CTR (CTR) White paper

CTR is the native utility and governance token of the Citrea network, a Zero-Knowledge Rollup that settles on Bitcoin. CTR is designed as a coordination mechanism for the protocol, enabling holders to participate in governance processes and direct ecosystem incentives through an active participation model. CTR does not confer ownership rights, profit participation, dividends, or entitlement to revenues. The token is transferable.

CTR has a fixed total supply of 10,000,000,000. Distribution is allocated as follows: Community and Ecosystem (59.99%); Early Contributors (20.66%, 4-year unlock, 1-year cliff); and Investors (19.35%, 4-year unlock, 1-year cliff). Holding CTR alone does not entitle a holder to passive income, profit-sharing, or claims on protocol revenues.

The request for admission to trading of CTR is intended to support access to secondary market trading and liquidity, including in the European Economic Area, and to support compliance processes where applicable.

Token allocation:
- Community and Ecosystem: 59.99%
- Early Contributors: 20.66% (4-year unlock, 1-year cliff)
- Investors: 19.35% (4-year unlock, 1-year cliff)

CTR may be acquired through airdrops or secondary markets.

The admission to trading of CTR (CTR) on Payward Europe Solutions Limited (Kraken) is intended to improve accessibility, liquidity, and application of the token across digital asset markets. There is no associated fundraising or primary issuance of tokens in connection with this listing. This disclosure is filed to enhance transparency, foster regulatory clarity, and support institutional confidence.

By aligning with the high disclosure standards of Regulation (EU) 2023/1114, Payward Europe Solutions Limited (Kraken) reinforces its commitment to operating a secure, compliant, and transparent trading environment. This initiative facilitates broader market access, supports responsible token adoption, and strengthens integration of CTR (CTR) within the regulated financial ecosystem.

Purchasers may choose to hold CTR (CTR) within their trading account on Payward Europe Solutions Limited (Kraken). Alternatively, holders can withdraw the asset to a compatible external wallet that supports the CTR (CTR).

Users are responsible for ensuring their chosen wallet supports the withdrawal network used by Payward Europe Solutions Limited (Kraken), and for securely managing their private keys. Incompatible withdrawals may result in permanent loss of crypto-assets.

There are no restrictions imposed on the transferability of the CTR token at the protocol level. The token is already in public circulation and may be freely transferred between users in accordance with the consensus rules of the decentralised network. Transfer functionality is determined by the underlying protocol and may be subject to standard technical conditions such as wallet compatibility, network fees, and block confirmation times. Any limitations that arise are typically due to external factors such as third-party exchange policies, jurisdictional regulatory requirements, or user-specific constraints.

The use of services provided by Payward Europe Solutions Limited (Kraken) may be governed by separate terms and conditions. These may include restrictions or obligations applicable to specific features, interfaces, or access points operated by Payward Europe Solutions Limited (Kraken) in connection with CTR. Such terms do not alter the native transferability of the token on the decentralised network but may affect how users interact with services linked to it. Users should consult and accept the applicable terms of service before engaging with these services.

This disclosure pertains solely to the transferability of the CTR token as admitted to trading on Payward Europe Solutions Limited (Kraken). Vesting schedules, lock-up arrangements, or other contractual restrictions related to private sales or early-stage allocations are considered out of scope for this section, as they apply only to specific counterparties and do not affect the native transferability of the token at the network level.

The disclosure herein relates to the admission to trading of CTR, rather than a new offer to the public. Nevertheless, risks associated with the admission process include:

Market Volatility: Crypto-assets, including CTR (CTR), are subject to significant price fluctuations due to market speculation, regulatory developments, liquidity shifts, and macroeconomic factors.

Information Asymmetry: Due to the decentralised and open-source nature of CTR (CTR), not all market participants may have access to the same level of technical understanding or information, potentially leading to imbalanced decision-making.

Listing Risk: Admission to trading on specific platforms does not guarantee long-term availability, and trading venues may delist the asset due to internal policy, regulatory enforcement, or liquidity thresholds.

Jurisdictional Restrictions: The regulatory treatment of crypto-assets varies between jurisdictions. Traders or investors in certain regions may face legal limitations on holding or transacting CTR (CTR).

Exchange Risk: While exchanges may implement robust operational, cybersecurity, and compliance controls, no exchange is immune to operational disruptions, cyber threats, or evolving regulatory constraints. Users should be aware that exchange-level risks - such as service outages, wallet access delays, or changes in platform policy - may impact the ability to trade or withdraw CTR (CTR). Legal and technical developments may affect the platform’s capacity to continue offering certain assets, including CTR (CTR). Users should ensure they have read the terms of service before engaging with any service.

Market participants should conduct their own due diligence and consider their risk tolerance prior to engaging in the trading of CTR (CTR).

