Security Philosophy
stake.link was built on a foundational premise: the protocol should be as boring as possible in all the right ways. Smart contracts hold real user funds and operate continuously on a live blockchain — every deployment decision, every upgrade, and every dependency is a potential attack surface. The response has been to invest heavily upfront in multiple layers of defense rather than reacting after the fact.
That philosophy manifests in four concrete commitments: fully open-source contracts with no hidden logic, five independent audits from different firms across different points in the protocol's lifecycle, a 24-hour on-chain timelock on all upgrades, a $100,000 bug bounty on Immunefi, and Hypernative 24/7 CryptoSecOps monitoring that keeps the wider security research community actively engaged.
After 3+ years of operation and $60M+ in TVL across those years, no security incident has occurred. That track record is the most credible signal of all — but the defense-in-depth approach is what creates it, not luck.
The Five Audits
The contracts have been reviewed by five independent security firms at different stages of development. Using multiple auditors rather than one is intentional: different firms apply different methodologies, bring different threat models, and catch different categories of bugs. A finding missed by one auditor may be caught by another.
| Auditor | Focus | Status |
|---|---|---|
| CodeHawks | Core staking contracts, early protocol architecture | Complete |
| Sigma Prime | Smart contract security, access control patterns | Complete |
| Zellic | Economic invariants, reward distribution logic | Complete |
| Trust Security | Protocol upgrade paths, proxy patterns | Complete |
| Cyfrin | Full protocol review — most recent (2024) | Complete |
audits/ directory of the open-source contracts repository at github.com/stakedotlink/contracts. Anyone can read the full findings, severity classifications, and resolution notes.The most recent review — by Cyfrin in 2024 — covered the current production contracts. Running a fresh audit after significant protocol upgrades is standard practice for protocols that take security seriously, and the Cyfrin engagement reflects the protocol's commitment to keeping the audit coverage current rather than relying solely on older reports.
The 24-Hour Timelock
Every smart contract upgrade at stake.link is gated behind a 24-hour on-chain timelock. This means that even if a multisig signer account were compromised, an attacker could not immediately deploy malicious code — any proposed upgrade is visible on-chain for at least 24 hours before it can execute.
During that window, the community can observe the proposed change, validate it against expected protocol behavior, and take protective action if something looks wrong. This is not a soft policy — it is enforced at the contract level and cannot be bypassed even by multisig signers. The timelock contract holds execution authority and requires the delay to pass before any upgrade proceeds.
Treasury multi-sig address (6-of-8 multi-signature wallet)
0xB351EC0FEaF4B99FdFD36b484d9EC90D0422493DDAO governance controls this 6-of-8 multi-signature wallet. All upgrades are proposed through this multi-sig and execute only after the 24-hour timelock expires.
Timelocks also protect against governance attacks. A proposal that passes through rushed or manipulated voting still cannot execute instantly — the 24-hour delay gives token holders time to respond, exit positions, or escalate concerns through community channels before a harmful change takes effect.
Bug Bounty Program
stake.link operates an active bug bounty program through Immunefi, the leading smart contract security platform. Immunefi provides a neutral third-party layer for coordinated disclosure — researchers submit findings through Immunefi's platform, which handles triage, communication, and payment processing according to a defined severity framework.
$100,000
Maximum payout for critical findings
The $100K ceiling keeps the bounty competitive for a focused protocol scope. A meaningful maximum payout signals that the protocol takes researcher incentives seriously — it is only worth hunting bugs in a codebase if the reward justifies the effort.
Bug bounties complement formal audits rather than replace them. Audits provide structured, time-bounded reviews by known firms. Bug bounties create a continuous, open-ended incentive for the global security research community to examine the contracts at any time. A vulnerability that emerges six months after an audit can still be caught and responsibly disclosed through the bounty program.
Researchers who discover valid vulnerabilities can report them at immunefi.com. All reports are handled with standard responsible disclosure practices — researchers receive credit and payment before any public disclosure.
Node Operator Security
stake.link's staking infrastructure is operated by 15 diversified professional node operators (NOPs). These are not anonymous validators — they are established infrastructure providers with long track records in Chainlink node operations and significant skin in the game across the broader staking ecosystem.
Collectively, the 15 NOPs represent $5B+ in combined Ethereum stake, a figure that reflects the operational scale and reputation each operator has built. Running Chainlink nodes requires technical sophistication, reliable uptime, and accountability to the broader oracle network — the bar for inclusion is high.
Diversification across 15 independent operators also reduces concentration risk. If one operator experiences downtime or an incident, the protocol continues operating via the remaining operators. No single operator failure can halt staking operations or materially impact user funds.
Risk Taxonomy
Honest security documentation includes a clear accounting of what can still go wrong. stake.link has mitigated many risks through design and auditing, but several categories of risk exist for any liquid staking protocol and should be understood by users before participating.
Smart Contract Risk
All funds held in the protocol are managed by smart contracts. Despite five independent audits and an active bug bounty, undiscovered vulnerabilities could theoretically exist. This is an irreducible risk in any on-chain protocol. Mitigations: open source code, multi-audit history, timelock on upgrades, continuous bounty program.
Slashing Risk
If a Chainlink node operator is slashed for underperformance or misconduct, the impact is shared proportionally across all stLINK holders — the exchange rate would decrease. This has never occurred in 3+ years. Mitigations: 15 diversified professional NOPs, each with 100% historical uptime and zero prior slashing events.
Liquidity Risk (Curve Pool)
stLINK liquidity is primarily in the Curve stLINK/LINK pool. In extreme market conditions or during a panic withdrawal scenario, pool imbalance could result in slippage when exiting large positions. Users who need immediate liquidity on large amounts should account for potential market impact.
Depeg Risk
stLINK is designed to maintain parity with LINK. However, market dynamics can temporarily push the trading price of stLINK below its underlying LINK value. This has historically been minor and corrected quickly via arbitrage, but the possibility exists during stressed conditions.
Liquidation Risk (Collateral Use)
If wstLINK is used as collateral in lending markets such as Morpho and the loan-to-value ratio approaches the liquidation threshold — due to price movements in LINK or the borrowed asset — the position may be liquidated. This is a function of how the collateral is deployed, not of the stake.link protocol itself.
These risk categories are not unique to stake.link — they apply to any liquid staking protocol. Understanding them allows users to size their positions appropriately and use the protocol in a manner consistent with their own risk tolerance.
Zero-Incident Track Record
Since launching, stake.link has processed hundreds of millions in deposit and withdrawal volume across 3+ years of continuous on-chain operation. During that time, the protocol has maintained a zero security incidents record — no hacks, no exploits, no unauthorized fund movements, no slashing events.
This is not a claim made lightly. The DeFi landscape during this period included multiple high-profile exploits affecting protocols with comparable TVL and audit histories. stake.link's clean record reflects both the quality of its security practices and the conservative, defense-in-depth approach taken from day one.
0
Security incidents
0
Slashing events
3+
Years operating
5
Independent audits
It is worth noting what the analytics dashboard does and does not do from a security perspective. The stakedotlink.money analytics system is entirely read-only — it queries on-chain data and presents it visually. It holds no private keys, has no signing authority, and cannot initiate any on-chain transactions. The analytics layer cannot affect protocol security in any direction.
For users evaluating stake.link as a place to put capital to work, the combination of five audits, three years of clean operation, a live $100K bug bounty, Hypernative 24/7 monitoring, and 15 professional NOPs with zero slashing history represents one of the more thorough security postures in the Chainlink ecosystem.