Trust model

What is enforced on-chain

The audited reward program must enforce all of the following:

• The reward mint cannot change after launch.
• The creator recipient cannot change after launch.
• The creator/holder split cannot change after launch.
• The vault authority is a program-derived address with no private key.
• There is no privileged withdrawal path of any kind.
• There is no generic sweep instruction.
• Destinations cannot be substituted during fee claims.
• Stock cannot be purchased into an unverified token account.
• No claim may exceed cumulative allocation minus the amount already claimed.
• Distributions cannot be replayed.
• Claims never expire.
• Pausing cannot redirect assets.
• No key exists that could seize holder allocations.
• All amounts use checked integer arithmetic.
• Every external program and mint is allowlisted.
• Upgrade authority and root authority are separate multisigs.
• Existing vault assets cannot be silently substituted when an asset is disabled.

What is trusted off-chain

• The indexer. It replays finalized transactions to compute balance-seconds. A defect or a dishonest operator could compute the wrong allocation. Proof Tape publishes the dataset so the computation can be checked and disputed.
• The root publisher. A multisig publishes each Merkle root. It can publish a wrong root, but it cannot exceed the vault's assets, cannot redirect them and cannot take a holder's already-claimable balance.
• The keeper. It triggers fee claims, conversions and deliveries. It cannot choose destinations. A compromised keeper cannot steal — at worst it can waste its own transaction fees or stop cranking.
• The upgrade authority. An upgradeable program can be changed. Review the published policy and multisig before depositing value.
• The issuer and its custodians. The instruments are third-party liabilities that depend on off-chain custody arrangements entirely outside STOCKTRESS's control.
• The compliance provider. Eligibility attestations come from a regulated external provider. STOCKTRESS fails closed when no current attestation exists.

Key custody

STOCKTRESS holds no privileged vault key, no root authority key, no upgrade authority key and no treasury key in application secrets. Reward funds are never held in a database. A server-operated keeper, if used, may only hold a constrained transaction-fee wallet.

Where this application is today

There is no deployed STOCKTRESS reward program. Every reward write is disabled and every reward surface fails closed. The specification the external program must satisfy is published in the repository as docs/STOCKTRESS_REWARD_PROGRAM_SPEC.md, and the readiness checklist is visible on the protocol status page.