Security model

STONK combines smart-contract, oracle, external-asset, governance, and frontend risk. Passing tests does not make funded markets safe to launch.

Core invariants

1. STONK minting requires active MINTR authorization and conservative backing.
2. Bond deposits cannot exceed live capacity or per-transaction payout bounds.
3. Treasury withdrawals require active TRSRY authorization.
4. StonkVault shares are backed by its STONK balance under ERC-4626 accounting.
5. Vault deposits and redemptions are atomic and can enforce explicit slippage bounds.
6. Revenue donations do not mint STONK, stSTONK, or voting power.
7. stSTONK voting checkpoints follow share mint, burn, transfer, and delegation.
8. Invalid price data fails closed for valuation-sensitive operations.
9. Production deployer authority is removed after control handoff.
10. Guardian authority is containment-only; restart and steady-state changes require delay.

Vault risks

The vault uses OpenZeppelin ERC-4626 with virtual-share accounting. Tests cover adversarial first deposits, donations, rounding, conservation, fuzzed operations, and stateful invariants. Integrators must still account for rounding and use preview-plus-limit transactions.

Direct STONK transfers increase share value and are irreversible donations. A mistaken transfer benefits existing shareholders. Revenue routing must therefore be explicit, observable, and independently reconciled.

The vault can return only STONK it holds. STONK token bugs, chain failures, governance changes, or compromised dependencies remain risks. stSTONK is not a claim on underlying treasury stock tokens.

Economic risks

Backing is not redemption. Reserve assets may become illiquid, frozen, blocked, paused, upgraded, depegged, mispriced, or subject to corporate actions. Haircuts and caps reduce modeled exposure but do not guarantee realizable proceeds.

Launch has no scheduled token emissions. This eliminates dilution disguised as yield but does not create revenue. Any future revenue or buyback mechanism requires an audited source-to-vault flow and accounting policy.

Funded risk is bounded primarily by aggregate live unsold bond capacity. Governance must approve a loss budget, concentration limits, and stress backing before opening markets.

Oracle risks

PRICE validates feed identity, decimals, round completion, source timestamps, heartbeat, deviation, and cap. Equity valuation also checks Robinhood pause state. It has no offchain writer.

The current mainnet mode cannot detect sequencer outages with a canonical uptime feed. That accepted High risk, exposure limit, controls, and expiry are in STK-001. No funded launch is authorized without signed acceptance.

Governance risks

Delegated token voting and Timelock delay reduce unilateral control but remain vulnerable to vote concentration, malicious proposals, signer compromise, UI deception, and governance apathy. Vault revenue increases economic value per vote without increasing vote count, which can affect acquisition economics but not checkpoint arithmetic.

Production requires separated genesis and guardian Safes, decoded proposal review, independent simulation, and eventual genesis proposer revocation.

Emergency authority

The guardian can disable mint/treasury capabilities and cancel queued operations. It cannot execute, withdraw, reconfigure, mint, or restart. Emergency shutdown is containment and may interrupt normal operations; governance-only restart prevents a compromised guardian from reopening the protocol.

Frontend and supply chain

The static frontend can still deceive users if DNS, hosting, dependencies, build credentials, Privy configuration, RPC responses, or a developer account is compromised. Users and operators should verify chain, addresses, decoded calls, and explorer state. Release artifacts must be tied to the reviewed commit and manifest.

Validation evidence

The candidate requires formatting, build, unit tests, high-run fuzzing, stateful invariants, coverage thresholds, local lifecycle rehearsal, current production-fork rehearsal, ABI reproducibility, TypeScript build, browser tests, static analysis, dependency and secret scanning, and independent audit.

Repository tests are evidence, not an audit substitute.

Public disclosure

Users must be told:

• backing constrains issuance but is not redemption or a peg;
• stSTONK is non-rebasing and has no guaranteed APY;
• vault revenue depends on actual STONK entering the vault;
• tokenized assets carry issuer, freeze, upgrade, liquidity, oracle, and corporate-action risks;
• governance, chain, smart-contract, wallet, RPC, and frontend failures can cause loss; and
• emergency shutdown may stop protocol capabilities but cannot reverse loss.

Incident response

Preserve evidence first. Contain only affected capabilities, cancel dangerous queued operations, disable misleading UI actions, quantify maximum exposure from independent RPCs, communicate verified facts, and recover through the smallest simulated Timelock proposal. Do not restart until root cause and post-state assertions have independent approval.

Security contact, safe-harbor terms, severity policy, response targets, and bounty budget are blocking launch inputs tracked in the launch gates.