PICNIC

TERMS AND CONDITIONS OF USE

PROTECTED VAULT

Variable Yield Product in USDC with Protocol Coverage

(Vault Cover — OpenCover x Nexus Mutual)

Last Updated: March 2026

IMPORTANT NOTICE — MANDATORY PRIOR DISCLOSURE

Before making any deposit in the Protected Vault, the User must acknowledge the following essential points:

0. HOW THE PROTECTED VAULT WORKS — PRODUCT OVERVIEW

0.1. Product structure — three independent layers

The Protected Vault is a feature of the PICNIC app that allows the User to deposit USDC into a Covered Vault managed by OpenCover, which allocates the assets in the Designated Vault (sDAI/Sky/Maker DSR) on the Gnosis Chain and maintains coverage with Nexus Mutual. The product operates in three independent layers:

0.2. What risk the coverage protects — depeg of sDAI

The current coverage for the Protected Vault is exclusively Part B of the Vault Cover Terms: depeg coverage of sDAI. This was a deliberate choice by OpenCover when structuring this product.

0.3. Yield — variable and dynamic

0.4. Proof of Cover — on-demand and proportional coverage

0.5. What are the Covered Components

The Vault Cover protects the Covered Components: (a) the Covered Vault (OpenCover contract); (b) the Designated Vault (sDAI/Sky/Maker); and (c) the Designated Protocol (Sky/Maker DSR code). User interfaces — including the PICNIC app and the Deframe API — are expressly excluded.

0.6. Participants and their roles

0.7. What PICNIC is not and does not do

1. PARTIES AND IDENTIFICATION

1.1. Platform operator

DeFiBasket Labs Inc., a company incorporated under the laws of the British Virgin Islands (BVI), No. 2085144, with registered address at Intershore Chambers, Geneva Place, 3rd Floor, Road Town, Tortola, BVI (‘PICNIC’, ‘we’ or ‘Platform’).

1.2. User

Individual or legal entity accessing the Protected Vault feature through the PICNIC app interface (‘User’ or ‘you’). By activating the Protected Vault or making any deposit, the User declares to have read, understood, and fully accepted these Terms, which are complementary and integrated with the General Terms of Use of PICNIC.

2. NATURE OF THE PRODUCT AND OPERATION

2.1. General description

The Protected Vault is a technological interface feature that allows the User to deposit USDC into the OpenCover Covered Vault, deployed on the Gnosis Chain, whose assets are allocated in the Designated Vault (sDAI/Sky/Maker DSR). The yield is generated by the Designated Protocol. The current protocol coverage is exclusively Part B (depeg of sDAI), governed by the Vault Cover Terms — OpenCover x Nexus Mutual.

2.2. How to participate

1. Have a self-custodial wallet compatible with the Gnosis Chain and available balance in USDC.
2. Read and accept these Terms in the PICNIC interface.
3. Authorize the deposit transaction, which will send your USDC to the Covered Vault on the Gnosis Chain.
4. Monitor the accumulated yield in the PICNIC interface.
5. Request redemption at any time, subject to the protocol's liquidity conditions.

By confirming the deposit, the User forwards their transaction to the Covered Vault. PICNIC does not hold, retain, or control the User's assets at any time.

2.3. Yield and cost — variable nature

The yield of the Protected Vault is variable and dynamic. Composed of the DSR from the Sky/Maker protocol minus the coverage costs. The current net yield is always displayed in the app and may vary daily. No historical rate constitutes a guarantee or promise of future return.

2.4. PICNIC's fees and commission

PICNIC may charge a commission on the generated yield, informed in advance in the interface before any deposit. The total cost to the User will always be displayed on the summary screen before confirmation.

2.5. Contract addresses

• Covered Vault (OpenCover Savings xDAI Insured Vault): 0x0AC34fe133BdE3A2eF589a18A4E10b6a7d253829
• Covered Token (Savings xDAI / sDAI): 0xaf204776c7245bF4147c2612BF6e5972Ee483701

2.6. Infrastructure and involved third parties

• Sky/Maker Protocol (DSR / Designated Protocol): generates yield on sDAI.
• Gnosis Chain: blockchain network where contracts are deployed.
• OpenCover (CVM): manager of the Covered Vault, holder of the coverage position with Nexus Mutual.
• Nexus Mutual: discretionary coverage pool governed by the Vault Cover Terms.
• Deframe: transaction generation and routing API. Not a custodian. Not a Covered Component.

