Skip to content

Staking System — Open Questions for Client

Source doc: QuantaTrade_Staking_System FINAL.docx (reviewed 2026-04-19) Audience: QT Labs (client), smart contract auditors, legal Purpose: Resolve before Milestone 5 (Token Utility & Monetization) contract freeze. Each unresolved item is a scope risk or an audit blocker.

1. Oracle dependencies (blocker)

The spec defines circuit breakers that react to token price and revenue. Neither signal is natively on-chain.

1.1 Price oracle

  • §5 trigger: "Token price drops >50% in 7 days → L1 buyback doubles from 10% to 20%".
  • Question: Which oracle? Chainlink feed (requires $QTRA to be listed), DEX TWAP (manipulable with thin liquidity), or custom aggregated feed?
  • Question: 7-day window — rolling or fixed-epoch? Measured from which reference price?
  • Risk: Manipulation of a thin TWAP can force the buyback doubling maliciously.

1.2 Revenue oracle

  • §5 trigger: "Zero revenue for 90 consecutive days → $1.5M stablecoin reserve activates".
  • §1 revenue router splits 50/20/20 — revenue sources are off-chain (subscriptions, exchange fees, trading profit).
  • Question: Who attests revenue on-chain? A single admin wallet? Multisig? Threshold oracle from multiple backend signers?
  • Tension: The attester role contradicts the spec's "no admin can change" language. Either acknowledge the trusted role explicitly or move attestation to a decentralised/verifiable mechanism.

2. Revenue on-ramp flow (partially resolved — 2026-04-19)

Revenue is earned in fiat / USDT, but the reward pool is denominated in $QTRA (per §4.3 "rewards paid in $QTRA").

Resolved by system spec PDF (2026-04-19): - ✓ Subscription revenue (Automated Trading + Intelligence Marketplace) is collected in USDT/USDC, not fiat — no fiat on-ramp in the router path. - ✓ Revenue router is confirmed immutable and separate from the staking contract. Client has flagged it as the highest-risk contract and requires a dedicated audit.

Still open: - Question: Does the router receive USDT/USDC and swap to $QTRA on-chain, or does off-chain treasury buy $QTRA on-market and deposit? (Reward is paid in $QTRA, so a USDT→$QTRA conversion happens somewhere.) - Question: If on-chain swap — slippage/MEV protection? Large pool deposits will move price on low-liquidity pairs. - Question: Alignment with "L1 buyback" — the spec implies a "two-layer buyback engine" but the buyback mechanics section is missing from the PDF. Is staker-fund conversion part of the L1 buyback, or a separate path? - Question: Exchange fees collected in multiple quote currencies (BTC, ETH, USDT etc.) — how does the router aggregate into one reward currency?

Action: Request full system spec (buyback section). Then produce end-to-end flow diagram.

3. State machine ambiguities

Several user flows have undefined transitions.

3.1 Warmup and cooldown

  • §7 lists "staking warmup: 7 days" and "unstaking cooldown: 3 days" — neither is explained anywhere else.
  • Question: Does warmup delay reward accrual (stake counted but no yield for 7 days) or delay counted-stake (stake not eligible until day 7)?
  • Question: Does cooldown lock tokens post-unstake (tokens unavailable for 3 days after unstake request)?
  • UX implication: A 7-day-tier user may actually experience 7 (warmup) + 7 (lock) + 3 (cooldown) + 7 (claim stream) = up to 24 days before tokens are fully liquid. Confirm, then make it explicit in UI copy.

3.2 Early unlock penalty

  • §7: "Early unlock penalty: revert to 7-day base rate".
  • Question: Retroactive (recompute all past rewards at 1.00x weight) or forward-only (forfeit future weight bonus)?
  • Retroactive cost: contract must track per-user reward history — high gas, complex audit surface.
  • Forward-only cost: users with long lock tiers get nearly a full bonus and exit, undermining the lock incentive.

