[Music] [Music] hello, hello, gmgm everyone, hello Hawks, and welcome to the starnet staking Cod Hawks kickoff. My name is Karen Nightingale, and I'm an engineer and instructor here at Cyphon. So today, we're going to be running through the starnet competitive audit that is currently live on Code Hawks. I just wanted to run through a few very quick housekeeping highlights that I wanted to mention before I introduce you to our wonderful guests. So the first thing is that this competition is currently live. How exciting! And we are going to be running this until October the 4th at noon UTC. So get it in your diaries, get some reminders. You will be competing for a prize pool with a grand total of $65,000, which is split into $60,000 for the highs and mediums and $5,000 for the lows. And now just a very quick overview of the project. So this project is the implementation of the Stark net staking mechanism following

Stark net sn8 and all of the information about this project, the actors involved, the scope and compatibilities, as always, is detailed in the readme on the GitHub links on the code Hawks stocket staking landing page. Little bit of a mouthful there. And now to explain to you a little bit more about this project, how it works, we have Natal and Alon from Stark net. Hello, Natan and Alon. The floor is now yours. Feel free to introduce yourself and explain a little bit more about start net staking. Hi everyone. Hi um I'm Natan. I'm the PM working on staking. Um Alan. I'm Alan. I'm a software developer on the team. Uh I must say first Alan heard about the prize and Alan you cannot participate. You understand this right? Okay so um yeah but for you it's very important uh uh to to test it and find it and and get all these rewards. We really prefer to share this money and find all the issues beforehand um so like I said my name is Natan. I'm the PM

working on the project. Uh, basically, we are looking at the first stage of staking on Stet. This is a very novel thing. This is the first L2 to move this much, uh, uh, this fast to being decentralized. So, I'm referring to it as being the first stage. This is not merely the last stage of staking on Starknet. There will be major versions coming ahead, but our plan is to, uh, launch and, and, uh, make sure our validators set and all of our economical structures are being, uh, tested and, and, and, uh, detailed, and we can reiterate and refine them to transition very easily from our current state to being decentralized. Um, so, like I said, it's only the first stage. Uh, the scope of the project is both L2 two mechanisms for staking, basically a staking registry when you can lock your funds, staking pools when you can have delegators to allocate funds to you, minting curve calculations, staking reward suppliers, all of that on L2, and then you'll have on L1 some minting.

contracts and again suppliers that would supply the minted rewards to L2. That's very, very zoomed out. Um, I would say just, uh, um, in a very, I would say, uh, roadmap level. Currently, Stocket is starting or continuing its transition between being centralized and decentralized while still being live. This is something very complicated. The only network that transitioned between two consensus protocols was Ethereum transitioning between a proof of work and a proof of stake while still being live. It took it more than two years and lots of incremental steps. So, this is one of our major steps after our provision program. Um, we are very, very excited about it. We worked on it very hard. We're already working on the second stage. Um, and we want to invite you to take part in this historic and very, very, uh, amazing project. Uh, alone please, uh, I'll open the repo and we can go through a bit of the high-level uh, entry points and read functions and WR functions. Uh, just a minute. Can this see your screen? I'll share it. Okay, yeah, I can add

it to Stage um yes okay so um present yes um so to rearrange the screen a bit hang on one second okay amazing yeah go ahead they see it you can just go ahead and and go through the docs and whatever okay so basically um I'll just go into the code no you want the dogs whatever you prefer all right so anyway the the big part is obviously well in staking contracts okay so Works app staking contract and here it's the source and here are the the main the main players here so you have the staking contract you have the L2 reward supplier you have the operator which is kind of like the the contract you actually send the transactions to and then it sends the transactions to the staking core okay you have the minting curve which basically is it has no State except for the total supply of the of the token and what it does is just is just give the yearly supposed mint amount so it's just a service yeah it's like it it it queries the stake the the total stake from the Stak in

