v2.0.0 — Audited relaunch on Base

Initial bug-hunting audit — published

The 2022 STACH contract was resurrected and put through a full adversarial review (bug-bounty methodology) before any deployment. Full report: docs/AUDIT-2026-10.md.

Critical findings (fixed, regression-tested)

• C-1 · transferFrom destroyed recipient balances — balances[to] = balances[to] - tokens (minus instead of plus). Every DEX/router integration would have reverted or burned funds.
• C-2 · Unbacked reward payouts — withdrawRewards() credited balances while the 3M reward pool existed only as a counter; the sum of balances could exceed totalSupply(). Rewards are now paid from a real on-chain reserve with Transfer events.

Hardening

Reentrancy guards on every external-call/unstake/withdraw path, zero-address checks, lifecycle events (Staked/Unstaked/RewardsWithdrawn), hardhat/console.sol removed, balance-delta "deflation" dance replaced with direct transfers.

Post-deploy pass

auditlens (static-first lens engine): 0 heuristic hits. Slither: every detector hit triaged in the report's appendix. Scanner flags (MetaMask/Dedaub) explained line-by-line in docs/SECURITY-FLAGS.md.

Deployments (source-verified: Sourcify + Basescan)

Contract	Address	Network
STACH	0x82c5f9901CD9AEE3177053482b79aEA235507166	Base mainnet + Sepolia
StachFaucet	0x2fc5f8976d3f460D78dc6AbFBd84EFBC0Da0D1C4	Base Sepolia

Live: app · landing · API · MCP: npx -y stakechain-mcp

28 Hardhat tests + API unit tests green in CI.

🤖 Generated with Claude Code