> For the complete documentation index, see [llms.txt](https://shakestock.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shakestock.gitbook.io/whitepaper/security-and-risk/security-model.md).

# Security Model

The layered security model covering anti-cheat controls, smart-contract enforcement, self-custody, transaction transparency, and administrative controls.

SHAKESTOCK uses separate application, smart-contract, blockchain, wallet, and administrative layers. Each layer addresses a defined part of the risk model.

### Threat model

The whitepaper identifies risks around reward abuse, automated shaking, duplicate accounts, excessive activity, claim replay, smart-contract bugs, unauthorized parameter changes, infrastructure outages, and tokenized stock.

The controls below reduce these risks. They do not remove every risk from the system.

### Defense in depth

| Risk                     | Control                        | Layer          |
| ------------------------ | ------------------------------ | -------------- |
| Automated shaking        | Movement threshold + future ML | Application    |
| Event spam               | 800 ms debounce                | Application    |
| Excessive shaking        | 500 daily shakes               | Application    |
| Multi-account abuse      | Device fingerprint             | Application    |
| Request abuse            | IP rate limit                  | Application    |
| Identity abuse           | Telegram identity verification | Application    |
| Claim replay             | Unique claim enforcement       | Smart contract |
| Excessive stock claims   | $10/user/day cap               | Smart contract |
| Parameter transparency   | Contract events                | Blockchain     |
| Transaction verification | Blockscout                     | Blockchain     |

The movement threshold provides the current activity control. Machine-learning anti-cheat belongs to planned Phase 2 and Phase 3 functionality. It is not a current control.

### Application security and on-chain security

#### Application layer

The application layer handles movement evaluation, an 800 ms debounce, device fingerprinting, IP rate limits, Telegram identity verification, and Shake Coin activity controls. It also applies the 500-shake daily activity cap.

These controls help assess user activity before a stock claim. They do not independently enforce blockchain state.

#### On-chain layer

The smart contract processes stock claims. It enforces unique claims and the $10-per-user-per-day stock claim cap.

Robinhood Chain maintains token state and the transaction record. This record supports public verification through Blockscout.

The separation matters because application anti-cheat and blockchain enforcement solve different problems. Application controls address activity and request behavior. The smart contract enforces the defined on-chain claim rules.

### Self-custody and transparency

The whitepaper states that tokens remain in the user's wallet. SHAKESTOCK does not hold them.

Reward parameters are stored in the smart contract. When parameters change, the contract emits an event. The change is publicly visible on-chain.

### Administrative trust

The owner can adjust parameters and withdraw pool funds. Owner control uses a multi-sig.

This is an explicit trust boundary. The system should not be described as fully permissionless or completely trustless.

### Audit status

{% hint style="warning" %}
**Internal audit:** Completed.

**Third-party audit:** Not yet completed. It is planned after launch.
{% endhint %}

The internal audit does not eliminate smart-contract risk. A third-party audit has not yet been completed.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://shakestock.gitbook.io/whitepaper/security-and-risk/security-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.