Softstack Completes full smart contract audit of Syndicate’s
Staking & Emissions
system, the core infrastructure powering gas-based rewards and multi-chain staking for Syndicate appchains.
Client: Syndicate
Project: Staking & Emissions
Industry: AppChain (L1/L2/L3)
Service: Smart Contract Audit
Syndicate is building the infrastructure layer for appchains – application-specific chains that give teams full control over performance, governance and token economics. At the heart of this stack is a gas-based staking and emissions system that rewards appchains based on real transaction activity across multiple networks.
Softstack recently completed a comprehensive smart contract audit of Syndicate’s Staking & Emissions contracts. This review focused on the security, correctness and robustness of the gas tracking, reward distribution and cross-chain proof systems that secure emissions across Base, Arbitrum-based sequencing chains and an L3 staking chain.
Scope of the audit
The audit covered the full gas-to-rewards pipeline and overall security, including:
- Gas tracking and proof verification via
GasAggregator
,
GasArchive
and
BlockHashRelayer
, including Merkle Patricia proofs, storage verification and block-hash relay logic.
- Epoch & reward accounting using
EpochTracker
and
RewardPoolBase
, with diminishing-returns math for fair distribution.
- Appchain and performance pools (
AppchainPool
,
PerformancePool
,
Splitter
) for vested and instant rewards, including vesting schedules, claim logic and dust handling.
- Access control & upgradeability for owner/admin roles, pause mechanisms, reentrancy protection and UUPS upgrade patterns.
In total, the review covered 8 logic contracts and 7 interfaces across ~1,800 SLOC, plus their dependencies on OpenZeppelin and PRB-Math libraries.
Methodology
Two independent Softstack experts performed an isolated audit, combining:
- Line-by-line manual code review
- Automated analysis, including symbolic execution and fuzzing
- Test coverage review and behavior verification against the technical specification
- Best-practice checks, upgradeable patterns and cross-chain design
The audit followed Softstack’s standard workflow: preparation, technical deep-dive, iterative findings review with the client, fix validation and final reporting.
Key Findings
During the initial assessment, the team identified 7 issues across the codebase:
- 0 Critical
- 0 High
- 1 Medium – related to potential epoch advancement stalling in
GasArchive
- 3 Low – including a deterministic chain-ID allocation edge case, an event-emission mismatch and a reward-sharing nuance in the performance pool
- 3 Informational – unused or duplicated imports and minor clean-ups
Each issue is documented in the final report with impact analysis, proof-of-concept tests and recommended remediations. The Syndicate team implemented the fixes and Softstack performed two follow-up re-checks to verify that all changes resolved the issues without regressions. All findings are now marked as fixed or acknowledged.
What this means for the ecosystem
Syndicate’s Staking & Emissions system underpins a gas-based rewards model for appchains, where higher real usage translates into a larger share of emissions. Ensuring that gas accounting, cross-chain proofs and reward distribution are correct and tamper-resistant is critical for protocol safety and long-term trust.
By hardening the epoch logic, chain-ID management and reward pools, this audit helps reduce the risk of stalled emissions, misallocated rewards or cross-chain inconsistencies. It also validates the underlying design choices around Merkle Patricia proofs, diminishing-returns functions and vesting mechanics.
About Softstack
Founded in 2017 (formerly Chainsulting), Softstack is a German Web3 security and software development company specialized in smart contract audits, protocol engineering and digital asset risk assessments across ecosystems like Ethereum, Solana, Tezos and TON.
If you’re building complex staking systems, L2/L3 infrastructure or appchain tooling and want to subject your contracts to the same level of scrutiny, reach out at hello@softstack.io or visit softstack.io .
Full Audit Report on our Github
