Custody Model
StakeXDC operates a non-custodial, smart contract-based custody model. Validator keys and staked assets are managed entirely by audited on-chain contracts - no human interaction…
StakeXDC operates a non-custodial, smart contract-based custody model. Validator keys and staked assets are managed entirely by audited on-chain contracts - no human interaction in custody flows.
Design Principles
| Principle | Implementation |
|---|---|
| Non-custodial | Users retain full ownership of assets at all times |
| Permissionless | Anyone can verify validator state and staked assets on-chain |
| Trustless | No single entity controls validator keys - the protocol enforces custody rules through code |
| Transparent | All custody operations are logged on the blockchain |
How It Works
Validator Key Management
- Validator keys are generated and secured by on-chain smart contracts
- No human operator has direct access to private keys
- Key rotation and management are governed by contract logic
Staked Asset Custody
- User XDC deposits are held in the
PrimeStakedXDC_V3_2vault. It is non-upgradeable, so the logic that holds your XDC can never be modified - The vault's unencumbered XDC serves instant redemptions (V3.2 has no percentage buffer target); the rest of the collateral works in KYC-verified masternodes on the XDC Network, and queued withdrawals are paid from a separate ring-fenced budget
- Withdrawal requests use
redeemWithQueue: instant when the buffer covers them, queued FIFO otherwise. Failed payouts defer intopendingQueuedAssetsand the user collects them viaclaimQueuedAssets. There is no admin approval step at any point. - The vault has no
mintand noownerWithdraw; these were removed in V3. Even the protocol admin cannot move user funds.
Two Distinct Layers
It is important to distinguish between asset custody and contract governance:
| Layer | Mechanism | Human Involvement |
|---|---|---|
| Validator key custody | Fully on-chain, smart contract-managed | None - trustless by design |
| psXDC v3 vault | Non-upgradeable, deployed with a regular constructor, no proxy | None - cannot be modified |
| Parameter changes (psXDC v3) | Role-gated + delayed governance (schedule → wait → execute) | Yes - multi-party approval, but cannot move user funds |
Institutional Considerations
| Question | Answer |
|---|---|
| Who controls the masternodes? | Smart contracts manage validator operations programmatically |
| Who signs upgrades? | Multisig governance with timelock (see Governance) |
| Is there a multisig? | Yes - contract upgrades require multi-party approval |
| Is there a timelock? | Yes - upgrade execution is delayed to allow review |
| Who controls the treasury? | Protocol treasury is governed by multisig with transparent on-chain operations |
| Is there automated reporting? | Yes - all staking, reward, and withdrawal events are indexed on-chain |
Audit & Collaboration
The custody model is developed in collaboration with:
- Nethermind - smart contract development and security review
- XDC Core team - network-level validator integration
- QuillAudits - independent external audit (98.8% score on staking contracts)
The custody substrate (the PrimeStakedXDC_V3 vault design + PrimeStakedXDC_V3MigrationBridge) was independently audited by Nethermind Security in NM-0843, XDC Prime Stake (final report May 08, 2026). All Critical, High, and Medium findings are Fixed. The live vault, PrimeStakedXDC_V3_2, is a redeployment of this audited codebase. See the Audits page for the V3.2 delta. Full report (PDF).
Risk Mitigation
| Risk | Mitigation |
|---|---|
| Smart contract exploit | Independent audits, reentrancy guards, pausable contracts |
| Validator downtime | Multi-validator delegation, performance monitoring |
| Key compromise | On-chain key management - no human access to private keys |
| Delayed withdrawals | Transparent FIFO queue; instant when the buffer permits, otherwise bounded by the network's candidateWithdrawDelay (~35 days under typical block times) |
What This Means for Partners
- No third-party custodian risk - assets are secured by code, not by an institution
- Verifiable at any time - on-chain state is the single source of truth
- No operational dependency - the protocol operates autonomously once deployed
- Institutional-grade transparency - full auditability aligned with exchange compliance requirements
Architecture Overview
Infrastructure is developed in collaboration with Nethermind (smart contract engineering and security) and the XDC Core team (network-level validator integration).
Integration Models
StakeXDC offers two integration models for exchanges, custodians, and institutional partners. Both leverage the same audited, battle-tested infrastructure.