Custody Model
StakeXDC operates a non-custodial, smart contract-based custody model. Staked assets are held and delegated entirely by audited on-chain contracts, with no human interaction in custody flows.
StakeXDC operates a non-custodial, smart contract-based custody model. Staked assets are held and delegated entirely by audited on-chain contracts - no human interaction in custody flows.
Design Principles
| Principle | Implementation |
|---|---|
| Non-custodial | Users retain full ownership of assets at all times |
| Permissionless | Anyone can verify validator state and staked assets on-chain |
| Trustless | No single entity controls the staked principal - the protocol enforces custody rules through code |
| Transparent | All custody operations are logged on the blockchain |
How It Works
Validator Key Management
- Staked XDC is delegated by the vault contract directly against the on-chain XDC validator contract; no human holds the delegated principal
- Masternode operators are KYC-verified and run the node infrastructure; they never hold user funds, which stay locked in the validator contract and return to the vault on resignation
- Operator onboarding, proposals and resignations are governed by contract logic and role-gated functions
Staked Asset Custody
- User XDC deposits are held in the
PrimeStakedXDC_V3_2vault. It is non-upgradeable, so the logic that holds your XDC can never be modified - The vault's unencumbered XDC serves instant redemptions (V3.2 has no percentage buffer target); the rest of the collateral works in KYC-verified masternodes on the XDC Network, and queued withdrawals are paid from a separate ring-fenced budget
- Withdrawal requests use
redeemWithQueue: instant when the vault has liquidity, queued FIFO (paid by position) otherwise. Only failed payouts defer intopendingQueuedAssets, where the user collects them viaclaimQueuedAssets. There is no admin approval step at any point. - The vault has no
mintand noownerWithdraw. Even the protocol admin cannot move user funds.
Two Distinct Layers
It is important to distinguish between asset custody and contract governance:
| Layer | Mechanism | Human Involvement |
|---|---|---|
| Staked principal custody | Fully on-chain: vault contract → XDC validator contract | None - trustless by design |
| psXDC vault | Non-upgradeable, deployed with a regular constructor, no proxy | None - cannot be modified |
| Parameter changes (psXDC vault) | Role-gated + delayed governance (schedule → wait → execute) | Yes - multi-party approval, but cannot move user funds |
Institutional Considerations
| Question | Answer |
|---|---|
| Who controls the masternodes? | The vault contract delegates and resigns programmatically; KYC-verified operators run the nodes |
| Can the vault be upgraded? | No. It is non-upgradeable; the only way to change vault logic is to deploy a new contract |
| Who signs parameter changes? | Multisig governance with timelock (see Governance) |
| Is there a multisig? | Yes - role rotations and risk-parameter changes require multi-party approval |
| Is there a timelock? | Yes - parameter changes are scheduled and execute only after governanceDelay, to allow review |
| Who controls the treasury? | Protocol treasury is governed by multisig with transparent on-chain operations |
| Is there automated reporting? | Yes - all staking, reward, and withdrawal events are indexed on-chain |
Audit & Collaboration
The custody model is developed in collaboration with:
- Nethermind - smart contract development and security review
- XDC Core team - network-level validator integration
- QuillAudits - independent external audit (98.8% score on staking contracts)
The custody substrate (the PrimeStakedXDC_V3 vault design + PrimeStakedXDC_V3MigrationBridge) was independently audited by Nethermind Security in NM-0843, XDC Prime Stake (final report May 08, 2026). All Critical, High, and Medium findings are Fixed. The live vault, PrimeStakedXDC_V3_2, is a redeployment of this audited codebase. See the Audits page for the V3.2 delta. Full report (PDF).
Risk Mitigation
| Risk | Mitigation |
|---|---|
| Smart contract exploit | Independent audits, reentrancy guards, pausable contracts |
| Validator downtime | Multi-validator delegation, performance monitoring |
| Key compromise | Staked principal sits in the validator contract, not in operator or admin wallets; role keys cannot move user funds |
| Delayed withdrawals | Transparent FIFO queue paid by position; instant when the vault has liquidity, otherwise funded as masternode principal returns after the network's candidateWithdrawDelay (~35 days under typical block times) |
What This Means for Partners
- No third-party custodian risk - assets are secured by code, not by an institution
- Verifiable at any time - on-chain state is the single source of truth
- No operational dependency - the protocol operates autonomously once deployed
- Institutional-grade transparency - full auditability aligned with exchange compliance requirements
Architecture Overview
Infrastructure is developed in collaboration with Nethermind (smart contract engineering and security) and the XDC Core team (network-level validator integration).
Integration Models
StakeXDC offers two integration models for exchanges, custodians, and institutional partners. Both leverage the same audited, battle-tested infrastructure.