contract okay and it just calculates like the yearly reward, and then from that yearly reward, we extrapolate the actual reward that the staking contract deserves for the amount of time that passed since the last time it was calculated. Um, so these are the L2 contract. Okay, so wait, so in staking, I think the interface would be easier. Yeah, let's go into the interface. Okay, sure, yeah, so taking in. Yeah, so Tak interface. Okay, okay, the scrolling is really fast on the. Oh, it's on the Mac. Okay, so we have a stake. Wait, the question is how deep am I supposed to go into the details? Uh, I would say, uh, however deep you like is fine. If you want to take it high level, then that's absolutely fine, or just introduce us to the main entry points, the main workflow. It's up to you. All right, I'll explain it. So stake is basically the way you enter the staking contract. It's the only way. It checks that you weren't there before. It checks

that like it checks everything that it's supposed to like hopefully but that's like the way you get you you stake your your initial amount. Okay, increased stake is after you already staked use stake. You can increase the stake even by a tiny amount, so this has like a Min stake I think of 20,000. Yeah, Starks. Okay, and this is without minimum at all. Okay, um claim rewards is how you basically uh you clear. There's like an unclaimed rewards that that build up. Okay, as it's being calculated and and when you claim rewards, you can actually clear it and and get the rewards to your reward address. Okay, um in addition, you have unstaking tent and unstake action. Unstake intent is when you say you want to leave, you want to unstake and then you have 21 days until you can actually do unstake action, which clears you and and deletes your your entry in the contract and sends you the funds and sends your pool delegate your delegation pool the funds as well.

um, so this is a question. Yeah, um, so you need to call unstake intent before you call unstake action. Yes, okay, that makes sense. Yeah, and then you have to wait a while. Um, okay, it. Then there are the obvious, like, change reward address if you want to change your reward address in the middle, then like, like during your stake period. Then you can do it. Uh, you can start, like, in the stake, in the mistake. Yeah, you have, like, pool enabled or not enabled. If it's not enabled, you can do afterwards. Set open for delegation. Okay, um, and I think that's it pretty much here. These are the main entry points here. I don't think there's okay anything else. So I think, um, for you can call, you can enter the pool contract. Um, and then I think these are the main functionalities from entry points, right? So this and the pool contract would be pretty much similar, no? But okay, but then there's like the API here that only the pool contracts can actually the pool.

contracts themselves can actually call which is ADD stake from pool. Okay, it's the way they add a stake. There's remove from delegation pool intent. Okay, what this does, this is a bit tricky in the code. What this does is there's like an intent, like a pool UND delegate intent area in the staking contract. Okay, okay, that looks like I think that's defined in the staking. Actually, wait, it's actually here. I'm looking for the struct. Yeah, I think, but I think it's here and you can see. I don't think it's very. Okay, there's an array that writes all the. There's like a map. Okay, there's like a map that basically. Okay, there's a map that basically has all the intents of all the pool members of all the pools. Okay, that. So, it's like a map from. From the, which is like a tuple from a pool contract address and an identifier, which depends on the pool contract implementation, but usually it will be just the pool member. So, you have like a

pool address and pool member to its intent. If there's an intent, it's there; if not, there isn't. Um, it's like zero, and uh, that's it for that. Wait, hold on. So when you do this, you basically add that to the map, okay? Um, and then you have the action which clears that intent from the map, and okay, what else? So there's also switch staking delegation pool. This is also something that the pool actually calls itself. There's also the pool side switch staking switch pool. All right, but this is what the pool contract calls. And there's also claim delegation pool rewards, which Al, which also the pool contract calls and gets the rewards until now. I'll say something about the functionalities because I think this is a very detailed explanation to what which one does what, but basically, there are stakers. Stakers can choose to open delegation pools, and both stakers and delegators face 21 days of delay between intent and actual withdraws. The only caveat, or I would say a different

flow that escapes. This is the switch pool mechanism. So basically, what we wanted is the pools to be very competitive. We didn't want delegators to be stuck in a certain pool. We want them to switch pools very fast and not wait for the whole 21 days. This is why we have a very, I would say, a bit more elaborate mechanism that allows the pool contracts to call switch pool and then basically would hop from one pool to another without waiting the 21 days in between. So basically, you're still committed to the stock. It is still locked all the way through, so we don't have security issues with this. And this also brings a lot of competition to the pool or staking pool market. And I want to explain how this is all, where you can find the maps, and how you can change these maps. And basically, it's only the pool contracts that are able to change these maps, but all these maps are written on the staking contract. So I

