QST Staking Protocol - QuStream

The start_stake_window instruction initiates a staking window where:

• The window remains open for 14 days from activation, during which users can stake tokens.

• A 48-hour enrollment period is enforced from the beginning of the window for users who wish to participate in the bonus program.

• Users who stake can withdraw their principal only 25 days after their last stake action.

• Bonus-enrolled users must wait an additional 10 days beyond the principal unlock period before withdrawal.

Additional mechanics are as follows:

• Early Unstake for Non-Bonus Users: Non-bonus users are permitted to unstake early by paying a penalty (30% if 20–10 days remain before unlock; 20% if within 10 days).

• Penalty Redistribution: Penalties collected from premature unstakers are redistributed to bonus-enrolled users when those users withdraw after completing their full lock period.

An inconsistency in reward distribution was identified. The following scenario illustrates the issue:

• Day 0: Staking window opens.

• Day 1: Alice and Bob stake and enroll in the bonus program. Their withdrawal eligibility is at Day 36 (1 + 25 + 10).

• Day 5: Alice stakes again, extending her withdrawal eligibility to Day 40 (5 + 25 + 10).

• Day 14: Tom stakes without enrolling in the bonus program. His withdrawal eligibility is at Day 39 (14 + 25).

• Day 36: Bob withdraws and receives only his staked amount because no penalties have been collected yet.

• Day 37: Tom performs an early unstake and is charged the applicable penalty.

• Day 40: Alice withdraws and receives her staked tokens plus the penalties collected from Tom.

This behavior produces a reward distribution inconsistency: Bob, who complied with the bonus program’s extended lock-up, receives no share of penalties because withdrawal occurred before penalties were generated. Conversely, Alice, who staked later and extended her lock-up, receives the full penalty redistribution even though Bob was also a qualifying bonus participant.

The outcome results in a misalignment between participant expectations and reward mechanics. Bonus-enrolled users who fulfill the extended lock-up may not receive redistributed penalties depending on the timing of other participants’ early unstakes. This undermines perceived fairness in the bonus reward system and may discourage participation in the bonus program.

programs/qst-staking/src/lib.rs

        let principal_amount = stake_account.amount;
        let mut bonus_rewards = 0u64;

        // Calculate bonus rewards if enrolled and bonus period ended
        if stake_account.enrolled_in_bonus && current_time >= stake_account.bonus_unlock_time {
            if staking_pool.total_enrolled_stake > 0 && staking_pool.penalty_vault_amount > 0 {
                // Use u128 to prevent overflow in proportional calculation
                let pv = staking_pool.penalty_vault_amount as u128;
                let user_amt = stake_account.amount as u128;
                let total = staking_pool.total_enrolled_stake as u128;
                bonus_rewards = if total > 0 { ((pv * user_amt) / total) as u64 } else { 0 };
                
                staking_pool.penalty_vault_amount =
                    staking_pool.penalty_vault_amount.saturating_sub(bonus_rewards);
            }
        }

        let total_withdrawal = principal_amount + bonus_rewards;

  // Initialize or update stake account
        if stake_account.amount == 0 {
            msg!("🆕 Initializing new stake account");
            stake_account.user = ctx.accounts.user.key();
            stake_account.amount = amount;
            stake_account.node_keys_earned = node_keys_earned;

            // Reset lock model - unlock time based on current stake time
            stake_account.principal_unlock_time = current_time + PRINCIPAL_LOCK_PERIOD;

            // Not enrolled by default; bonus unlock remains 0 until enroll
            stake_account.bonus_unlock_time = 0;
            stake_account.enrolled_in_bonus = false;
            stake_account.bump = ctx.bumps.stake_account;
        } else {
            msg!("📈 Updating existing stake account");
            stake_account.amount = stake_account
                .amount
                .checked_add(amount)
                .ok_or(ErrorCode::NumericOverflow)?;
            stake_account.node_keys_earned = stake_account
                .node_keys_earned
                .checked_add(node_keys_earned)
                .ok_or(ErrorCode::NumericOverflow)?;

