Security & Audits

LUKSO staking relies on smart contracts, validator operations and privileged administrative and oracle roles. Non-custodial operation lets users hold their positions through their own accounts, but does not remove contract, operational or liquidity risk.

User Security Recommendations

Use a wallet or Universal Profile you control and secure its keys, controller permissions and recovery setup. Withdrawal rights depend on the current vault stake holder, and a pending withdrawal belongs to its beneficiary. They are not permanently restricted to the original depositing wallet.

Verify the network, app URL, contract address, beneficiary and transaction contents before signing. Keep gas available for later actions. Never share a recovery phrase, private key or controller key with support. Treat unsolicited requests to send funds, sign transactions or disclose secrets as suspicious.

Official support and announcements:

Multiple Security Audits

Published reports for the LUKSO contracts include:

Earlier vault audits are in the Universal Page contracts repository.

Read each report's code revision, scope, assumptions, findings and remediation status. An automated agent report is a different kind of review from a human audit. Neither establishes that all issues are fixed or that the live deployment matches the reviewed code. Audits reduce uncertainty; they do not guarantee safety.

Smart Contract and Administrative Risks

The documented vault source includes owner-controlled pause functions and operator/owner controls for fees, fee recipients, deposit limits, oracle permissions and restricted-mode settings. These roles affect how the vault operates. A pause can block deposits, stake transfers, withdrawals, claims and oracle operations.

The token source includes owner-controlled mint/burn pausing. Burning also depends on the linked vault: restricted mode can prevent an unallowlisted recipient from receiving the returned stake.

Both implementations use upgradeable-library patterns. Determine actual upgrade authority from the deployed proxy and implementation rather than assuming a library name establishes the live permission model. Compromised privileged accounts, incorrect configuration, bugs or a future upgrade can affect funds or availability.

Oracle Responsibilities and Failure Risk

In the documented vault source, authorized oracles call rebalance to update accounting and registerValidator to deposit vault funds into the network's validator deposit contract. The latter constructs withdrawal credentials pointing to the vault. Oracles therefore have consequential operational powers even though they do not hold users' wallet keys.

An unavailable or incorrect oracle process can delay accounting or validator registration, and incorrect validator data can put funds at risk. Withdrawal credentials pointing to the vault do not make every oracle action harmless. Do not interpret the oracle architecture as a guarantee that a compromised oracle cannot affect funds.

The source's rebalancing implementation explicitly assumes validator penalties do not occur or are negligible. This is an accounting assumption to review against the deployed implementation and incident procedures, not slashing insurance or a guarantee that losses cannot happen.

Validator and Network Risks

Downtime can reduce rewards and incur penalties. Conflicting validator duties can cause slashing. Key handling, validator data, network selection and operational procedures matter alongside contract review. No monitoring or diversification strategy removes these risks entirely.

Incorrect validator deposit data can lead to failed activation or inaccessible funds. Check current operational safeguards and the scope of relevant audits; do not rely on a general claim that every possible invalid deposit is prevented.

Withdrawal and sLYX Risks

A withdrawal may be paid fully, partially or not at all immediately. The remainder requires sufficient claimable funds and a later claim transaction. Validator exits, network processing, vault accounting, contract pauses and beneficiary compatibility can delay receipt. There is no guaranteed completion time.

Burning sLYX returns vault stake, not spendable LYX. Market liquidity is a separate issue: sLYX may trade at a different price from its accounted backing, and a market may not have enough liquidity for your order. Using it as collateral or in another protocol adds that protocol's risks.

See the withdrawal procedure and sLYX integration guide.

Verify Before Interacting

Compare the published addresses and reference with the app and explorer. Inspect the live proxy implementation, owner/operator roles, token-vault link, fee, limits, restrictions and pause state. The repository revision referenced here explains the documented behavior; it is not proof of the code or settings currently deployed.

Read the Terms of Service before using the platform. If a transaction or balance looks wrong, retain the public transaction hash and seek support before sending further funds.