3.3 Tier expiry

  • Question: When a 90-day lock period ends, does the position auto-roll at 1.20x, drop to 1.00x, or require user action to restake?
  • Default matters: If auto-roll, user is implicitly re-committed; if drop to 1.00x, silent APY cliff.

3.4 Claim stream + unstake interaction

  • §4.1: breaking a 7-day reward stream early forfeits the unvested portion to the pool.
  • Question: Does "breaking" include unstaking the underlying principal, or only transferring the stream position?
  • Edge case: User with multiple overlapping claim streams — do they all break together, or per-stream?

4. Immutability posture (partially resolved — 2026-04-19)

The spec repeatedly says "cannot change", "immutable", "no admin". This is a design choice with major consequences.

Resolved by system spec PDF (2026-04-19): - ✓ Token contract is hard-immutable: "no admin key, no upgrade proxy for the token contract", mint permanently disabled. Posture #1 confirmed for the ERC-20.

Still open: - Question: Same posture for the revenue router? Flagged as highest-risk — a bug is catastrophic but also unfixable under strict immutability. Strong recommendation: parameter immutability + timelock-gated pause (posture #2). - Question: Same posture for the staking contract? Economic parameters immutable is aligned with the spec, but a pause capability protects against exploits.

Postures: - Strict immutability: no setters, no pause, no upgrade. A critical bug becomes permanent. Demands formal verification. - Parameter immutability + emergency pause: no economic parameter can change, but a multisig + timelock can pause if a critical exploit is detected. Industry standard. - Full upgradeability: proxy pattern, admin can upgrade. Conflicts with spec tone.

Action: Get written sign-off per contract (token / router / staking). Budget for formal verification only on contracts where posture #1 is confirmed. Note: client has budgeted for two separate audits (router + staking) — formal verification would be additional.

5. Economic scenarios to add

Current stress tests assume constant $0.10 token price. Real equilibrium depends on price.

  • Question: What happens at $0.30? APY = $22.1M / ($0.30 × 599M) = 12.3%. Still competitive but lower — does the 1.60x tier still attract lockers?
  • Question: At $1.00? APY = 3.7%. Below typical DeFi benchmarks — risk of unstaking cascade and safeguard trip (drops below 10M stake threshold).
  • Question: Treasury floor $5M runway — where are those reserves held? Is $5M pre-funded at launch, or accrued over time from excess revenue periods?

Action: Extend stress table to include $0.30 and $1.00 token price rows. Document treasury reserve funding plan.

  • Question: In which jurisdictions will staking be offered? US, EU, UK, Singapore, others?
  • Question: Will staking require KYC? If yes, at what tier? (e.g., Sumsub Tier 1 for retail, Tier 2 for institutional stakers.)
  • Question: Has external securities counsel reviewed the yield structure? Revenue-share yield may be treated as an investment contract (Howey) in the US.
  • Action: Legal memo required before M5 contract freeze. If KYC gating is required, affects contract design (whitelist mapping or ERC-1404-style transfer restrictions).

7. Indexer and UI cadence

  • Question: How often does the live APY display update? Every block (gas-expensive), every minute (indexer cache), every 5 minutes?
  • Question: Where does the UI read APY from — direct contract view call, or indexed backend?
  • Action: Define in §8 UI requirements. Affects indexer scope in M1/M5.

8. Minor corrections

  • §6 stress table: header row labels the staked-value columns as "Revenue achievement ($59M)". $59M is the staked value, not revenue. Relabel to avoid confusion.
  • §1 Y5 total: subscriptions + exchange + trading = $18.33M + $2.32M + $1.50M = $22.15M ✓
  • §7 "Early unlock penalty" needs clearer definition (see §3.2).

Sign-off required before M5 kickoff

# Item Owner Status
1.1 Price oracle choice Client + protocol team Open
1.2 Revenue attester design Client + protocol team Open
2 Revenue on-ramp flow Client treasury team Open
3.1–3.4 State machine clarifications Spec author Open
4 Immutability posture Client (written) Open
5 Extended stress tests Spec author Open
6 Legal review External counsel Open
7 UI refresh cadence Product + UI team Open