> For the complete documentation index, see [llms.txt](https://docs.stackingdao.com/stackingdao/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stackingdao.com/stackingdao/audits-and-security.md).

# Audits and Security

Stacking DAO is a liquid-staking protocol on Stacks. Every on-chain contract is deployed on mainnet from the deployer `SP4SZE494VC2YC5JYG7AYFQ44F5Q4PYV7DVMDPBG`. The exact deployed sources, together with a runnable simnet and tests, are published for anyone to review at [StackingDAO/stackingdao-smart-contracts](https://github.com/StackingDAO/stackingdao-smart-contracts).

## Language-level assurance

The contracts are written in **Clarity:** a decidable, non-Turing-complete language that is interpreted (not compiled) and published on-chain as source. There is no reentrancy through unknown code paths, no unbounded loops, and every state transition is explicit. Deployed sources are comment-free and pure ASCII by convention, so what is on chain is exactly what is reviewed.

## Governance controls

Every state-changing protocol action is gated by the DAO:

* **dao:** the protocol registry and access gate. A contract must be `set-contract-active` before it can call protocol-gated functions (`check-is-protocol`); admins are checked via `check-is-admin`.
* **dao-executor:** the sole admin. It only acts by executing an approved **proposal-script**: a purpose-built contract that performs one specific, reviewable change.
* **dao-multisig:** manages the proposal lifecycle: propose, approve to threshold, execute, with a timelock on non-urgent proposals.

## Audits

Stacking DAO's PoX-5 contracts were independently audited by **Clarity Alliance**:

* [Clarity Alliance - Stacking DAO PoX 5](https://clarity-alliance.github.io/audits/Clarity%20Alliance%20-%20Stacking%20DAO%20PoX-5.pdf)

Previous audits of Stacking DAO contracts can be found below:

* [Clarity Alliance - Stacking DAO Security Review](https://clarity-alliance.github.io/audits/Clarity%20Alliance%20-%20Stacking%20DAO.pdf)
* [Clarity Alliance - Stacking DAO BTC Yielding STX LST Security Review](https://clarity-alliance.github.io/audits/Clarity%20Alliance%20-%20Stacking%20DAO%20BTC%20Yielding%20STX%20LST.pdf)
* [Clarity Alliance - Stacking DAO Upgrade Security Review](https://clarity-alliance.github.io/audits/Clarity%20Alliance%20-%20Stacking%20DAO%20\(Upgrade\).pdf)

## Continuous adversarial testing

In addition to point-in-time audits, the deployed contracts are tested continuously by an automated harness that uses the latest frontier AI models as adversaries. Each newly released model is run against the full contract set shortly after release, searching for logic errors, edge cases, and any path that could affect user deposits or protocol state. Candidate findings are reproduced against the deployed sources before being classified as valid.

Since start of 2026, no valid vulnerability has been reported through this process.

## Bug bounty

A bug bounty program in collaboration with **Immunefi** is live, offering rewards of up to **$100,000** for identifying bugs and vulnerabilities.

* [Stacking DAO bug bounty on Immunefi](https://immunefi.com/bounty/stackingdao/)

## Responsible disclosure

If you discover a vulnerability, please disclose it privately and give the team a reasonable window to respond before any public disclosure.

The bug bounty program above is the preferred disclosure channel. You can also reach the team via [@StackingDAO](https://x.com/StackingDAO) on X.

## External dependencies

The protocol integrates the canonical **sBTC** token (`SM3VDXK3WZZSA84XXFKAFAF15NNZX32CTSG82JFQ4.sbtc-token`), which is outside Stacking DAO's control and has its own security model.