intermediaries “bringing together buyers and sellers.” New requirements could include maintaining detailed order records, demonstrating best execution, and submitting audit-trail data similar to the Consolidated Audit Trail. Compliance systems of that complexity are foreign to most blockchain operators and could price out smaller participants.

Retroactive designations also create legal uncertainty: Node operators who processed trades before receiving broker-dealer license risk enforcement for unregistered activity. The DAO would have to choose between disabling trading-adjacent modules undermining its core thesis or absorbing the cost and delay of building institutional-grade surveillance, record-retention, and reporting frameworks.

Expansion of transaction-level identity-sharing mandates such as the Financial Action Task Force (“FATF”) “Travel Rule” could require disruptive redesigns, because only DAO-member nodes undergo full KYC/AML screening today.

Current design. Before a validator keypair can receive a Node License credential, the operator’s name (or entity name) is screened once against the U.S. Treasury Department’s OFAC sanctions lists; no additional personal documents are collected. Full KYC/AML (passport, beneficial-owner forms, source-of-funds) is required only if the operator applies for DAO membership. This two-tier process limits friction for ordinary Node operators while giving regulators an auditable roster of DAO governors.

Regulatory trajectory. The FATF and several national regulators are moving toward transaction-level beneficiary-information requirements for crypto-asset transfers. Draft guidance under review in the EU and Singapore would obligate any party that validates or relays value transfers, not just custodial exchanges, to transmit originator and recipient details when amounts exceed low thresholds (e.g., USD /EUR 1,000). If such rules are enacted, Node operators that today hold only OFAC-screen results would lack the data needed to comply.

Operational impact. Achieving compliance would likely entail:

• adding encrypted payload fields to every transaction, increasing block size and reducing throughput.

• retroactively collecting full KYC/AML data from thousands of existing license holders; and

• hard-forking the protocol to reject transactions that lack Travel-Rule metadata.

Retro-KYC would impose new legal obligations on operators who initially joined under an OFAC-only regime, and some may decline to furnish additional data, shrinking the validator set and potentially breaching Byzantine-fault-tolerance safety margins. Conversely, exempting non-KYC nodes would risk regulators deeming the chain non-compliant and pressuring exchanges or institutional users to geofence the network. Either route forced upgrade or regional restrictions could fragment liquidity and divert engineering resources from core feature delivery.

Minimal data collection for standard node licenses reduces but does not eliminate privacy-law exposure, while the full KYC database for DAO members introduces separate breach and retention risks.

Standard Node Licenses. For ordinary Node operators, the on-chain record stores only (i) a hash of the license ID and (ii) the fact that the operator cleared an OFAC check. Although this approach avoids publishing rich personal identifiers, it is not risk-free:

• Under the EU General Data Protection Regulation (“GDPR”), a hashed identifier can still be “personal data” if it can be linked to a living person via reasonable means. Once written to an immutable ledger it cannot be erased to honor a “right to be forgotten.”

• Off-chain records kept by the licensing portal such as IP addresses, email confirmations, or screenshots of sanctions checks are subject to breach. A successful intrusion would trigger GDPR or California CPRA notification duties even though the chain itself stores only hashes.

DAO-member database. Applicants who seek voting rights submit passports, corporate charters, and beneficial-owner statements. These files reside in an off-chain repository managed by DAO’s compliance vendor. A breach would expose high-value personal data tied to wallets that publicly vote on Treasury disbursements, increasing the risk of targeted phishing or extortion. Data-retention mandates further complicate matters: securities and AML laws require records to be kept for five to seven years, whereas GDPR demands data be stored no longer than necessary. Reconciling those requirements is legally complex; over-retention risks privacy fines, under-retention risks regulatory sanctions for inadequate record-keeping.

Mitigation challenges. Possible safeguards include zero-knowledge KYC attestations, revocable cryptographic credentials, differential-privacy techniques. These safeguards would require new cryptographic circuits, UX changes for operators, additional audits, and higher gas costs for on-chain proofs. Each safeguard increases development complexity and extends upgrade timelines. Until such measures are in place, the DAO must navigate a narrow compliance window: collecting just enough data to meet sanctions-screen expectations without running afoul of global privacy regimes, all while preparing for the possibility that future laws will tighten identity-sharing requirements for every validator, not only DAO members.

