Reviewers & operators
L2 sequencer failure mode, quantified exposure, compensating controls and strict-upgrade plan.
Risk acceptance: STK-001 L2 sequencer liveness
Decision
| Field | Value |
|---|---|
| Finding | no approved canonical Robinhood Chain sequencer-uptime feed |
| Severity | High |
| Design | explicit StonkPriceUnprotected until strict protection is available |
| Status | contract deployment may be reviewed; funded markets are not authorized |
| Required acknowledgement | ACCEPT_UNPROTECTED_SEQUENCER_RISK=true |
| Expiry | canonical feed availability, relevant sequencer incident, monitoring gap, or exposure increase |
The protocol cannot currently distinguish a healthy sequencer from an outage or early recovery. The manifest, verifier, and mainnet UI must identify this as ACCEPTED_UNPROTECTED. That label is disclosure, not remediation.
Named engineering/security and operations/risk approvers must separately authorize a maximum funded exposure. A zero-market deployment does not authorize deposits.
Accepted failure
An equity price can be published before an outage, remain within its configured heartbeat, and be consumed during outage or early-recovery ordering before a fresh round exists. An actor with preferential inclusion may receive STONK against an asset whose realizable value has fallen.
PRICE still checks round completion, timestamps, heartbeat, identity, decimals, deviation, cap, and Robinhood pause state. None proves L2 liveness.
Exposure
The maximum additional issuance is aggregate live unsold STONK capacity, not the quantity of quote assets. maxPayout separately bounds one deposit. Mainnet genesis contains no market templates and deployment creates no markets.
For a market floor p, haircut h, price drop d, and payout q:
risk-adjusted assets = p x (1 - h) x (1 - d) x q
modeled shortfall = max(0, 1 - p x (1 - h) x (1 - d)) x q
Approvers must calculate this using the proposed live capacity, correlated gaps, liquidity discounts, issuer restrictions, existing supply, and realistic inclusion timing. The template total must never be treated as an approved budget.
Compensating controls
- Production refuses an implicit or mislabeled unprotected deployment.
- The deployed implementation, manifest, verifier, UI, and public docs expose the mode.
- All ordinary price and token metadata validation remains active.
- Production deploys with zero markets and no scheduled emissions.
- Capacity, payout, market count, asset count, deviation, and price caps are bounded onchain.
- Guardian containment can stop new mint and treasury activity; only governance can restart.
- Independent monitoring must identify sequencer incidents through operational sources even though PRICE cannot enforce them onchain.
These controls bound or disclose exposure; they do not detect the failure in the contract.
Conditions for funded markets
- independent review of the exact release and this exception;
- two named signatures with a dollar loss budget and aggregate unsold-capacity ceiling;
- external-token control and liquidity diligence;
- current-fork containment and recovery rehearsal;
- alert and public-status fire tests; and
- public disclosure that sequencer protection is unavailable.
Retirement
When an approved Chainlink-compatible feed exists, independently verify its address, code, decimals, status semantics, and operating history. Deploy strict StonkPrice with registry migration, verify all copied assets and outage/recovery behavior on a current fork, execute a decoded Kernel module upgrade through governance, independently verify live policy wiring and prices, update all public artifacts, and retire this record only after strict protection is proven live.