3. NATURE OF PROTOCOL COVERAGE

3.1. Vault Cover — discretionary coverage. Not insurance.

The current coverage is governed by the Vault Cover Terms — OpenCover x Nexus Mutual, with exclusive application of Part B (depeg of sDAI). The specific Annex for this product expressly states: ‘Part A Terms — Not applicable for OpenCover Savings xDAI (sDAI) Vault Cover.’ Therefore, Part A (protocol risks: smart contract bugs, oracle failure, governance takeover, liquidation failure) DOES NOT apply. The coverage is DISCRETIONARY and DOES NOT CONSTITUTE INSURANCE regulated by Decree-Law No. 73/1966 or supervised by SUSEP.

3.2. Part B — Only covered event: depeg of sDAI

Covered event (cl. 4 of the Vault Cover Terms): OpenCover can trigger a claim if, during the Cover Period, the Reference Value of sDAI and the Market Value differ by more than 10% for a continuous period of at least 7 consecutive days.

3.3. Coverage table — what is and is not covered

All scenarios below are evaluated based on the Vault Cover Terms and the Annex sDAI Vault Cover. The Annex prevails in case of conflict.

3.4. Part B exclusions — uncovered events

The User acknowledges that Part B coverage DOES NOT apply in the following situations:

• (i) Technical issues in the Covered Token or Approved Covered Token Derivative that do not specifically result in depeg as per cl. 4 (cl. 6.1).
• (ii) Depeg of any asset other than sDAI (cl. 6.2).
• (iii) OpenCover not having held the Covered Tokens for at least 72h before the depeg event (cl. 6.3).
• (iv) Events occurring before the start of the Cover Period (cl. 3.4, applicable by analogy).
• (v) Cover triggered by a third party without the User's knowledge and consent, or whose recovery is not intended for the User — Cover is void (cl. 3.10).
• (vi) Material Change in Risk: Nexus Mutual may deny claim if OpenCover has materially altered its activities or terms (cl. 14).

3.5. Coverage limit, Deductible, and Claim Amount calculation

The indication of ‘up to 97.5% of capital’ is a maximum estimate before the Deductible and in a total depeg scenario. In adverse scenarios, recovery may be significantly lower. It does not constitute a contractual guarantee by PICNIC.

3.6. Claim deadlines, Cool Down, and redemption

4. LEGAL NATURE

4.1. Software interface — non-custodial

PICNIC acts exclusively as a non-custodial software interface provider. It is not a bank, financial institution, broker, investment manager, fund administrator, insurer, or PSAV. PICNIC does not hold, at any time, custody, control, or access over the User's assets.

4.2. On-chain yield operation

• (i) the yield is generated by an autonomous on-chain protocol (Sky/Maker DSR), without active management by PICNIC;
• (ii) the sDAI is a native token of the protocol, not issued by PICNIC; and
• (iii) each User's position does not represent participation in a collective enterprise.

4.3. Coverage

PICNIC does not offer, distribute, or intermediate insurance. The terms ‘coverage’, ‘protocol coverage’, and ‘Vault Cover’ refer exclusively to the Nexus Mutual product governed by the Vault Cover Terms. PICNIC does not use the terms ‘insurance’, ‘insured’, ‘policy’, or equivalents in any communication to the User.

4.4. Tax responsibility

The User is solely responsible for calculating, declaring, and paying all taxes on the yields obtained. PICNIC does not provide tax advice.

5. RISK FACTORS

The User declares full awareness of the risks associated with the Protected Vault, including but not limited to:

5.1. Protocol risks

• Vulnerability or bug in the smart contracts of the Covered Components that DOES NOT result in qualified depeg — no coverage.
• Failure, manipulation, or attack on the Gnosis Chain protocol or related bridge — no coverage.
• Depeg of sDAI below 10% or for a period less than 7 consecutive days — no coverage.
• Bad debt resulting from liquidation mechanism failure that does not cause qualified depeg — no coverage.
• Governance attack or malicious upgrade that does not cause qualified depeg — no coverage.

5.2. Yield risks

• Reduction or zeroing of the DSR by Sky/Maker governance.
• Increase in coverage cost (OpenCover + Pods) reducing net yield.
• Absence of minimum yield guarantee in any period.