Tax authorities may treat token distributions and gas-fee receipts as ordinary income, creating complex withholding and reporting burdens for Node operators.

Emission tables show SKY vesting daily to licensed nodes over roughly ten years. U.S. Internal Revenue Service guidance (Notice 2014-21; Rev. Rul. 2019-24) treats staking or mining rewards as taxable at fair-market value upon receipt. Similar rules apply in Australia, the U.K., and Canada. Node hosts must therefore track USD-equivalent values for thousands of micro-payouts per year, file quarterly estimates, and potentially withhold taxes for subcontractors.

Gas-fee revenue adds another layer: some jurisdictions impose value-added-tax (“VAT”) on digital services, meaning that cross-border validator income could incur VAT collection and remittance obligations. Record-keeping complexity may deter small operators or hobbyists, concentrating network security among entities with compliance departments and again increasing centralization risk. The DAO has not yet published withholding tools or template tax statements, so early operators bear the burden of bespoke accounting systems.

A sanctions or AML violation by a single licensed node could expose the DAO and co-signing Node operators to joint enforcement.

Because each block requires signatures from a super-majority of the active validator set, any transaction that violates OFAC sanctions implicates all participating signers. The business description underscores that built-in sanctions controls will be “reviewed with specialist counsel before each major feature” but provides no guarantee of real-time list updates.

If a blacklisted wallet is inadvertently whitelisted or if a node falsifies screening attestations, regulators could allege that fellow Node operators “facilitated” the prohibited transfer. Unlike proof-of-work chains where miners remain anonymous, the DAO’s license registry provides a ready-made enforcement map: agencies can serve subpoenas or penalty notices on every identifiable validator, even those in other jurisdictions.

Co-signer liability risk may chill participation by heavily regulated financial institutions, the very entities that SKYBound Network hopes to attract. Mitigations such as on-chain revocation lists, real-time oracle feeds of sanctions data, and rapid re-sign mechanisms increase operational complexity and may still fall short of regulators’ strict-liability expectations.

[Cross-border tokenized asset settlement requires multiple jurisdiction-specific approvals, risking staggered launches and fragmented liquidity.

The roadmap envisions regulated equities, real estate interests, and other “StableShare” tokens settling directly on chain after necessary approvals. Yet the business description concedes that live trading will commence in any jurisdiction only “after local legal opinions confirm” compliance with securities and payments rules.

In practice, each major market (e.g., the U.S., EU, U.K., Singapore and Brazil) maintains distinct licensing regimes for transfer agents, central-securities depositories, and custodial trustees. Negotiating approvals can take years, often with iterative feedback that forces technical redesigns (e.g., segregated sub-ledgers or local disaster-recovery nodes). Launching functionality piecemeal means liquidity will cluster where approvals arrive first, undermining the all-to-all global order book that SKYBound Network aspires to build.

Issuers may hesitate to list assets if settlement finality depends on a patchwork of regional forks; meanwhile, competing consortia chains backed by local banks and regulators could fill the gap. Reengineering the protocol to accommodate jurisdiction-specific rule sets would divert engineering resources from core features and could dilute the uniform compliance logic touted as a selling point.]

RISKS RELATED TO THE THIRD PARTY TRAVEL PROVIDERS

Skybound’s Services depend on third-party travel providers whose performance, pricing, and policies are outside Skybound’s control.

Hotels, airlines, transportation providers, experience vendors, and other suppliers operate independently and are bound by their own terms and conditions. Skybound’s Terms of Service expressly disclaim responsibility for travel-provider cancellations, schedule changes, travel disruptions, and service-quality issues. If suppliers cancel reservations, change pricing, withhold inventory, or reduce service quality, members may be unable to redeem the travel-related benefits that motivated their participation, which could damage member trust, reduce SKY-denominated marketplace activity, slow Node-operator engagement-validation throughput, and trigger consumer-protection complaints or chargebacks even though the underlying performance failure was the supplier’s, not Skybound’s.