Risk & Compliance
StakeXDC maintains a comprehensive risk framework and compliance posture designed for institutional partners and regulated environments.
StakeXDC maintains a comprehensive risk framework and compliance posture designed for institutional partners and regulated environments.
Risk Framework
Smart Contract Risk
| Risk | Severity | Mitigation |
|---|---|---|
| Contract vulnerability | High | Independent external audits (QuillAudits - 98.8% score on V1 liquid staking; Nethermind Security NM-0843 on V3 vault + V3 Migration Bridge, all Critical/High/Medium findings Fixed), reentrancy guards, emergency pause on the V3 vault |
| Dependency failure | Medium | Minimal external dependencies; core logic is self-contained |
| Economic attack | Medium | Buffer + FIFO queue design, bounded scans, per-report and per-day loss caps |
| Migration risk | Low | One-shot atomic migration with minSharesOut slippage protection; migration window is gated; failure modes always revert |
Validator Risk
| Risk | Severity | Mitigation |
|---|---|---|
| Validator downtime | Medium | Multi-validator delegation, automated failover monitoring |
| Slashing (principal-stake) | None | XDC's slashing mechanism penalizes downtime via temporary exclusion from block production (~2h, 4 epochs) and missed rewards, but never burns principal. This is structurally different from ETH-based liquid staking, where slashing can permanently destroy a portion of staked ETH |
| Reward rate change | Low | Dynamic APY calculation; transparent communication to partners |
Network Risk
| Risk | Severity | Mitigation |
|---|---|---|
| XDC Network halt | Low | Protocol pauses automatically; no loss of funds |
| Fork / chain split | Low | Protocol follows canonical chain; manual intervention if needed |
| Congestion | Low | Transaction prioritization; gas optimization in contracts |
Operational Risk
| Risk | Severity | Mitigation |
|---|---|---|
| Key compromise | High | On-chain smart contract custody - no human key access |
| Unauthorized upgrade | High | Multisig + timelock governance |
| Team dependency | Medium | Open-source contracts; protocol operates autonomously on-chain |
Audit History
| Module | Auditor | Findings / Score | Status |
|---|---|---|---|
| XDC Staking Contract (V1 liquid) | QuillAudits | 98.8% score | Published |
| psXDC V3 vault + V3 Migration Bridge (NM-0843) | Nethermind Security | 21 findings (1C / 2H / 1M / 6L / 9I / 2BP): 18 Fixed / 3 Acknowledged | Published May 8, 2026 |
Nethermind Security NM-0843, XDC Prime Stake (final report, May 08, 2026) covered PrimeStakedXDC_V3.sol and PrimeStakedXDC_V3MigrationBridge.sol (1,391 LoC). All Critical, High, and Medium findings are Fixed. The three Acknowledged findings are operationally mitigated (loss caps for risk-manager front-running, pre-deployment seed enforcement, and two-call workaround for partial-fill queue redemption). The live vault, PrimeStakedXDC_V3_2, is a redeployment of this audited codebase with a scoped delta for the staged collateral transition; a follow-up external audit of the delta is in progress; see Audits.
→ Read the full NM-0843 report (PDF)
All audit reports are published publicly. Target: >= 95% score on every audit, with findings of Medium severity or higher resolved within 72 hours.
Compliance Posture
Protocol Level
- Non-custodial - StakeXDC never takes custody of user funds
- Permissionless - no KYC/AML at the protocol level (open smart contracts)
- Transparent - all operations verifiable on-chain
- Jurisdiction-agnostic - smart contracts operate globally without geographic restriction
Partner Level
Partners integrating StakeXDC are responsible for:
- KYC/AML compliance in their jurisdiction
- Sanctions screening for their users
- Tax reporting and regulatory filings
- Data privacy (GDPR, CCPA, etc.) for their user base
StakeXDC provides the technical infrastructure; regulatory compliance is handled by the partner at the integration layer.
Incident Response
| SLA | Target |
|---|---|
| Critical vulnerability | Pause contracts within 1 hour; patch within 24 hours |
| Medium severity issue | Assess within 4 hours; resolve within 72 hours |
| Low severity issue | Assess within 24 hours; resolve in next scheduled update |
Liability Framework
In Case of a Bug or Exploit
- StakeXDC contracts are audited but not guaranteed to be vulnerability-free
- In the event of an exploit, the protocol will pause operations, assess damage, and work to recover funds
- Partners should carry their own insurance and implement user-facing risk disclosures
In Case of Delayed Withdrawals
- In V3, withdrawals settle instantly when the vault buffer covers them; otherwise they enter the on-chain FIFO queue and settle as new deposits, reward inflows, or masternode resignations replenish liquidity.
- For redemptions that depend on a masternode resignation, the upper bound is the XDC Network's
candidateWithdrawDelay, approximately 35 days under typical real-world block times (longer under network congestion). - StakeXDC does not guarantee specific withdrawal timelines; the queue is FIFO and depends on network conditions and protocol-level cash flow.
- Partners should communicate both paths (instant-when-possible and queued-with-self-claim) to their users.
In Case of Reward Rate Changes
- APY is variable and depends on validator performance and network conditions
- StakeXDC communicates material changes to partners with reasonable notice
- Historical reward data is available on-chain for forecasting