            // Reset lock model - set unlock to current_time + 25 days
            stake_account.principal_unlock_time = current_time + PRINCIPAL_LOCK_PERIOD;

            // If already enrolled, bonus unlock follows principal (principal + 10d)
            if stake_account.enrolled_in_bonus {
                stake_account.bonus_unlock_time = stake_account.principal_unlock_time + BONUS_LOCK_PERIOD;
            }
        }

To address this issue, it is recommended to implement one of the following measures:

• Force that it can only be withdrawn once the period of possible premature unstakes has passed ensuring that bonus-enrolled users can only withdraw once the early-unstake period has fully expired.

• Decouple the withdrawal process into two distinct steps:

  • Withdrawal of Principal Staked Tokens: Bonus-enrolled users should be able to withdraw their original staked tokens once their principal unlock period (plus any additional bonus lock-up period) has expired, ensuring that the withdrawal of staked tokens is independent of any penalties collected from early unstakers.

  • Withdrawal of Proportional Bonus Penalties: A separate instruction should allow bonus-enrolled users to withdraw their share of redistributed penalties at a later point, once penalties have been collected from early unstakers.

SOLVED: The QuStream team solved this issue by splitting the withdrawal flow into two instructions, withdraw_all and withdraw_bonus. Under the implemented design, deposits may be withdrawn after the corresponding bonus lock period has expired, and the share of bonus penalties may be withdrawn later once any applicable penalties have been applied.

The emergency_pause instruction allows the staking pool administrator to pause the active staking window by setting both stake_window_end and bonus_enrollment_deadline to zero. Conversely, the start_stake_window instruction enables the administrator to start a new staking window, provided it is the first activation or the previous stake_window_end has elapsed.

programs/qst-staking/src/lib.rs

pub fn start_stake_window(ctx: Context<StartStakeWindow>) -> Result<()> {
        let staking_pool = &mut ctx.accounts.staking_pool;

        // Add admin access control
        require!(
            ctx.accounts.admin.key() == staking_pool.authority, 
            ErrorCode::Unauthorized
        );

        // Prevent restarting an active window (optional policy)
        require!(
            staking_pool.first_stake_timestamp == 0 || Clock::get()?.unix_timestamp > staking_pool.stake_window_end,
            ErrorCode::StakeWindowAlreadyActive
        );

        let current_time = Clock::get()?.unix_timestamp;
        staking_pool.first_stake_timestamp = current_time;
        staking_pool.stake_window_end = current_time + STAKE_WINDOW_PERIOD;
        staking_pool.bonus_enrollment_deadline = current_time + BONUS_ENROLLMENT_PERIOD;

This design introduces a potential vulnerability if the administrator executes emergency_pause immediately followed by start_stake_window in an attempt to reset the staking window. Under this scenario, users who staked during the prior (now inactive) window may interact incorrectly with the newly created window:

• Bonus Enrollment Bypass: A user who staked before the reset can still call enroll_in_bonus during the new window, even if they never enrolled in the bonus program of the original (expired) window. This occurs because enroll_in_bonus validates only the current bonus_enrollment_deadline against the current timestamp, without considering the staking window in which the user originally staked.

• Premature Unstaking: Similarly, a user who staked before the reset can call unstake_tokens based on the principal_unlock_time recorded in their stake account. Since this value was derived from the expired window, the user may be able to withdraw their staked tokens earlier than expected relative to the requirements of the newly active staking window.