Information accuracy: Information published by the issuer, including on websites or technical materials, may be incomplete, inaccurate, or out of date. Misstatements or omissions can lead to incorrect assumptions about CTR (CTR) and may expose holders to unexpected losses.

Governance and oversight: The issuer’s governance arrangements may be limited or highly centralised. Weak oversight or concentrated decision-making can lead to poor strategic choices or inconsistent project direction, and conflicts of interest may arise where insiders hold significant positions or influence outcomes.

Conduct and integrity: Individuals involved with the issuer may engage in misconduct, including mismanagement, diversion of funds, or false representations. Such behaviour may negatively affect the development, viability, or perception of CTR (CTR) and may leave holders with limited recourse.

Technical and implementation risk: The issuer may be responsible for development, deployment, or maintenance of technology supporting CTR. Errors in design, implementation, upgrades, or security practices may affect functionality or lead to loss of assets, and new or untested technology may not perform as intended under all conditions.

Operational resilience: The issuer may rely on internal systems and external providers for essential functions. Service disruptions, security incidents, or failures of operational processes may impair access to information or supporting services relevant to CTR (CTR).

Regulatory exposure: The issuer is subject to changing legal and regulatory requirements across jurisdictions. Compliance failures or regulatory action may restrict the issuer’s activities or the availability of CTR, and divergent regulatory interpretations may create uncertainty for users and market participants.

Financial viability: The issuer may experience financial difficulties, including reduced funding, liquidity constraints, or insolvency. Limited financial resources may affect the issuer’s capacity to support ongoing work or maintain operations relating to CTR.

Dependence on individuals and third parties: The issuer may rely on a small number of key people or specialised service providers. Loss, withdrawal, or underperformance of such individuals or providers may disrupt project continuity and affect the development or maintenance of CTR (CTR).

Investor protection limitations: Holding CTR generally does not grant rights or protections associated with traditional financial instruments. Holders may have no claim over issuer assets and no access to compensation schemes in the event of losses or issuer failure.

Unforeseen risks: Additional risks may arise that cannot be identified in advance, including those stemming from technological developments, market conditions, regulatory changes, or internal circumstances. Such risks may affect the issuer’s operations or the use and perception of CTR.

Volatility risk: Crypto-assets are subject to significant price volatility, which may result from market speculation, shifts in supply and demand, regulatory developments, or macroeconomic trends. This volatility can affect the asset’s value independently of the project’s fundamentals.

Liquidity risk: The ability to buy or sell the crypto-asset on trading platforms may be limited by market depth, exchange availability, or withdrawal restrictions, potentially impairing the ability of holders to exit positions efficiently or at desired prices.

Regulatory risk: The evolving global regulatory landscape may impose new restrictions, classifications, or disclosure requirements that could impact the legal treatment, availability, or use of the crypto-asset. Changes in regulation may also affect the token’s classification or trigger enforcement actions.

Exchange-related risk: The crypto-asset may rely on third-party trading platforms for liquidity and price discovery. These platforms are subject to operational, custodial, or legal risks, including suspension of trading, delistings, or platform failure, which may adversely affect access to the asset.

Custody and private key risk: Holders of crypto-assets are typically responsible for managing private keys or access credentials. Loss, theft, or compromise of these keys may result in irreversible loss of the associated assets without recourse or recovery.

Market manipulation risk: The crypto-asset may be susceptible to pump-and-dump schemes, wash trading, or other forms of market manipulation due to limited oversight or fragmented market infrastructure, which can distort price signals and mislead participants.

Perception and reputational risk: Public sentiment, media narratives, or association with controversial projects or exchanges may influence the perception of the crypto-asset, affecting its adoption, market value, and long-term viability.

Forking risk: Blockchain networks may undergo contentious upgrades or forks, potentially resulting in duplicate tokens, split communities, or compatibility challenges that affect the asset’s continuity or utility.

Legal ownership risk: Depending on jurisdiction and platform terms, holders may not acquire legal ownership or enforceable rights with respect to the crypto-asset, which could affect recourse options in the event of fraud, misrepresentation, or loss.

Network usage risk: A decline in activity or utility on the associated network may reduce the economic relevance of the crypto-asset, diminishing its value and undermining its role as a medium of exchange or utility token.

Compliance risk: Holders may be subject to local obligations related to tax reporting, anti-money laundering (AML), or sanctions compliance. Failure to meet these obligations could result in penalties or legal consequences.

Cross-border risk: Transactions involving the crypto-asset may span multiple jurisdictions, creating uncertainty around applicable laws, conflict-of-law issues, or barriers to enforcement and regulatory clarity.

Incentive misalignment risk: The crypto-asset’s economic model may depend on incentives for participants such as validators, developers, or users. If these incentives become insufficient or distorted, network participation and security may decline.

