> For the complete documentation index, see [llms.txt](https://stonkmarket.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://stonkmarket.gitbook.io/docs/reference/security.md).

# Security

## Design Principles

stonk.market follows a **security by immutability** approach. Once launched, a token cannot be modified by anyone — not the deployer, not the protocol owner, not the factory. Its liquidity is permanent by code.

## Attack Surface Analysis

### Front-Running Prevention

| Vector                      | Mitigation                                                   |
| --------------------------- | ------------------------------------------------------------ |
| Deployment front-running    | Atomic launch buy in the same transaction                    |
| Grace-period exploitation   | No grace period — trading is locked until the next NYSE open |
| Sandwich attacks            | Minimum-output (slippage) protection on swaps                |
| Stale transaction execution | Deadline on swaps                                            |

### Rug Pull Prevention

| Vector                 | Mitigation                                                                                                                |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| Parameter changes      | All token parameters are immutable; the token has no owner                                                                |
| Liquidity removal      | The StonkHook reverts every removal (`ProtocolLiquidityIsPermanent`); only the factory can add liquidity, once, at launch |
| Supply inflation       | Fixed 1,000,000,000 supply; minting is permanently disabled after launch                                                  |
| Upgradeability exploit | Tokens are clones, not proxies — no upgrade path                                                                          |

Uniswap v4 has no LP tokens, so liquidity permanence is enforced directly in the hook rather than approximated by burning LP tokens to a dead address.

### Access Control

| Function                           | Access                                                                                                                                                                             |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Add liquidity to a stonk pool      | Factory only, once, at launch                                                                                                                                                      |
| Remove liquidity from a stonk pool | Nobody — reverts in the hook                                                                                                                                                       |
| Token `initialize()`               | One-shot `initializer`; the implementation's initializers are disabled in its constructor and the factory clones + initializes atomically, so there is no window to hijack a clone |
| Factory parameter changes          | Factory owner only (a Ledger hardware wallet)                                                                                                                                      |
| Fee claims                         | The credited beneficiary only, from the StonkFeeLocker                                                                                                                             |
| Holiday management                 | Oracle owner only                                                                                                                                                                  |

## Two-Layer Market-Hours Enforcement

Off-hours trading is blocked in two independent places (defence in depth):

* The **StonkHook's `beforeSwap`** rejects any swap while the NYSE is closed.
* The **token's transfer function** gates every `transfer` / `transferFrom` the same way.

Either alone is sufficient; neither depends on the other.

## Key Security Properties

1. **No token has an owner** — after launch, there is no privileged address.
2. **Factory changes are forward-only** — they only affect future launches.
3. **The oracle is shared but safe** — it can update holidays but cannot touch a token's trading logic or funds.
4. **Liquidity is permanent** — code-enforced, not LP-burn-approximated.
5. **The fee is never in the launched token** — only the backing asset (WETH or USDC) is ever taken as fee.

## Recommendations for Protocol Operators

* Hold the factory owner key on **hardware** (the production owner is a Ledger).
* Keep MarketHoursOracle ownership on a **multisig**.
* Populate the holiday calendar for at least 2 years ahead.
* Consider a **timelock** on factory parameter changes.
* Run static analysis (Slither, Mythril) before deploying any protocol upgrades.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://stonkmarket.gitbook.io/docs/reference/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.