Security
What can and cannot happen to your funds.
The useful version of a security page is a list of powers, not a list of adjectives. Here is what the contract allows, what the operator can change, and what neither of them can do.
Demo mode. No staking contract is configured, so nothing on this page is deployed anywhere yet. It describes the contract shipped in contracts/BastionStaking.sol, which is what these screens are built against.
Your principal is only ever moved by you
There is no function on the staking contract that transfers a staker’s principal to anyone but that staker. The operator cannot move a position, cannot reassign it, and cannot withdraw on someone’s behalf. Penalties are the single exception, they are capped in the contract, and they only apply to an exit the staker initiated before their own chosen term was up.
Signing in is not an approval
The connect flow asks for a signed message, never a transaction. It grants no allowance and moves nothing. The message names this site, the chain and a single-use nonce, and it says so in words — a wallet prompt full of opaque hex is how people get drained, and this product will not be teaching that habit.
What an operator can change
Launch a pool, pause deposits into one, adjust an advertised rate, and change the protocol fee within the bound set at deploy time. That is the whole list. Changing a pool’s rate never touches a position that already exists: the rate is copied onto the position when it opens. And deposits are the only thing that can be paused — claims and withdrawals stay open unconditionally.
The numbers are checkable
Accrual is principal × rate × seconds ÷ year, with daily compounding on the vault. It is one file — lib/rewards.ts — with no dependencies and no database access, and the calculator on the pool page runs that same function rather than an approximation of it. The protocol fee is 2% of rewards claimed, taken at claim time and shown on the receipt.
Audits
Two independent reviews before launch, published in full including the findings that were accepted rather than fixed. An audit is a snapshot of one commit — check that the address you are interacting with is the one that was reviewed.
Risks that remain
- Smart contract risk. Audited is not the same as safe. A bug in the staking contract could cost you everything in it.
- Price risk. Rewards are paid in the same token you staked. A 15% yield on an asset that halves is a loss.
- Rate risk. Advertised rates apply to new positions and can be lowered at any time. Your existing positions keep their rate; your next one may not get it.
- Liquidity risk. A locked term is locked. If you may need the funds, the flexible pool exists for exactly that reason.
Found something? Report it to security@example.com. Reports are acknowledged within one working day, and anything exploitable is eligible for a bounty. Please do not open a public issue first. See the FAQ for everything else.