Token distribution concentration risk: A disproportionate concentration of token supply in the hands of a small number of holders may enable price manipulation, governance capture, or coordinated sell-offs that impact market stability and community trust.

Misuse risk: The crypto-asset may be used for illicit purposes (e.g., money laundering, ransomware payments), exposing the project to reputational harm or regulatory scrutiny, even if such activity is beyond the issuer’s control.

Utility risk: The expected utility of the token within its ecosystem may fail to materialize due to low adoption, under-delivery of promised features, or technical incompatibility, undermining its value proposition.

Inflation or deflation risk: The token’s supply mechanics (minting, burning, vesting, etc.) may introduce inflationary or deflationary dynamics that affect long-term holder value and purchasing power within the network.

Secondary market dependence risk: The ability of users to access, trade, or price the token may depend entirely on secondary markets. If such platforms restrict or delist the asset, liquidity and discoverability may be severely impacted.

Taxation risk: The treatment of crypto-assets for tax purposes may vary by jurisdiction and change over time. Holders may face unanticipated tax liabilities related to capital gains, income, or transaction activity.

Bridging risk: If the crypto-asset exists on multiple blockchains via bridging protocols, vulnerabilities in those bridges may lead to de-pegging, duplication, or irrecoverable losses affecting token integrity and user balances.

Incompatibility risk: The crypto-asset may become technically incompatible with evolving wallets, smart contracts, or infrastructure components, limiting its usability and support within the broader crypto ecosystem.

Network governance risk: If governance decisions (e.g., protocol upgrades, treasury usage) are controlled by a limited set of actors or are poorly defined, outcomes may not align with broader user interests, leading to fragmentation or disputes.

Economic abstraction risk: Users may be able to interact with the network or ecosystem without using the crypto-asset itself (e.g., via gas relayers, fee subsidies, or wrapped tokens), reducing demand for the token and weakening its economic role.

Dust and spam risk: The crypto-asset may be vulnerable to dust attacks or spam transactions, creating bloated ledgers, user confusion, or inadvertent privacy exposure through traceability.

Jurisdictional blocking risk: Exchanges, wallets, or interfaces may restrict access to the crypto-asset based on IP geolocation or jurisdictional policies, limiting user access even if the asset itself remains transferable on-chain.

Environmental or ESG risk: The association of the crypto-asset with energy-intensive consensus mechanisms or unsustainable tokenomics may conflict with emerging environmental, social, and governance (ESG) standards, affecting institutional adoption.

Development risk: The project may experience delays, underdelivery, or changes in scope due to unforeseen technical complexity, resource constraints, or coordination issues, impacting timelines and stakeholder expectations.

Funding risk: The continued implementation of the project may depend on future funding rounds, revenue generation, or grants. A shortfall in available capital may impair the project’s ability to execute its roadmap or retain key personnel.

Roadmap deviation risk: Strategic shifts, pivots, or reprioritization may result in deviations from the originally published roadmap, potentially leading to dissatisfaction among community members or early supporters.

Team dependency risk: The project’s success may be heavily dependent on a small number of core contributors or founders. The departure, unavailability, or misconduct of these individuals could significantly impair execution capacity.

Third-party dependency risk: Certain components of the project (e.g., infrastructure providers, integration partners, oracles) may rely on external entities whose performance or continuity cannot be guaranteed, introducing operational fragility.

Talent acquisition risk: The project may face challenges recruiting and retaining qualified professionals in highly competitive areas such as blockchain development, AI engineering, security, or compliance, slowing implementation or reducing quality.

Coordination risk: As decentralized or cross-functional teams grow, internal coordination and alignment across engineering, product, legal, and marketing domains may become difficult, leading to delays, errors, or strategic drift.

Security implementation risk: Insufficient diligence in implementing security protocols (e.g., audits, access controls, testing pipelines) during development may introduce critical vulnerabilities into the deployed system.

Scalability bottleneck risk: Architectural decisions made early in the project may limit performance or scalability as usage grows, requiring resource-intensive refactoring or redesign to support broader adoption.

Vendor lock-in risk: Reliance on specific middleware, cloud infrastructure, or proprietary tools may constrain the project’s flexibility and increase exposure to price shifts, service outages, or licensing changes.

Compliance misalignment risk: Product features or delivery mechanisms may inadvertently breach evolving regulatory requirements, particularly around consumer protection, token functionality, or data privacy, necessitating rework or geographic limitations.

Community support risk: The project’s success may rely on active developer or user participation. If the community fails to engage or contribute as anticipated, ecosystem momentum and resource leverage may decline.

Governance deadlock risk: If project governance (e.g., DAO structures or steering committees) lacks clear decision-making processes or becomes fragmented, the project may face delays or paralysis in critical strategic decisions.

