Matchain Liquid Staking Protocol
Zealynx audited Matchain's liquid staking protocol, the MAT token reward distribution mechanism with halving emissions, the pool ownership NFT, the staking pool factory, and the fee distribution vault. The 6-day review identified 23 issues including 6 High severity (two reentrancy windows around the pool ownership NFT transfer, halving boundary reward miscalculations, exchange rate front-running, and reward starvation beyond the first 21 pools). 18 findings were fixed during the engagement and 5 were acknowledged.
Total findings
23
18 fixed · 5 acknowledged
Critical
00
High
06
Medium
05
Low + Info
12
02
Scope
7 filesRepository
Initial commit
50690f4ca1cf
Platform
Matchain · Solidity
Methodology
File
MATToken.sol
MatchConfig.sol
StakingPool.sol
LiquidStakingPool.sol
StakingPoolFactory.sol
PoolOwnership.sol
FeeDistributionVault.sol
03
Findings
click any row for the full write-upSeverity
ID
Finding
Status
04
Key Findings
- Reentrancy via ownership transfer before stake state update. The
_transferOwnershipfunction inStakingPoolcallsownershipNFT.transferFrom(which firesonERC721Received) before updating the recipient's stake bookkeeping, opening a reentrancy window where the new owner controls the pool with a still-uncleared stake balance. - Reentrancy in pool token transfer.
PoolOwnership.solsimilarly callssuper._safeTransferbefore invokingmoveStakeToSelfStake, letting a smart contract recipient observe the staking state mid-transfer and double-count or exploit it viaonERC721Received. - Exchange rate function enables direct protocol fee theft.
LiquidStakingPool.exchangeRate()is a public function that combines reading and state-modifying behaviour, so any address can front-run reward distribution with a no-costexchangeRate()call to consume the reward delta and starve the protocol's fee accounting. - Halving boundary reward miscalculations. Two distinct High issues (
IMM-HIGH-01andIMM-HIGH-05) cause underemission across halving boundaries: the contract applies the post-halving reward rate to all blocks since the last distribution, yielding roughly 49% fewer tokens than the economic model intends. - Unrestricted pool creation leads to reward starvation beyond first 21 pools. Pool creation via
mintPoolis unbounded, butrewardDistributiononly iterates over a fixedMAX_POOL_NUMBER = 21pools, so any pool registered beyond the first 21 receives zero rewards regardless of stake.
05
Team & approval
Auditor
Zealynx Security Researchers
06
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
