Security and audit documentation

WStaking has a smart-contract security assessment performed by CredShields. The report should be read together with the contract name, version, network, source reference, and scope identified in the audit.

The audit reflects the code and conditions reviewed during a specific period. It does not guarantee that the contract is free from vulnerabilities or that later deployments, upgrades, frontend systems, backend services, or operational processes are covered.

The report describes a smart-contract assessment of the identified testnet scope. It states that CredShields reviewed the contract source, functions, and business logic during the audit window and retested the remediation changes.

The report does not establish coverage for the frontend, backend services, infrastructure, administrative procedures, external integrations, token contracts, operational wallets, or later contract versions and deployments.

The report identifies testnet addresses and does not publish a source commit that proves the current mainnet deployments match the audited or retested code. Users should compare the audited source and version with the currently deployed contract information.

The report records 16 findings: 1 Critical, 2 High, 3 Medium, 6 Low, 1 Informational, and 3 Gas optimization items. Its executive summary states that the findings were addressed, while the finding table records individual items as Fixed or Acknowledged.

The report records a retest on March 20, 2026. Users should review the finding entries and retest notes in the full report for the exact status of each item; an acknowledged finding should not be treated as resolved.

Before relying on an audit, compare the audited contract name, version, source reference, and network with the contract currently used by the application.

Confirm the network, full contract address, proxy or implementation status, version, and explorer source-code verification where available. Current published mainnet references are listed separately in the contract registry and transparency information.

Source-code verification on a blockchain explorer allows published source to be compared with deployed bytecode. It is not a substitute for an independent security audit.

The published report identifies BNB Smart Chain Testnet scope addresses, while the application publishes mainnet references on other deployments. Exact audited source-to-mainnet deployment matching is not currently verified on-site.

Security researchers and users can report a suspected vulnerability through the responsible-disclosure process. Include the affected page, contract, or network; a clear description; reproduction steps; a transaction hash or contract address where relevant; potential impact; and supporting technical details.

Do not publish an unresolved vulnerability publicly. Do not share private keys, seed phrases, wallet recovery phrases, or account passwords. For general account or transaction support that is not a vulnerability report, use the normal support channel.

Security contact: service@wstaking.net