As a result, resetting the staking window via emergency_pause and start_stake_window can lead to inconsistent staking state across users, allowing them to bypass intended restrictions on bonus eligibility and early unstaking.

programs/qst-staking/src/lib.rs

pub fn enroll_in_bonus(ctx: Context<EnrollInBonus>) -> Result<()> {
        let staking_pool = &mut ctx.accounts.staking_pool;
        let stake_account = &mut ctx.accounts.stake_account;

        let current_time = Clock::get()?.unix_timestamp;

        // Check if bonus enrollment is still open
        require!(
            current_time <= staking_pool.bonus_enrollment_deadline,
            ErrorCode::BonusEnrollmentClosed
        );

pub fn unstake_tokens(ctx: Context<UnstakeTokens>, amount: u64) -> Result<()> {
        let stake_account = &mut ctx.accounts.stake_account;
        let staking_pool = &mut ctx.accounts.staking_pool;

        require!(stake_account.amount >= amount, ErrorCode::InsufficientStakeBalance);

        // Block unstaking completely for bonus enrolled users
        require!(!stake_account.enrolled_in_bonus, ErrorCode::BonusEnrolledCannotUnstake);

        let current_time = Clock::get()?.unix_timestamp;
        let time_until_unlock = stake_account.principal_unlock_time - current_time;

        // Early exit options (relative to current principal unlock date)
        let (penalty_amount, net_amount) = if time_until_unlock <= 0 {
            // Unlocked: No penalty
            (0u64, amount)
        } else if time_until_unlock <= EARLY_UNSTAKE_THRESHOLD_1 {
 // 10—0 days remaining: 20% penalty
            let penalty = ((amount as u128) * (PENALTY_RATE_LATE as u128) / 100u128) as u64;
            (penalty, amount - penalty)
        } else if time_until_unlock <= EARLY_UNSTAKE_THRESHOLD_2 {

Furthermore, it is important to note that the start_stake_window instruction only checks whether staking_pool.first_stake_timestamp == 0 || Clock::get()?.unix_timestamp > staking_pool.stake_window_end before allowing execution. This also permits restarting the staking window once the original period has elapsed. Since the intended design goal is to enforce a unique, single-use staking window, this behavior introduces inconsistencies and potential vulnerabilities by allowing multiple windows to exist sequentially when only one should ever be valid.

To address this issue and prevent inconsistent staking states caused by combining emergency_pause and start_stake_window, it is recommended to implement one of the following measures:

• Remove the ability to restart a staking window, eliminating checks where the stake_window_end is validated to be exceeded. In this case, consider removing the emergency_pause instruction as well, if it is not needed or expected to be used.

• If a restart is required, introduce a stake_window_id stored in both pool and user stake accounts, ensuring enroll_in_bonus and unstake_tokens validate against the correct window ID.

This ensures users cannot bypass bonus eligibility or early-unstake rules when windows are reset.

SOLVED: The QuStream team solved this issue by removing the emergency_pause instruction and by removing the check in start_stake_window that required stake_window_end to have been exceeded.

The unstake_tokens instruction allows users who have previously staked tokens without enrolling in the bonus program to withdraw their stake. If the unstake is performed before the principal unlock date, a penalty is applied: 20% if the unlock time is within 10 days, or 30% if it is within 20 days.

The instruction requires the user to specify the amount to be unstaked and correctly enforces an upper bound check to ensure that this amount does not exceed the user’s recorded stake. However, it does not enforce a lower bound check to guarantee that the amount is greater than zero. As a result, users can submit an unstake request with a value of 0.

While this has no effect on their stake balance, the transaction still executes successfully, unnecessarily consuming compute resources and forcing the user to pay transaction fees without any meaningful outcome.

programs/qst-staking/src/lib.rs

pub fn unstake_tokens(ctx: Context<UnstakeTokens>, amount: u64) -> Result<()> {
        let stake_account = &mut ctx.accounts.stake_account;
        let staking_pool = &mut ctx.accounts.staking_pool;

        require!(stake_account.amount >= amount, ErrorCode::InsufficientStakeBalance);

        // Block unstaking completely for bonus enrolled users
        require!(!stake_account.enrolled_in_bonus, ErrorCode::BonusEnrolledCannotUnstake);

        let current_time = Clock::get()?.unix_timestamp;
        let time_until_unlock = stake_account.principal_unlock_time - current_time;

