> For the complete documentation index, see [llms.txt](https://shakestock.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shakestock.gitbook.io/whitepaper/security-and-risk.md).

# Security & Risk

How SHAKESTOCK approaches security, smart-contract risk, infrastructure dependencies, and regulatory considerations.

SHAKESTOCK does not rely on a single security mechanism. Security is distributed across application controls, smart-contract enforcement, blockchain transparency, self-custody, infrastructure dependencies, administrative controls, audit status, and remaining risk.

### Security layers

| Layer          | Main control                                        |
| -------------- | --------------------------------------------------- |
| Application    | Anti-cheat and activity controls                    |
| Smart Contract | Claim limits and replay protection                  |
| Blockchain     | On-chain transaction record                         |
| Wallet         | Self-custodial token ownership                      |
| Infrastructure | Telegram + Robinhood Chain dependencies             |
| Administration | Owner parameter controls + multi-sig                |
| Audit          | Internal audit completed; third-party audit pending |

The application layer evaluates activity before a claim. The smart contract enforces source-defined claim rules on-chain.

Robinhood Chain records claim transactions and token state. Blockscout provides public transaction verification.

Tokens remain in the user's wallet. SHAKESTOCK does not hold those tokens.

Administrative control is a separate trust boundary. The owner can adjust parameters and withdraw pool funds through a multi-sig owner model.

### Key security properties

#### Self-custody

The whitepaper states that tokens remain in the user's wallet. SHAKESTOCK does not hold user tokens.

#### On-chain claims

Each stock claim is an on-chain transaction. Users can verify its record on Blockscout.

#### Replay protection

Each claim is unique and cannot be used twice. This property is enforced by the smart contract.

#### On-chain daily cap

The maximum stock claim value is **$10 per user per day**. The smart contract enforces this cap, rather than relying only on backend controls.

This is separate from the application-level limit of **500 shakes per user per day**.

#### Transparent parameters

Reward parameters exist in the smart contract. Parameter changes emit an event, making the change publicly observable on-chain.

#### Immutable token properties

The whitepaper states that token supply is fixed. It also states that liquidity is permanently locked.

These token properties remain separate from adjustable protocol parameters.

### Security boundary

```
User / Device
       ↓
Anti-Cheat Layer
       ↓
Shake Coins
       ↓
Claim Request
       ↓
Smart Contract
       ↓
Robinhood Chain
       ↓
Tokenized Stock
       ↓
User Wallet
       ↓
Blockscout
```

Each layer has a different responsibility. Anti-cheat controls assess application activity. The contract validates claim rules. Robinhood Chain records execution. The wallet holds the resulting token. Blockscout exposes the transaction record for verification.

### Risk mindset

Security controls reduce specific risks. They do not eliminate smart-contract bugs, platform outages, market risk, tokenized-stock risk, administrative risk, or regulatory uncertainty.

Continue with [Security Model](/whitepaper/security-and-risk/security-model.md) for the layered defenses, [Smart Contract Security](/whitepaper/security-and-risk/smart-contract-security.md) for on-chain controls, [Platform Dependencies](/whitepaper/security-and-risk/platform-dependencies.md) for external dependencies, and [Regulatory Considerations](/whitepaper/security-and-risk/regulatory-considerations.md) for legal-risk disclosures.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://shakestock.gitbook.io/whitepaper/security-and-risk.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.