Audits and Security
Stacking DAO is a liquid-staking protocol on Stacks. Every on-chain contract is deployed on mainnet from the deployer SP4SZE494VC2YC5JYG7AYFQ44F5Q4PYV7DVMDPBG. The exact deployed sources, together with a runnable simnet and tests, are published for anyone to review at StackingDAO/stackingdao-smart-contracts.
Language-level assurance
The contracts are written in Clarity: a decidable, non-Turing-complete language that is interpreted (not compiled) and published on-chain as source. There is no reentrancy through unknown code paths, no unbounded loops, and every state transition is explicit. Deployed sources are comment-free and pure ASCII by convention, so what is on chain is exactly what is reviewed.
Governance controls
Every state-changing protocol action is gated by the DAO:
dao: the protocol registry and access gate. A contract must be
set-contract-activebefore it can call protocol-gated functions (check-is-protocol); admins are checked viacheck-is-admin.dao-executor: the sole admin. It only acts by executing an approved proposal-script: a purpose-built contract that performs one specific, reviewable change.
dao-multisig: manages the proposal lifecycle: propose, approve to threshold, execute, with a timelock on non-urgent proposals.
Audits
Stacking DAO's PoX-5 contracts were independently audited by Clarity Alliance:
Previous audits of Stacking DAO contracts can be found below:
Continuous adversarial testing
In addition to point-in-time audits, the deployed contracts are tested continuously by an automated harness that uses the latest frontier AI models as adversaries. Each newly released model is run against the full contract set shortly after release, searching for logic errors, edge cases, and any path that could affect user deposits or protocol state. Candidate findings are reproduced against the deployed sources before being classified as valid.
Since start of 2026, no valid vulnerability has been reported through this process.
Bug bounty
A bug bounty program in collaboration with Immunefi is live, offering rewards of up to $100,000 for identifying bugs and vulnerabilities.
Responsible disclosure
If you discover a vulnerability, please disclose it privately and give the team a reasonable window to respond before any public disclosure.
The bug bounty program above is the preferred disclosure channel. You can also reach the team via @StackingDAO on X.
External dependencies
The protocol integrates the canonical sBTC token (SM3VDXK3WZZSA84XXFKAFAF15NNZX32CTSG82JFQ4.sbtc-token), which is outside Stacking DAO's control and has its own security model.
Last updated