5.3. Coverage risks

• Claim denial by Nexus Mutual's Claim Assessors (discretionary and sovereign decision).
• Loss of claim right due to OpenCover's failure to meet the 30-day deadline after the END of the Depeg Time.
• Loss of approved claim for not redeeming within 30 days of approval.
• Deductible of 5% of the Cover Amount reducing the Claim Amount.
• Unit of Claim of 0.975 (2.5% haircut) per covered token.
• 72h holding requirement of Covered Tokens by OpenCover — if not met, claim denied.
• Material Change in Risk allowing Nexus Mutual to deny claim.
• Insolvency or operational failure of OpenCover as CVM.
• Exposed Funds exceeding the Cover Amount, limiting recovery proportionally.
• Absence of coverage for any event that does not constitute depeg sDAI ≥ 10% for ≥ 7 consecutive days.

5.4. Custody and security risks

• Loss of access to the wallet due to loss of passkey, seed phrase, or device.
• Phishing, social engineering, or malware attacks.
• Irreversibility of on-chain transactions.

5.5. Infrastructure risks

• Failure or unavailability of the Deframe API.
• Hack or vulnerability in PICNIC's internal systems (not covered by the Vault Cover).
• Interruption of the PICNIC app or access interface.

6. PICNIC'S DISCLAIMER AND LIMITATION OF LIABILITY

To the maximum extent permitted by applicable law, PICNIC, its directors, employees, partners, and affiliates are not liable for:

• Capital losses arising from any risk listed in Clause 5.
• Non-payment or reduction of claim by Nexus Mutual.
• OpenCover's failure to trigger or redeem the claim within the stipulated deadlines.
• Failures, bugs, exploits, or attacks on any Covered Component or third-party protocol.
• Losses arising from events not covered by Part B (including bugs that do not cause qualified depeg).
• Loss of access to the User's wallet.
• Yield variations or zeroing.
• User's tax obligations.
• Indirect, consequential, lost profits, or moral damages.
• Loss of approved claim for not redeeming within 30 days.

7. USER OBLIGATIONS AND DECLARATIONS

By using the Protected Vault, the User declares and guarantees that:

6. They have read, understood, and fully accept these Terms and the General Terms of Use of PICNIC.
7. They have the legal capacity to enter into contracts and use virtual assets in their jurisdiction.
8. The deposited funds have a lawful origin.
9. They understand that the coverage is exclusively for depeg sDAI ≥ 10% for ≥ 7 consecutive days.
10. They understand and accept the specific parameters: Depeg Time 7 days, Depeg Percentage 10%, Unit of Claim 0.975/sDAI, Deductible 5%.
11. They will not use the Protected Vault for illegal purposes.
12. They are responsible for safeguarding their credentials and the security of their device.
13. They are responsible for their tax obligations.
14. They will check the current yield in the app before each deposit.
15. They acknowledge that they have no direct contractual relationship with Nexus Mutual and that only OpenCover can trigger claims.
16. They will monitor communications from PICNIC and OpenCover and, in the event of a depeg claim, will take necessary actions within the deadlines (such as transferring assets to multisig, if applicable).
17. They will consult a qualified professional for legal, financial, or tax advice.

8. DEPOSIT, YIELD, AND REDEMPTION CONDITIONS

8.1. Deposit

Deposits are made exclusively in USDC, from a self-custodial wallet. There is no guarantee of immediate processing. PICNIC may set minimum and/or maximum values, displayed in the interface before confirmation.

8.2. Yield

The yield is accumulated in sDAI on-chain. The displayed rate is the current net rate at the time of consultation and may vary. No previously displayed rate constitutes a guarantee of future yield.

8.3. Redemption

The User can request redemption at any time, subject to the liquidity conditions of the sDAI protocol and the Gnosis Chain. In the event of an ongoing claim, redemption may be temporarily suspended.

8.4. Exceptional conditions

• Temporary suspension: during the Cool Down Period (7 days after the start of the depeg), redemptions may be suspended or affected by the coverage process conditions.
• Redemption during depeg: the User may be instructed to transfer assets to multisig instead of redeeming directly. Failure to comply may result in loss of the right to compensation.
• Redemption after approved claim: remaining funds available after distribution.

9. THIRD PARTIES, ON-CHAIN PROTOCOLS, AND LACK OF CONTROL

• Sky/Maker Protocol: operates autonomously; PICNIC has no influence over DSR, governance, or security.
• OpenCover (CVM): PICNIC does not control its operational decisions, claim outcomes, or deadline compliance.
• Nexus Mutual: sovereign DAO; decisions of the Claim Assessors cannot be contested by PICNIC.
• Deframe: PICNIC is not responsible for failures in the API.

