Security
StonksPad is built on the assumption that servers can be hacked. Funds and rewards are protected by contract rules, not by trust in the operator.
Vault design
- One vault per token. Each vault only ever holds that token's revenue and the reward assets it is buying.
- Fixed at launch. A vault's reward assets, how each one is priced and bought, its fee split, its limits and the address that receives the platform fee are copied into the vault when the token launches. No StonksPad key, and not StonksPad's timelock either, can change them afterwards.
- Rewards are held by Flap's dividend contract. What a vault buys is deposited into the token's dividend contract, which credits holders on-chain and pays them out. StonksPad cannot move those rewards.
- No off-chain operator. Purchases happen only in rounds started by Flap's trigger service (or by Flap's Guardian). Settling and scheduling can be started by anyone with a public call that cannot buy or redirect anything. No StonksPad account runs or controls the vaults.
Who can do what
| Role | Powers | Cannot |
|---|---|---|
| Flap trigger service | Start a vault's purchase round (about once an hour) | Change a vault, move funds |
| Anyone | The public process() call (at most once per 10 minutes): settle, allocate, schedule | Buy, redirect or withdraw anything |
| StonksPad timelock (48 hours, held by a 2-of-3 Safe) | For new launches only, after a 48-hour public delay: registry assets, the platform fee, the settings of future vaults | Act on a launched vault, act without the 48-hour delay |
| Flap Guardian | Emergency actions on a live vault, immediately: pause a reward asset, repair an asset's price feed, cancel a stuck purchase request, start a round, upgrade the vault and basket code (it owns both beacons). With vault implementation v2.4.2: rescue mode (see below) | Not limited by StonksPad: these are Flap's powers |
Emergency powers
Only Flap's Guardian holds emergency powers over a live vault. A paused reward asset keeps its share for 72 hours and is then redistributed to the other assets; what was already bought stays in the basket.
Vault implementation v2.4.2 is deployed and becomes active when Flap's Guardian switches the vault beacon to it. It adds a rescue mode: the Guardian can move BNB or tokens the vault holds and redirect the vault's new tax income to another address. Rescue mode only redirects new income. Rewards already deposited stay in Flap's dividend contract and remain claimable, and rounds already funded still run. While a vault is in rescue mode its token page shows a red notice with the address.
StonksPad's own admin and timelock have no emergency power over live vaults.
Price safety
Every purchase is checked against an on-chain reference price (a Chainlink feed, or a TWAP over at least 30 minutes) with a deviation cap, and purchases are capped per round. If the price is off or a price source is stale, the purchase waits for a later round instead of filling badly. Payouts to holders never depend on a price.
Upgrades
Vaults and rewards baskets are upgradeable beacon proxies. The only address that can upgrade them is Flap's Guardian, not StonksPad.
Custodial wallets
Users who sign in with X get a wallet whose key is managed by a separate signer service that is not reachable from the internet, with per-transaction and daily limits. Users can export their private key at any time.
Audits
The vault is built to Flap's public vault specification and its source is verified on BscScan. There is no third-party security audit yet.
- Internal red-team reviews of the web application and the signer (findings fixed). This is not a third-party audit.
- Contract source is verified on BscScan for every contract deployed on mainnet, and every vault is visible on flap.sh.
More on the roles outside StonksPad's contracts: How rewards work, "Trust assumptions".