hope I made it clear. If I made it less clear, I'm sorry. Um, that's the basic functionalities. Yeah. Um, okay, I'll just go to the pool now. Wait, so let's go to the pool interface. Um, any questions? Um, questions? Yeah, wait, we can't see the... No, currently not yet. Oh, um, I can see the chat, and currently there are no questions. I will interject if I get any other questions for you. Okay, cool, so you can continue. Okay, so in the pool contract here, again, here users interact, not the other contracts. I mean, every account is a contract, but never mind. Okay, so um, okay, so again, there's enter delegation pool. This is the way you enter the delegation pool. Initially, though, it does not have a minimum, right? Have a minimum. Uh, and after you're... After this, like, registers you, you can do at delegation pool. The reason, by the way, we have these, like, are separate is because we want people to be able to ER, like, claim rewards and add, like, even daily if they want, you know, because that creates

like a compound, yeah, like a compound interest, yeah, okay. Because otherwise, if you have a certain amount as a staker or as a pool member, you will only get a percentage on that, and you will not get a percentage of interest on the rewards, yeah, on the rewards. So if you want to have compound interest, you have to claim and then add, okay? So claiming ad, so that's why there's no minimum here, but also not here. So sorry, could you just clarify what's the difference between enter delegation pool and add to delegation pool? So the only difference is this one actually adds you to the map initially, okay, and makes sure that you weren't there before and stuff like that. And at the delegation pool, first of all, it can be called from two addresses. It can be called from the pool member address and can be called from the reward address, okay?

yeah, we didn't touch about it at all, but we support a very, uh, I would say, elaborate key management. So, what does it mean? It stakers have three keys. There have the main, um, um, you know, Staker key, which controls the whole amount of entering and exiting. There's a rewards address that controls all the rewards would go to it. It controls less of less funds, so it can be less secure. And there's the operational address when eventually, uh, stakers would have to side block sequence blocks and such. Uh, this address is very, very, uh, frequently used, so it's very hot, so it's not secured, uh, in that case. Even Del ators can, uh, have two addresses. They can choose it to be the same address, but they have, like, the main address that controls the whole amount they're delegated and the rewards, which is a fraction of it, um, uh, is set to another address. So, when you add to the delegation pool, you don't need to say what you know, what's the reward address. It's only when you sign in and also to

add to delegation pool. Uh, you can do it not only with your very, very secured enforced called wallet. You can do it with the Rewards address, which would be more frequently used and more accessible. Yeah, that's thank you. Yeah, I mean, the point was that the initial amount, which is very large, it could be very large. You want to do it like a cold wallet, you know, and keep it on the side and not use it for a while. Okay, so we have that, and then we have just like in the staking, we have the pool intent and the exit delegation intent in action. Okay, and here is the user side switch delegation pool that you tell it, you know, I want to go to the pool of this Staker, and it has to have this address. Why do we say Staker and address? Because we want to make sure that when you do the actual change, you know what's the implementation here and everything you

want to know it's not. It's out of scope. Uh, anyway, okay. And this is the other side of the switch delegation pool, which is enter delegation pool from the staking contract. Because basically, the flow is you do switch delegation pool. It goes to the staking contract, to the switch pool over there. And that function calls this function in the other pool contract. I'm sorry if I'm confusing you. Uh, you. Yeah, so I think that the larger scope is saying pool contract. Uh, can get as a very, uh, specific role for the staking contract. So, so some functions can only be called from the staking contracts and vice versa. So, I think this is a key thing to watch when you do these aits. Is some functions on the pool contracts are only, uh, are assuming that the staking contract contract holds them. And the staking contract assumes a pool contract holds it. Um, we can skip all the details of this. They'll find out. Like, I hope they find out. This is another one of these, uh, function. Yeah, this is another one of the

