Risk & Compliance
StakeXDC maintains a comprehensive risk framework and compliance posture designed for institutional partners and regulated environments.
StakeXDC maintains a comprehensive risk framework and compliance posture designed for institutional partners and regulated environments.
Risk Framework
Smart Contract Risk
| Risk | Severity | Mitigation |
|---|---|---|
| Contract vulnerability | High | Independent external audits (QuillAudits - 98.8% score on V1 liquid staking; Nethermind Security NM-0843 on V3 vault + V3 Migration Bridge, all Critical/High/Medium findings Fixed), reentrancy guards, emergency pause on the V3 vault |
| Dependency failure | Medium | Minimal external dependencies; core logic is self-contained |
| Economic attack | Medium | Ring-fenced queue budget + FIFO queue design, bounded scans, per-report and per-day loss caps |
Validator Risk
| Risk | Severity | Mitigation |
|---|---|---|
| Validator downtime | Medium | Multi-validator delegation, automated failover monitoring |
| Slashing (principal-stake) | None | XDC's slashing mechanism penalizes downtime via temporary exclusion from block production (~2h, 4 epochs) and missed rewards, but never burns principal. This is structurally different from ETH-based liquid staking, where slashing can permanently destroy a portion of staked ETH |
| Reward rate change | Low | Dynamic APY calculation; transparent communication to partners |
Network Risk
| Risk | Severity | Mitigation |
|---|---|---|
| XDC Network halt | Low | Protocol pauses automatically; no loss of funds |
| Fork / chain split | Low | Protocol follows canonical chain; manual intervention if needed |
| Congestion | Low | Transaction prioritization; gas optimization in contracts |
Operational Risk
| Risk | Severity | Mitigation |
|---|---|---|
| Key compromise | High | Staked principal is held by the vault and validator contracts; role keys cannot move user funds |
| Unauthorized parameter change | High | Non-upgradeable vault; role and risk-parameter changes need multisig + timelock |
| Team dependency | Medium | Open-source contracts; protocol operates autonomously on-chain |
Audit History
| Module | Auditor | Findings / Score | Status |
|---|---|---|---|
| XDC Staking Contract (V1 liquid) | QuillAudits | 98.8% score | Published |
| psXDC V3 vault + V3 Migration Bridge (NM-0843) | Nethermind Security | 21 findings (1C / 2H / 1M / 6L / 9I / 2BP): 18 Fixed / 3 Acknowledged | Published May 8, 2026 |
Nethermind Security NM-0843, XDC Prime Stake (final report, May 08, 2026) covered PrimeStakedXDC_V3.sol and PrimeStakedXDC_V3MigrationBridge.sol (1,391 LoC). All Critical, High, and Medium findings are Fixed. The three Acknowledged findings are operationally mitigated (loss caps for risk-manager front-running, pre-deployment seed enforcement, and two-call workaround for partial-fill queue redemption). The live vault, PrimeStakedXDC_V3_2, is a redeployment of this audited codebase with a scoped delta (the permanent-ledger model). That delta has not yet been covered by a separately published external audit; any follow-up review will be published on the Audits page.
→ Read the full NM-0843 report (PDF)
All audit reports are published publicly. Target: >= 95% score on every audit, with findings of Medium severity or higher resolved within 72 hours.
Compliance Posture
Protocol Level
- Non-custodial - StakeXDC never takes custody of user funds
- Permissionless - no KYC/AML at the protocol level (open smart contracts)
- Transparent - all operations verifiable on-chain
- Jurisdiction-agnostic - smart contracts operate globally without geographic restriction
Partner Level
Partners integrating StakeXDC are responsible for:
- KYC/AML compliance in their jurisdiction
- Sanctions screening for their users
- Tax reporting and regulatory filings
- Data privacy (GDPR, CCPA, etc.) for their user base
StakeXDC provides the technical infrastructure; regulatory compliance is handled by the partner at the integration layer.
Incident Response
| SLA | Target |
|---|---|
| Critical vulnerability | Pause contracts within 1 hour; patch within 24 hours |
| Medium severity issue | Assess within 4 hours; resolve within 72 hours |
| Low severity issue | Assess within 24 hours; resolve in next scheduled update |
Liability Framework
In Case of a Bug or Exploit
- StakeXDC contracts are audited but not guaranteed to be vulnerability-free
- In the event of an exploit, the protocol will pause operations, assess damage, and work to recover funds
- Partners should carry their own insurance and implement user-facing risk disclosures
In Case of Delayed Withdrawals
- Withdrawals settle instantly while the vault has liquid XDC; otherwise they enter the on-chain FIFO queue and are paid by position as the ring-fenced queue budget is funded (masternode principal returning, routed by operations). New deposits refill the instant buffer, not the queue.
- For queued redemptions that depend on a masternode resignation, the network's
candidateWithdrawDelay(approximately 35 days under typical real-world block times, longer under network congestion) governs when that principal returns. - StakeXDC does not guarantee specific withdrawal timelines and shows no settlement date; the queue is FIFO, smaller requests may settle first, and the payout is recomputed at the share price when processed.
- Partners should communicate both paths (instant while liquid, otherwise queued by position and cancellable) to their users.
In Case of Reward Rate Changes
- APY is variable and depends on validator performance and network conditions
- StakeXDC communicates material changes to partners with reasonable notice
- Historical reward data is available on-chain for forecasting
Governance
What governance can and cannot do on the psXDC vault: role separation, schedule → wait → execute delayed governance, the non-upgradeable vault, pause controls and the decision-making framework.
SLA & Support
StakeXDC provides differentiated support and uptime commitments based on the partner's integration model.