Audits

All StakeXDC smart contracts undergo independent external audits before deployment and whenever significant updates are introduced.

---

Methodology

1. Reputable external auditors - We partner with leading firms (Nethermind Security, QuillAudits) that review every line of code and validate the economic logic of the contracts.
2. Two-phase process
   • Preliminary report: Identification of findings.
   • Fix & Verify: The engineering team resolves issues and the auditor performs final verification.
3. Transparent disclosure - Full reports are published so the community can verify the scope and applied fixes.

---

Published Reports

Our target is to keep every audit score >= 95% and close findings of Medium severity or higher within 72 hours.

---

Nethermind Security: NM-0843, XDC Prime Stake (May 08, 2026)

Scope (1,391 LoC):

• PrimeStakedXDC_V3.sol: ERC-4626 native-XDC vault, non-upgradeable, with the buffer / FIFO queue / claimQueuedAssets flow, masternode round-robin auto-propose, delayed governance, role split, and per-report / per-day loss caps.
• PrimeStakedXDC_V3MigrationBridge.sol: V2 psXDC → V3 share migration with minSharesOut slippage protection, time-locked excess withdrawals, daily withdrawal cap, and delayed owner transfer.

Process: initial review (commit f92b803, March 26, 2026) → fix verification → final commit 2d97d9b (May 08, 2026). Documentation Assessment: Medium. Test Suite Assessment: Medium.

Findings, by severity and status:

Acknowledged findings (no functional fix shipped):

All Critical, High, and Medium findings are Fixed. Highlights:

• Critical: returned masternode stakes were double-counted in trackedTotalAssets; resolved by routing principal returns through resignMasternode(...) instead of the unprivileged receive() path.
• High: receivers could trigger a gas-bomb in _processWithdrawalQueueInternal(...) to brick the queue; resolved by enforcing a strict gas limit on the external call.
• High: permissionless syncTrackedAssets() during migration could let early migrators steal funded liquidity; resolved by gating syncTrackedAssets with whenMigrationFinished.
• Medium: deferred queued payouts were not ring-fenced from the protocol's accounting; resolved by introducing a totalDeferredPayouts accumulator and excluding it from _availableForImmediateWithdrawal, _availableForQueuePayout, and _syncTrackedAssetsExcludingInflow.

The full per-finding write-up, recommendations, and per-fix verification is in the PDF report.

---

V3.2 redeployment (July 2026)

The live vault, PrimeStakedXDC_V3_2, is a redeployment of the NM-0843-audited V3 codebase. Two scoped revisions sit between the audited commit and the live contract:

• V3.1 added an under-backed launch mode with NAV write-down protection, ring-fenced funding lanes for the withdrawal queue, and the one-time V31AirdropDistributor mint path used to mirror V3 balances.
• V3.2 (the live vault) makes the partially-backed state the permanent operating model: it removes the underBackedMode flag, the percentage buffer (bufferBps) and fundMigrationLiquidity; adds the manager-only reward lane (distributeRewards, with an optional hard-capped rewardFeeBps) and the fundBacking backing lane; settles the FIFO queue exclusively from queueBackingBudget; and used the one-time V32AirdropDistributor (now permanently finalized) to mirror every V3.1 balance 1:1. See the Smart contract reference for the accounting details.

The V3 architecture, roles, time-locks, and withdrawal design are otherwise unchanged. The V3.1/V3.2 delta has not yet been covered by a separately published external audit; any follow-up review will be published on this page.