Docs

Security model

Flatstock is built so it can only do what you signed. This page lists what the code does. It is a hackathon project and has not been audited.

Self-custody

Stock Tokens go directly to your wallet. The app never holds your funds, and there is no account.

A signature for every action

• Votes, buys and sells are authorised by your own EIP-712 signature for that exact action (round and stock, exact legs and minimum outputs, or exact token and amount), plus a nonce and a deadline.
• Token movement uses standard EIP-2612 permits for the exact amount.
• There is no account delegation (no EIP-7702) and nothing is paid in $WIF as gas.
• The relayer can only submit what you signed. It cannot change the signed fields; it can refuse or delay a request, in which case you can send the same action from your own wallet and pay your own gas.

Price and oracle guards

• Every swap leg must be within 2% of Chainlink, or the whole buy is blocked.
• Missing quotes, stale prices (older than 24 hours) and unhealthy feeds fail closed.
• Each leg has a minimum output.

Relayer limits

• 3 sponsored transactions per wallet per day.
• Automatic pause when the relayer's ETH is low (below 0.0003 ETH); the pause fails closed if the balance cannot be read.
• An operator kill switch.
• The relayer's key is held only on the server; the website holds no secrets.

Contracts

The votes, router and lock contracts all have exact-match source verification on Sourcify, and the source is in the repository. See Contracts and addresses.

• None of the three contracts is a proxy and none can be upgraded: there is no delegatecall or selfdestruct.
• The router and the lock contract have no owner and no admin functions.
• The vote contract has one immutable owner (the relayer wallet). It can only open rounds. It cannot move, freeze or redirect anyone's $WIF. Closing a round is open to anyone after its closing time.
• Approvals are exact: 1 $WIF to vote, 10 $WIF to lock, and only the USDG or Stock Token amount of the action you are doing.

The full findings, with severities and what is mitigated, are in SECURITY.md.

What we do not claim

No audit, no insurance, no guarantee of availability. Use small amounts. Report a problem through the repository.

Notice Not available to US persons, or in Canada, the UK, Switzerland or other restricted jurisdictions. Not investment advice. Restricted jurisdictions