Architecture Overview

Infrastructure is developed in collaboration with Nethermind (smart contract engineering and security) and the XDC Core team (network-level validator integration).

System Design

The whole system is one non-upgradeable vault contract on XDC plus the network's own validator contract. Users and partners only ever talk to the vault; the operations team funds it and distributes rewards into it.

 Users / partner apps                    Operations team
   stake · redeemWithQueue · cancel        distributeRewards (monthly)
   read share price / queue                fundBacking · queue budget
            │                                       │
            ▼                                       ▼
┌─────────────────────────────────────────────────────────────┐
│  PrimeStakedXDC_V3_2  (ERC-4626, non-upgradeable)           │
│  · mints/burns psXDC at totalAssets / totalShares           │
│  · instant withdrawals from unencumbered liquidity          │
│  · FIFO withdrawal queue paid from queueBackingBudget       │
│  · delayed governance, loss caps, bounded scans             │
└───────────────┬─────────────────────────────┬───────────────┘
                │ propose / resign            │ events
                ▼                             ▼
   XDC validator contract            Goldsky subgraph → app,
   (masternodes, 10M XDC each,       Transparency page,
   ~35-day unbonding)                partner reporting

Around the vault sit the peripheral contracts: ReferralRegistry / ReferralRewards (referral program), the PsxdcOFTAdapter lockbox and PsxdcRateSender (bridge and rate oracle), and the StakeXDC Spot pair and limit-order book. None of them custody user principal.

Contract Topology

Full inventory (referral program, Spot venue, bridge, rate oracle, partner registry and superseded contracts) in Deployed Contracts & Addresses.

Validator Infrastructure

StakeXDC operates XDC Network masternodes that generate the underlying staking yield:

• Validator delegation is performed by PrimeStakedXDC_V3_2 directly against the on-chain XDC validator contract. No off-chain custodian.
• Operator onboarding is admin-controlled (KYC-verified masternode operators); operator scans are bounded by operatorScanLimit to prevent gas-griefing.
• Auto-propose runs opportunistically during stake or via triggerAutoPropose(maxNodes). It is blocked whenever the withdrawal queue has a backlog, so user redemptions are prioritised over new validator locks.
• Resignation returns principal to the vault after the network candidateWithdrawDelay (~35 days under typical block times). reportMasternodeResignPrincipal(operator) accounts for the returned principal without inflating the reward share.
• Per-operator tracking of outstanding principal both globally and per operator (outstandingValidatorPrincipalByOperator).
• No principal-stake slashing. XDC penalizes underperforming masternodes via temporary exclusion (~2h) and missed rewards, but never burns staked capital.

→ Custody Model

Security Layers

Data Flow

Staking

1. User calls stake() or depositNative(assets, receiver) on PrimeStakedXDC_V3_2 with native XDC as msg.value.
2. Vault mints psXDC shares at the current exchange rate (totalAssets / totalShares).
3. Once un-earmarked liquidity reaches the masternode stake threshold (minStake, 10M XDC by default) and no queue backlog exists, auto-propose delegates it to a masternode through the XDC validator contract.

Reward Accrual

1. Masternode rewards are collected off-vault and distributed into it by the operations team (distributeRewards, roughly monthly, sized to the 4.5% target).
2. totalAssets increases; share supply does not.
3. Exchange rate steps up, so every psXDC share is worth more XDC. There is no per-user claim step.

Withdrawal

1. User calls redeemWithQueue(shares, receiver) (or withdrawWithQueue(assets, ...)).
2. If maxRedeem(user) >= shares, the redemption settles instantly in the same transaction.
3. Otherwise the request enters the FIFO queue; shares are escrowed inside the vault. The request is paid by position from the ring-fenced queue budget (smaller requests may settle first) and settlement uses the live exchange rate at processing time.
4. processWithdrawalQueue(maxRequests) is permissionless; anyone can push the queue forward. Payouts go straight to the receiver.
5. Only failed receiver payouts defer into pendingQueuedAssets; the user collects those via claimQueuedAssets.

Integration Points

→ Integration Models → Custody Model → Governance