10. USER SUPPORT

PICNIC provides dedicated support through official channels in the app and at usepicnic.com. PICNIC is committed to actively communicating to the User the occurrence of depeg events that may trigger the claim process — especially when User action is required. PICNIC does not guarantee resolution of issues related to on-chain protocols or Nexus Mutual decisions.

11. CHANGES TO THE PRODUCT AND THESE TERMS

PICNIC reserves the right to modify, suspend, or discontinue the Protected Vault at any time without liability beyond the funds already deposited on-chain, which remain under the User's custody. These Terms may be changed with a minimum notice of 10 (ten) business days, except in cases of urgency. Continued use implies tacit acceptance.

12. APPLICABLE LAW AND DISPUTE RESOLUTION

These Terms are governed by the laws of the British Virgin Islands (BVI). Any dispute will first be submitted to an attempt at amicable resolution within 30 days and, if persisting, to arbitration under the General Terms of Use of PICNIC.

13. GENERAL PROVISIONS

• These Terms complement the General Terms of Use of PICNIC. In case of conflict, these provisions prevail.
• The nullity of any clause does not compromise the others.
• Failure to enforce compliance does not imply waiver of future rights.
• These Terms constitute the entire agreement between the parties regarding the Protected Vault.
• The Vault Cover Terms and its Annexes do not formally integrate these Terms, but the User is encouraged to read them directly.

GLOSSARY

Vault Cover Terms — OpenCover x Nexus Mutual

Document governing protocol coverage. For the Protected Vault, only Part B (depeg) is applicable. In case of conflict with these Terms, the Vault Cover Terms prevail.

Part A

Section of the Vault Cover Terms covering protocol risks (bugs, oracle failure, governance takeover, liquidation failure). NOT APPLICABLE for the Protected Vault, as per the Annex.

Part B

Section of the Vault Cover Terms covering depeg of the Covered Token. ONLY current coverage for the Protected Vault.

Covered Components

Set of: (a) Covered Vault (OpenCover contract); (b) Designated Vault (sDAI/Sky/Maker); and (c) Designated Protocol (Sky/Maker DSR code). User interfaces, including the PICNIC app and the Deframe API, are expressly excluded.

Covered Vault Manager (CVM)

OpenCover, the only entity with legitimacy to trigger claims. Attempt to trigger by third parties renders the Cover void.

DSR (DAI Savings Rate)

Variable yield rate of the Sky/Maker protocol. Can be changed at any time, including to zero.

Proof of Cover

Mechanism by which underwriting capital is acquired on-demand by OpenCover proportional to the total in the Covered Vault. Not a fixed pool.

Deductible

5% of the Cover Amount. Formula: Claim Amount = min[Loss Amount − (5% × Cover Amount), Cover Amount].

Unit of Claim

0.975 USDC per sDAI for Part B claims. 2.5% haircut per token, applied before the Deductible.

Reference Value

Reference value of sDAI for calculating the Depeg Percentage, as defined in the Vault Cover Terms.

Cover Amount

Total coverage amount acquired by OpenCover, proportional to the total deposited in the Covered Vault.

Exposed Funds

Total value of assets exposed in the Covered Components. If they exceed the Cover Amount, the Claim Amount will be proportionally reduced.

Cool Down Period

Part B: equal to Depeg Time (7 days). No claim can be submitted before the end.

Depeg Time

7 (seven) consecutive days — minimum uninterrupted price deviation period for Part B coverage.

Depeg Percentage

10% of Reference Value — minimum deviation required, combined with Depeg Time, for Part B coverage.

Material Loss

Loss whose Claim Amount, after subtracting the Deductible, exceeds the gas costs involved in approval.

Material Change in Risk

Material change in OpenCover's activities or terms affecting the risk profile, giving Nexus Mutual the right to deny claims (cl. 14).

Rug Pull

Intentional confiscation of funds by controllers. May not result in qualified depeg and, therefore, may not trigger coverage.

Claim Assessors

Nexus Mutual evaluators responsible for approving or rejecting claims. Discretionary and sovereign decision.

Discretionary Coverage

Protection granted by Claim Assessors' decision, without legal obligation to pay. Not regulated insurance by SUSEP.

DeFiBasket Labs Inc. | PICNIC | usepicnic.com