> For the complete documentation index, see [llms.txt](https://shakestock.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shakestock.gitbook.io/whitepaper/security-and-risk/smart-contract-security.md).

# Smart Contract Security

The on-chain security properties, claim controls, replay protection, parameter transparency, and administrative trust boundaries of SHAKESTOCK smart contracts.

The smart contract does not detect phone movement. Its role is to enforce the on-chain rules for stock claims.

```
Application
  → Claim Request
  → Smart Contract
  → Validation / Enforcement
  → Token Delivery
  → Transaction Record
```

The application handles Shake Coin activity. The contract validates and enforces the source-defined claim properties.

### Replay protection

> Each claim is unique. Can't be used twice.

This is the replay-protection property defined by the whitepaper. A claim that has already been used cannot be used again.

The whitepaper defines the property, not its implementation. It does not specify a nonce, claim ID format, signature scheme, mapping structure, hash format, or storage layout.

### Daily claim limit

| Property    | Definition           |
| ----------- | -------------------- |
| Maximum     | $10 per user per day |
| Enforcement | Smart contract       |
| Scope       | Stock claims         |

On-chain enforcement matters because a backend-only rule could potentially be bypassed if application controls fail. The whitepaper specifically states that the smart contract enforces this limit.

This claim cap is distinct from the application-level 500-shake daily cap.

### Transparent parameters

Reward parameters exist in the smart contract. When parameters change, an event is emitted.

The resulting change is publicly observable on-chain. The whitepaper does not specify event names.

### Immutable token properties

The whitepaper identifies two permanent token properties:

* Supply is fixed.
* Liquidity is permanently locked.

These properties cannot be changed after launch. They are separate from protocol parameters that the owner can adjust.

### Administrative control

The owner can adjust parameters and withdraw pool funds. Owner control uses a multi-sig.

This creates a stated trust assumption. The whitepaper does not specify signer count, signature threshold, timelocks, governance, a DAO, or an upgrade mechanism.

### Audit status

{% hint style="warning" %}
**Internal audit:** Completed\
**Third-party audit:** Not completed yet\
**Planned:** After launch
{% endhint %}

Audit status is part of the current security boundary. The contracts should not be described as fully audited.

### Smart-contract risk

> Bug risk always exists in smart contracts.

An internal audit reduces known risk. It cannot guarantee the absence of vulnerabilities.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://shakestock.gitbook.io/whitepaper/security-and-risk/smart-contract-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.