Security owners & reviewers
Threat model, evidence requirements, release workflow and continuous operations.
Security program
The security program treats contract correctness and launch safety as separate gates.
Scope
- Kernel, modules, policies, STONK, StonkVault, Governor, and Timelock.
- Deployment, manifests, configuration, Safe validation, and verification scripts.
- Chainlink feeds and Robinhood tokenized assets.
- Frontend, Privy, browser RPC, Cloudflare, DNS, and release credentials.
- Governance signers, incident responders, monitoring, and public communications.
Threat model
Reviewers assume malicious users, market creators, governance proposals, calldata, RPCs, frontend releases, dependency updates, and compromised deployer or Safe signers. They also model stale or incorrect feeds, sequencer failure, token freeze/upgrade/blocklist behavior, illiquid reserves, concentrated votes, donation manipulation, rounding attacks, denial of service, and operational mistakes.
Required evidence
- Frozen release commit and reproducible toolchain.
- Clean formatting, build, unit, fuzz, invariant, coverage, local E2E, and production-fork results.
- Static analyzer, dependency advisory, license, secret, and supply-chain reports.
- Independent audit and retest of the exact candidate.
- Exact fork simulation and decoded production transaction review.
- Independent live verification output and manifest/runtime hashes.
- Production-origin wallet and transaction smoke test.
- Alert fire tests and incident exercise record.
- Signed economic, counterparty, and STK-001 decisions.
Severity policy
| Severity | Typical impact | Launch treatment |
|---|---|---|
| Critical | direct unbounded loss or permanent hostile control | must fix |
| High | bounded but material loss, governance compromise, or core safety failure | fix or signed time-bounded exception with exposure cap |
| Medium | limited loss, important availability/integrity degradation | owner and remediation plan required |
| Low | defense-in-depth or low-impact correctness issue | track and schedule |
No issue is closed solely because market capacity is initially zero. Zero capacity is a compensating control, not remediation.
Review workflow
Changes to issuance, valuation, vault conversions, external-token handling, roles, Safe validation, deployment, governance, or frontend transaction construction require targeted threat review and executable regression evidence. ABI and canonical docs update in the same release.
Continuous operations
After launch, monitor backing, concentration, external assets, feeds, STONK supply, vault assets/shares/rate, markets and notes, roles and module state, governance and Timelock activity, Safe changes, frontend integrity, RPC divergence, and public-status delivery.
Security reports need a public contact, encrypted channel, safe-harbor terms, acknowledgement target, escalation owner, and funded bounty before public launch.
Launch authority
Only the mainnet launch gates determine whether a funded launch is authorized. The dated internal review and STK-001 record provide inputs but do not replace independent approval.