Softstack Completes Smart Contract Audit of Syndicate’s Staking & Emissions

Smart Contract Audit

Client

Syndicate

Project

Staking & Emissions

Industry 

AppChain (L1/L2/L3)

Service

Smart Contract Audit

Syndicate is building the infrastructure layer for appchains – application-specific chains that give teams full control over performance, governance and token economics. At the heart of this stack is a gas-based staking and emissions system that rewards appchains based on real transaction activity across multiple networks.

Softstack recently completed a comprehensive smart contract audit of Syndicate’s Staking & Emissions contracts. This review focused on the security, correctness and robustness of the gas tracking, reward distribution and cross-chain proof systems that secure emissions across Base, Arbitrum-based sequencing chains and an L3 staking chain.

Scope of the audit

The audit covered the full gas-to-rewards pipeline and overall security, including:

  • Gas tracking and proof verification via GasAggregator, GasArchive and BlockHashRelayer, including Merkle Patricia proofs, storage verification and block-hash relay logic.

  • Epoch & reward accounting using EpochTracker and RewardPoolBase, with diminishing-returns math for fair distribution.

  • Appchain and performance pools (AppchainPool, PerformancePool, Splitter) for vested and instant rewards, including vesting schedules, claim logic and dust handling.

  • Access control & upgradeability for owner/admin roles, pause mechanisms, reentrancy protection and UUPS upgrade patterns.

In total, the review covered 8 logic contracts and 7 interfaces across ~1,800 SLOC, plus their dependencies on OpenZeppelin and PRB-Math libraries.

Methodology

Two independent Softstack experts performed an isolated audit, combining:

  • Line-by-line manual code review

  • Automated analysis, including symbolic execution and fuzzing

  • Test coverage review and behavior verification against the technical specification

  • Best-practice checks, upgradeable patterns and cross-chain design

The audit followed Softstack’s standard workflow: preparation, technical deep-dive, iterative findings review with the client, fix validation and final reporting.

Key Findings

During the initial assessment, the team identified 7 issues across the codebase:

  • 0 Critical

  • 0 High

  • 1 Medium – related to potential epoch advancement stalling in GasArchive

  • 3 Low – including a deterministic chain-ID allocation edge case, an event-emission mismatch and a reward-sharing nuance in the performance pool

  • 3 Informational – unused or duplicated imports and minor clean-ups

Each issue is documented in the final report with impact analysis, proof-of-concept tests and recommended remediations. The Syndicate team implemented the fixes and Softstack performed two follow-up re-checks to verify that all changes resolved the issues without regressions. All findings are now marked as fixed or acknowledged.

What this means for the ecosystem

Syndicate’s Staking & Emissions system underpins a gas-based rewards model for appchains, where higher real usage translates into a larger share of emissions. Ensuring that gas accounting, cross-chain proofs and reward distribution are correct and tamper-resistant is critical for protocol safety and long-term trust.

By hardening the epoch logic, chain-ID management and reward pools, this audit helps reduce the risk of stalled emissions, misallocated rewards or cross-chain inconsistencies. It also validates the underlying design choices around Merkle Patricia proofs, diminishing-returns functions and vesting mechanics.

About Softstack

Founded in 2017 (formerly Chainsulting), Softstack is a German Web3 security and software development company specialized in smart contract audits, protocol engineering and digital asset risk assessments across ecosystems like Ethereum, Solana, Tezos and TON.

If you’re building complex staking systems, L2/L3 infrastructure or appchain tooling and want to subject your contracts to the same level of scrutiny, reach out at hello@softstack.io or visit softstack.io.

Full Audit Report on our Github

Services we provide

Softstack Case Studies

Click through our success stories and see how we have helped other companies
achieve their Web3 goals.