Audits
All StakeXDC smart contracts undergo independent external audits before deployment and whenever significant updates are introduced.
Security Audits
All StakeXDC smart contracts undergo independent external audits before deployment and whenever significant updates are introduced.
Methodology
- Reputable external auditor - We partner with leading firms (e.g., QuillAudits) that review every line of code and validate the economic logic of the contracts.
- Two-phase process
- Preliminary report: Identification of findings.
- Fix & Verify: The engineering team resolves issues and the auditor performs final verification.
- Transparent disclosure - Full reports are published so the community can verify the scope and applied fixes.
Published Reports
| Module | Auditor | Findings | Link |
|---|---|---|---|
| XDC Staking Contract (V1 / liquid staking) | QuillAudits | 98.8% score | Report |
| psXDC V3 vault + V3 Migration Bridge (NM-0843) | Nethermind Security | 1 Critical · 2 High · 1 Medium · 6 Low · 9 Info · 2 Best Practices (18 Fixed / 3 Acknowledged) | Report (PDF) |
https://www.quillaudits.com/leaderboard/prime-numbers/prime-numbers-staking-contract
Our target is to keep every audit score >= 95% and close findings of Medium severity or higher within 72 hours.
Nethermind Security: NM-0843, XDC Prime Stake (May 08, 2026)
Scope (1,391 LoC):
PrimeStakedXDC_V3.sol: ERC-4626 native-XDC vault, non-upgradeable, with the buffer / FIFO queue /claimQueuedAssetsflow, masternode round-robin auto-propose, delayed governance, role split, and per-report / per-day loss caps.PrimeStakedXDC_V3MigrationBridge.sol: V2 psXDC → V3 share migration withminSharesOutslippage protection, time-locked excess withdrawals, daily withdrawal cap, and delayed owner transfer.
Process: initial review (commit f92b803, March 26, 2026) → fix verification → final commit 2d97d9b (May 08, 2026). Documentation Assessment: Medium. Test Suite Assessment: Medium.
Findings, by severity and status:
| Severity | Count | Fixed | Acknowledged |
|---|---|---|---|
| Critical | 1 | 1 | 0 |
| High | 2 | 2 | 0 |
| Medium | 1 | 1 | 0 |
| Low | 6 | 5 | 1 |
| Informational | 9 | 8 | 1 |
| Best Practices | 2 | 2 | 0 |
| Total | 21 | 18 | 3 |
Acknowledged findings (no functional fix shipped):
| Finding | Severity | Why acknowledged |
|---|---|---|
Users can frontrun reportValidatorLoss(...) to evade slashing penalties | Info | Mitigated operationally via the per-report and per-day loss caps; routing all exits through the queue would degrade UX. |
| Constructor does not enforce a non-zero seed at deployment | Low | Operational pre-deployment requirement; the deployment script seeds the vault. |
redeemWithQueue / withdrawWithQueue use all-or-nothing logic (no partial fill) | Info | Two-call pattern (redeem(maxRedeem) + redeemWithQueue(rest)) gives the same outcome; partial fill considered for a future revision. |
All Critical, High, and Medium findings are Fixed. Highlights:
- Critical: returned masternode stakes were double-counted in
trackedTotalAssets; resolved by routing principal returns throughresignMasternode(...)instead of the unprivilegedreceive()path. - High: receivers could trigger a gas-bomb in
_processWithdrawalQueueInternal(...)to brick the queue; resolved by enforcing a strict gas limit on the external call. - High: permissionless
syncTrackedAssets()during migration could let early migrators steal funded liquidity; resolved by gatingsyncTrackedAssetswithwhenMigrationFinished. - Medium: deferred queued payouts were not ring-fenced from the protocol's accounting; resolved by introducing a
totalDeferredPayoutsaccumulator and excluding it from_availableForImmediateWithdrawal,_availableForQueuePayout, and_syncTrackedAssetsExcludingInflow.
The full per-finding write-up, recommendations, and per-fix verification is in the PDF report.
V3.1 redeployment (July 2026)
The live vault, PrimeStakedXDC_V3_2, is a redeployment of the NM-0843-audited V3 codebase with a scoped set of changes to support the staged masternode-collateral transition: an under-backed launch mode with NAV write-down protection, ring-fenced funding lanes for the withdrawal queue, and the one-time V31AirdropDistributor mint path used to mirror V3 balances. The V3 architecture, roles, time-locks, and withdrawal design are otherwise unchanged. A follow-up external audit of the V3.1 delta is in progress and will be published on this page.
Other V3 stack components
Deployed contracts and addresses
Canonical address book for StakeXDC V3.2, covering the psXDC vault, airdrop distributor, referral program, XDC spot venue, and legacy contracts.
Custody and key management
StakeXDC uses a permissionless, smart contract-based validator custody model - eliminating human interaction from custody flows entirely.