Add TransparentStaking: audited-pattern rewrite of the reviewed staking contract - #2
Draft
Rezamoradifar wants to merge 2 commits into
Draft
Add TransparentStaking: audited-pattern rewrite of the reviewed staking contract#2Rezamoradifar wants to merge 2 commits into
Rezamoradifar wants to merge 2 commits into
Conversation
Replaces the Ponzi-style economics and hidden owner-withdrawal path from the reviewed ArbiSmart contract with a fully collateralized model: - Every stake's promised reward must be backed by a pre-funded rewardReserve before the stake is accepted (pendingRewardObligation invariant), so rewards can never be paid from new depositors' funds. - Removed the fake "polymarketArbitrageTrade" owner withdrawal path, the partner-only emergency fund sweep, the blacklist, the tx.origin EOA gate, and the multi-level MLM referral structure. - Owner powers are now bounded on-chain: pause() only blocks new stakes (never claims/withdrawals), and reserve withdrawals are capped to the mathematically unencumbered excess. - Plan terms are immutable once created; fees are immutable and hard-capped at deploy time. - Uses OpenZeppelin SafeERC20/ReentrancyGuard/Pausable/Ownable2Step.
Owner
Author
❌ Deploy Preview for playful-starship-836a94 failed.
|
✅ Deploy Preview for euphonious-biscotti-e90450 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Adds a disaster-recovery mechanism that mirrors the original contract's partner-vote idea but removes its fatal flaw: the emergency destination is a single address fixed at deploy time (emergencyRecipient), never the council members themselves, so a colluding majority cannot vote the funds to themselves. The 10 council seats are set once in the constructor with no add/remove function, so membership can never be repacked later either. Flow: 6-of-10 council votes -> contract pauses new stakes (claim/withdraw stay open) -> 72h timelock -> anyone can execute the sweep to emergencyRecipient. Cancelling a pending vote also requires 6-of-10, so neither the owner nor a single member can unilaterally start or stop it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
contracts/TransparentStaking.sol, a from-scratch rewrite of the previously reviewed "ArbiSmart" staking contract, designed to be transparent, auditable, and free of the issues found in the original:polymarketArbitrageTradelet the owner pull 20% of the contract's balance directly, disguised with "arbitrage" event names but with no actual trading logic. Removed entirely.rewardReserveat stake time (pendingRewardObligationinvariant:rewardReserve >= pendingRewardObligation). If the reserve can't cover the promise, the stake reverts. Rewards can never be paid out of new depositors' principal.emergencyMode/executeEmergencysplit all remaining funds among 4 "partner" addresses, leaving depositors with nothing. Removed; replaced with apause()that only blocks new stakes and never blocksclaim()/withdraw().tx.originEOA gate. Both were centralization/compatibility footguns; removed.referralReserve.withdrawExcessRewardReserve/withdrawExcessReferralReservecan only move funds not currently backing a live promise — the ceiling is computed on-chain (rewardReserve - pendingRewardObligation), so the owner cannot touch principal or promised rewards.claimFeeBps,maxEarlyExitFeeBps,referralBps) are immutable and hard-capped in the constructor (10% / 15% / 5% respectively), so they can never be raised post-launch.SafeERC20,ReentrancyGuard,Pausable, andOwnable2Stepinstead of hand-rolled equivalents.This file is a reference implementation for compilation/audit with a standard toolchain (Hardhat/Foundry) and the
@openzeppelin/contractspackage — this repo currently has no Solidity build pipeline (the existingcontracts/directory only holds ABI TypeScript files consumed by the frontend), so no build config was added.Test plan
@openzeppelin/contractsv5.x under Hardhat or FoundrywithdrawExcessRewardReserveceiling enforcement, pause blocking only new stakesGenerated by Claude Code