functions that only staking contract can call. Uh, basically, Bally, this final Staker index is when the Staker calls unstake action. He's basically deleted from the records in the staking contract. So, since the interest is calculated compared to the index of the Staker, you will see it in the code. Okay, so since we cannot query it anymore, we have to set it somewhere. So, we set it in the unstake action. We call this function which sets it like indefinitely. Okay, but you will see it in the code, hopefully. Uh, and then there's like nothing really nice. Love seeing it. Yeah, it's yeah. Okay, um, okay. Then we have the op. I think um, you think that's it maybe? Yes. So, I have five more minutes. I don't want to waste for me. Maybe you can stick longer. Um, I would say say a something about maybe the L1. Yeah, the solidity is in scope, right? Um, is in the scope of the audit also this um, I think so. Yeah, I think so. Okay.

let me just double-check that. Okay, um, yeah, yeah, the solidity is in scope. Yeah, but then I have to say something about reward supply. Okay, so you can check it in the reward supply on L1. It will give them a taste. Maybe just say something in the reward supply on L1, and that's it. If you can stick longer, um, wait, I'll just say a word here. Okay, there's a reward supplier. This basically what it does is, is I'll just explain the mechanism. It, uh, it basically asks. It keeps all the rewards that the stakers are due. Okay, which basically is not on the staking contract. It's here on this contract, the balance. I mean, obviously, it's on the ERC20, but, uh, anyway. So what this does is, is it has a certain amount of money, which is the rewards for all the stakers, for all the staking contracts. And when it doesn't have enough money, okay, when it doesn't have enough

tokens it sends a message. Okay, I just want to show it sends a message to L1 saying please mint a certain amount I need for the rewards and pass it to me and send it to me. Okay, so now I'll show the L1 side um staking and I want to make something clear I think you would be interested in uh the L1 to L2 messages and L2 to L1 messages and also deposits are out of scope in a sense so we are using and referring to uh deposits using Stargate and deposits themselves and also other messages use Stark net messaging mechanism and I think you need to understand if we meet the interface correctly but beyond that it's out of scope. Okay, so um it's you won't find the messaging mechanis in in the repo so just just an FYI. Yeah um yeah so basically in this contract you have like a function called I think it's stick wait I it's sck it's stick.

it's think I just want to like look for it. That's a search. No, I know. Forget it. It's just Mac. It's just Mac. Sorry, sorry. Okay, come on. Okay, okay. So basically, this receives the L1. Okay, so this tries to consume these L2 to L1 messages. Okay, and for as many as it consumes it, it just requests a mint and sends it to and deposits it with message to L1 to L2. Sorry. Okay. Um, uh, yeah. So this is basically the system. Um, wait. So, so are you finished running through the code? Um, you want to? I have to go personally. Um, no problem at all. No problem. So maybe I around and share a bit more. Um, I know. No, that's absolutely fine. Thank you so much, both of you. That was really, really good. Um, great run through of everything. It was perfect. No, well, I mean, unless you want to, but I think we're running out of time here now. We've only got two minutes left. Um, unless

there was anything other high level that you wanted to explain. Um, the description was extremely detailed, so it was great. Only say that our representatives of stare would be in the Discord, and we're available, and we'll answer questions throughout, so it's not like we're gone until October 4th. Uh, we're here, and we're very, very excited about this effort, and um, yeah, and I, and I'll say that, that I really hope you find stuff and should look at the all these like intense area in the pool like I would look, I don't know, I think, uh, you cannot participate. I told you this. No, I know, I know, I know. I hope you find things is what I'm saying. I hope you find it's really, I want you to. Yeah, that's a great point. Thank you so much to both of you. Um, um, great to have you both on. Oh, sorry, was no, no, I was just saying, oh, I thought you were saying something else. No, thank you so much. Um, as always, all the information that you guys need is going to be on the

GitHub repo linked on the code Hawk's Landing Page, and as you guys said, if you have any questions, then there is the Starkware Discord, and then also we have the Cphon Discord, so don't hesitate to ask away if you have any questions. Again, a massive thank you to our guests Natan and Alon, and thank you Hawks for joining GM and GN everyone. Bye-bye.

Starknet Staking | Live competition Kick-off

Book a smart contract audit here 👇
https://www.cyfrin.io/