Incentive misalignment risk: Implementation plans may fail to maintain consistent alignment between stakeholders such as developers, token holders, investors, and users, undermining cooperation or long-term sustainability.

Marketing and adoption risk: Even with timely technical delivery, the project may fail to gain market traction, user onboarding, or brand recognition, reducing the effectiveness of its deployment.

Testing and QA risk: Inadequate testing coverage, staging environments, or quality assurance processes may allow critical bugs or regressions to reach production, causing service degradation or user loss.

Scope creep risk: Expanding project objectives without adequate resource reallocation or stakeholder alignment may dilute focus and overextend the development team, compromising quality or deadlines.

Interoperability risk: Implementation plans involving cross-chain or cross-platform integration may encounter compatibility issues, protocol mismatches, or delays in third-party upgrades.

Legal execution risk: If foundational legal structures (e.g., entities, IP assignments, licensing) are not finalized or enforceable across key jurisdictions, the project may face friction during scaling, partnerships, or fundraising.

Smart contract risk: The crypto-asset may rely on smart contracts that, if improperly coded or inadequately audited, can contain vulnerabilities exploitable by malicious actors, potentially resulting in asset loss, unauthorized behavior, or permanent lock-up of funds.

Protocol risk: The underlying blockchain protocol may contain unknown bugs, suffer from unanticipated behavior, or experience edge-case failures in consensus, finality, or synchronization, leading to disruptions in network operation.

Bridge risk: If the crypto-asset is deployed across multiple chains via bridging infrastructure, the underlying bridge may be vulnerable to exploit, misconfiguration, or oracle manipulation, threatening asset integrity across networks.

Finality risk: Some blockchains may exhibit probabilistic or delayed finality, making transactions theoretically reversible within short windows. This can lead to issues in cross-chain settlements or operational reliability.

Node centralization risk: If the network depends on a small number of validators or infrastructure providers to maintain consensus or data availability, it may be susceptible to downtime, censorship, or coordinated manipulation.

Data integrity risk: In decentralized environments, reliance on off-chain data (e.g., oracles or external feeds) introduces the possibility of incorrect or manipulated information entering the system and triggering undesired outcomes.

Versioning and upgrade risk: Protocol upgrades, forks, or version mismatches between nodes and clients can introduce compatibility issues or destabilize service availability, particularly if coordination or governance processes are insufficient.

Storage and archival risk: The technical infrastructure supporting the crypto-asset may be vulnerable to data loss or corruption, particularly in cases involving third-party storage solutions, partial nodes, or decentralized file systems.

Interoperability risk: Integration with third-party tools, blockchains, or application layers may rely on APIs, SDKs, or interfaces that change without notice or suffer from inconsistencies, potentially breaking user functionality or asset movement.

Scalability risk: The underlying technology may not scale effectively under high usage conditions, leading to network congestion, transaction delays, fee spikes, or degraded user experience.

Cryptographic risk: The system relies on current cryptographic standards for key generation, digital signatures, and hashing. Advances in computing (e.g., quantum computing) or undiscovered flaws may undermine these protections in the future.

Permissioning or access control risk: If token behavior or network features are governed by privileged roles (e.g., admin keys, multisigs), improper key management, role abuse, or governance capture could impact fairness or security.

Decentralization illusion risk: Despite being labeled “decentralized,” critical components (e.g., governance, token distribution, node operation) may be technically or operationally centralized, concentrating risk and reducing resilience.

Latency and synchronization risk: Distributed networks may experience propagation delays, inconsistent state views, or latency in consensus confirmation, introducing unpredictability in transaction ordering and agent coordination.

Frontend dependency risk: End users may rely on centralized interfaces (e.g., websites, wallets, APIs) to interact with the asset, which if compromised or taken offline, can block access despite the network itself being operational.

Misconfiguration risk: Errors in smart contract deployment, token configuration, permission settings, or network parameters can result in unintended behavior, including frozen assets, incorrect balances, or bypassed restrictions.

Monitoring and observability risk: Insufficient logging, alerting, or metrics may prevent the timely detection of technical issues, exploits, or usage anomalies, limiting the project's ability to respond to emergent threats.

Software dependency risk: Core components may depend on open-source libraries or packages that are unmaintained, vulnerable, or deprecated, exposing the asset to cascading failures or inherited security flaws.

Time drift and clock sync risk: Distributed ledgers that rely on timestamping may face issues if nodes do not maintain consistent system time, impacting consensus, block ordering, or event sequencing.

Blockchain immutability risk: Once deployed, certain design flaws or oversights may be difficult or impossible to correct due to the immutable nature of smart contracts or protocol rules, necessitating workarounds or forks.