Architecture Overview

Infrastructure is developed in collaboration with Nethermind (smart contract engineering and security) and the XDC Core team (network-level validator integration).

---

System Design

---

Contract Topology

Full inventory in Deployed Contracts & Addresses.

---

Validator Infrastructure

StakeXDC operates XDC Network masternodes that generate the underlying staking yield:

• Validator delegation is performed by PrimeStakedXDC_V3_2 directly against the on-chain XDC validator contract. No off-chain custodian.
• Operator onboarding is admin-controlled (KYC-verified masternode operators); operator scans are bounded by operatorScanLimit to prevent gas-griefing.
• Auto-propose runs opportunistically during stake or via triggerAutoPropose(maxNodes). It is blocked whenever the withdrawal queue has a backlog, so user redemptions are prioritised over new validator locks.
• Resignation returns principal to the vault after the network candidateWithdrawDelay (~35 days under typical block times). reportMasternodeResignPrincipal(operator) accounts for the returned principal without inflating the reward share.
• Per-operator tracking of outstanding principal both globally and per operator (outstandingValidatorPrincipalByOperator).
• No principal-stake slashing. XDC penalizes underperforming masternodes via temporary exclusion (~2h) and missed rewards, but never burns staked capital.

→ Custody Model

---

Security Layers

---

Data Flow

Staking

1. User calls stake() or depositNative(assets, receiver) on PrimeStakedXDC_V3_2 with native XDC as msg.value.
2. Vault mints psXDC shares at the current exchange rate (totalAssets / totalShares).
3. Excess liquidity above the buffer triggers auto-propose if no queue backlog exists; XDC is delegated to a masternode through the XDC validator contract.

Reward Accrual

1. Masternode rewards are collected off-vault and distributed into it by the operations team (distributeRewards, roughly monthly, sized to the 5.5% target).
2. totalAssets increases; share supply does not.
3. Exchange rate rises automatically, so every psXDC share is worth more XDC. There is no manual claim step for the base layer.

Withdrawal

1. User calls redeemWithQueue(shares, receiver) (or withdrawWithQueue(assets, ...)).
2. If maxRedeem(user) >= shares, the redemption settles instantly in the same transaction.
3. Otherwise the request enters the FIFO queue; shares are escrowed inside the vault. Settlement uses the live exchange rate at processing time.
4. processWithdrawalQueue(maxRequests) is permissionless; anyone can push the queue forward.
5. Failed receiver payouts defer into pendingQueuedAssets; the user claims later via claimQueuedAssets.

Integration Points

→ Integration Models → Custody Model → Governance