Staking Contract Development: Security, Audit, and Gas Optimization
One of our clients lost 5% of rewards due to rounding in Solidity. We rewrote the logic with a scaling factor of 1e27 — the problem disappeared. Such details can make or break a project. Implementing a staking contract seems straightforward: deposit, reward accrual, withdrawal. But every detail can cost millions. An error in reward calculation — and users lose rewards, the contract becomes unprofitable. We solved this problem for 10+ projects on Ethereum, Polygon, and Arbitrum, with a combined TVL exceeding $50M. The development includes audit and gas optimization, saving up to $100,000 on gas for a pool of 1000 stakers per year. Our turnkey packages start at $5,000, with typical gas savings above $50,000 annually. To achieve the same reliability, get a consultation.
Problems We Solve
Gas cost. A naive implementation iterates over all stakers on each change — O(n) and kills the contract with hundreds of users. We use the accumulated reward per token algorithm, which works in O(1). The optimized contract consumes 20 times less gas than the naive one with 1000 stakers.
Reentrancy. When paying reward via transfer, an external call can re-enter the contract. We apply the Checks-Effects-Interactions (CEI) pattern: update state first, then make the transfer.
Precision loss. Solidity rounds division down. With small amounts, errors accumulate. We use scaling factor 1e18 and, when needed, 1e27 for extra precision.
Admin keys. A single EOA is a single point of failure. We set Timelock + multisig for managing rewardRate and other critical parameters.
Why Accumulated Reward Per Token Is the DeFi Standard
This algorithm, first introduced by Synthetix StakingRewards, allows computing each user's reward in constant time, regardless of pool size. The global variable rewardPerTokenStored updates on each deposit or withdrawal, and the individual reward is computed as (rewardPerToken - userCheckpoint) × userBalance.
Our algorithm is 20 times better in gas consumption than the naive one: the naive approach with a loop requires 20000+ gas for 100 users, ours only 5000 gas. Gas savings reach 80% and grow with pool size. This is critical for networks with high fees, such as Ethereum mainnet.
Example Solidity Implementation
uint256 public rewardPerTokenStored; uint256 public lastUpdateTime; mapping(address => uint256) public userRewardPerTokenPaid; mapping(address => uint256) public rewards; function rewardPerToken() public view returns (uint256) { if (totalSupply == 0) return rewardPerTokenStored; return rewardPerTokenStored + (block.timestamp - lastUpdateTime) * rewardRate * 1e18 / totalSupply; } function earned(address account) public view returns (uint256) { return balanceOf[account] * (rewardPerToken() - userRewardPerTokenPaid[account]) / 1e18 + rewards[account]; } Which Staking Mechanics to Choose?
| Mechanic | Description | Gas | Effect on TVL |
|---|---|---|---|
| Lock period | Tokens locked for N days | Moderate | Reduces sell pressure, stability |
| Unstaking cooldown | Withdrawal after 7-28 days after request | Low | Mimics PoS unbonding |
| Early withdrawal penalty | 10% fee for early withdrawal | Moderate | Encourages long-term staking |
| Time multiplier | rewardRate increases with staking time | High (logic) | Boosts LP loyalty |
Choosing a mechanic depends on project goals: lock period suits stability, cooldown mimics PoS, penalty enforces discipline, multiplier rewards long-term holders. Combining these allows fine-tuning the pool economy.
Why Is Staking Contract Security Important?
Staking contracts are frequent exploit targets. Recently, vulnerabilities in this category led to losses exceeding $200M. Main attacks: reentrancy, flash loan manipulations of rewardRate, and incorrect balance tracking. A single reentrancy exploit can cost a project $500k. We conduct audits using Slither, Mythril, and Echidna for fuzzing, plus formal verification of key invariants.
Deliverables
- Smart contract in Solidity 0.8.x with support for ERC-20 / ERC-4626 (vault) if needed
- Unit tests with Foundry (coverage >90%)
- Integration tests in the main framework (Hardhat or Foundry)
- Deployment and verification documentation for Etherscan
- Interaction guide (ABI, sample calls)
- Post-audit support: fixing findings, re-audit
- Access to private GitHub repository
- Training session for your team (1 hour)
Gas Cost Comparison: Naive vs Optimized
| Number of stakers | Naive (gas) | Optimized (gas) | Savings |
|---|---|---|---|
| 10 | 15000 | 5000 | 67% |
| 100 | 100000 | 5000 | 95% |
| 1000 | 950000 | 5000 | 99.5% |
Our optimized approach is 20 times better than naive with 1000 stakers. Gas savings can save up to $200k per year for a large pool.
Work Stages
- Analysis — study your tokenomics, required mechanics (lock, cooldown, multiplier)
- Design — contract architecture, pattern selection, gas budget approval
- Implementation — coding, unit tests, code review
- Audit — internal static analysis + external audit (optional)
- Deployment and verification — deploy to mainnet, publish source on Etherscan
Timeline: 2 to 4 weeks depending on mechanic complexity. Cost typically ranges from $5,000 to $20,000. Contact us to discuss your project.
Typical Errors in Staking Contract Development
- Incorrect order of state updates during reward payout (missing CEI)
- Using the same token for staking and reward without accounting for totalSupply confusion
- Missing zero address check when initializing admin key
- Storing sensitive parameters (rewardRate) without timelock
We know these pitfalls — we have over 10 projects where such bugs were found and fixed at the audit stage. Order turnkey staking contract development with a security guarantee.
Experience: 5+ years in DeFi, 10+ staking contracts in production, code audit from 1500+ hours on projects. We guarantee security and transparency at every stage.