        // Early exit options (relative to current principal unlock date)
        let (penalty_amount, net_amount) = if time_until_unlock <= 0 {
            // Unlocked: No penalty
            (0u64, amount)
        } else if time_until_unlock <= EARLY_UNSTAKE_THRESHOLD_1 {
            // 10—0 days remaining: 20% penalty
            let penalty = ((amount as u128) * (PENALTY_RATE_LATE as u128) / 100u128) as u64;
            (penalty, amount - penalty)
        } else if time_until_unlock <= EARLY_UNSTAKE_THRESHOLD_2 {
            // 20—10 days remaining: 30% penalty
            let penalty = ((amount as u128) * (PENALTY_RATE_EARLY as u128) / 100u128) as u64;
            (penalty, amount - penalty)
        } else {
            // More than 20 days remaining: Unstake blocked
            return Err(ErrorCode::UnstakeBlocked.into());
        };

To address this issue, it is recommended to add a validation to ensure the zero value amount cannot be unstaked.

SOLVED: The QuStream team solved this issue by introducing a validation to require that the provided amount value is greater than 0.

Several fragments of code in the staking program contain redundant or duplicated validations. For instance, the second check (bonus_enrollment_deadline > 0) in the enroll_in_bonus instruction is unnecessary because it is implicitly guaranteed by the first condition: if current_time <= bonus_enrollment_deadline, then bonus_enrollment_deadline must be greater than zero (given that current_time cannot be negative in this context).

programs/qst-staking/src/lib.rs

pub fn enroll_in_bonus(ctx: Context<EnrollInBonus>) -> Result<()> {
        let staking_pool = &mut ctx.accounts.staking_pool;
        let stake_account = &mut ctx.accounts.stake_account;

        let current_time = Clock::get()?.unix_timestamp;

        // Check if bonus enrollment is still open
        require!(
            current_time <= staking_pool.bonus_enrollment_deadline,
            ErrorCode::BonusEnrollmentClosed
        );
        require!(
            staking_pool.bonus_enrollment_deadline > 0,
            ErrorCode::StakeWindowNotStarted
        );

Similar redundant validations have been detected in other instructions, such as withdraw_all, get_stake_info and unstake_tokens.

While this does not introduce a functional vulnerability, the redundancy increases code complexity and maintenance overhead.

let mut bonus_rewards = 0u64;

        // Calculate bonus rewards if enrolled and bonus period ended
        if stake_account.enrolled_in_bonus && current_time >= stake_account.bonus_unlock_time {
            if staking_pool.total_enrolled_stake > 0 && staking_pool.penalty_vault_amount > 0 {
                // Use u128 to prevent overflow in proportional calculation
                let pv = staking_pool.penalty_vault_amount as u128;
                let user_amt = stake_account.amount as u128;
                let total = staking_pool.total_enrolled_stake as u128;
                bonus_rewards = if total > 0 { ((pv * user_amt) / total) as u64 } else { 0 };
                
                staking_pool.penalty_vault_amount =
                    staking_pool.penalty_vault_amount.saturating_sub(bonus_rewards);
            }

  pub fn get_stake_info(ctx: Context<GetStakeInfo>) -> Result<StakeInfo> {
        let stake_account = &ctx.accounts.stake_account;
        let staking_pool = &ctx.accounts.staking_pool;

        // Calculate potential bonus (simple pro-rata preview)
        let potential_bonus = if stake_account.enrolled_in_bonus && staking_pool.total_enrolled_stake > 0 {
            let pv = staking_pool.penalty_vault_amount as u128;
            let user_amt = stake_account.amount as u128;
            let total = staking_pool.total_enrolled_stake as u128;
            if total > 0 { ((pv * user_amt) / total) as u64 } else { 0 }
        } else {
            0
        };

        require!(!stake_account.enrolled_in_bonus, ErrorCode::BonusEnrolledCannotUnstake);

        let current_time = Clock::get()?.unix_timestamp;
        let time_until_unlock = stake_account.principal_unlock_time - current_time;

        // Early exit options (relative to current principal unlock date)
        let (penalty_amount, net_amount) = if time_until_unlock <= 0 {
            // Unlocked: No penalty
            (0u64, amount)
        } else if time_until_unlock <= EARLY_UNSTAKE_THRESHOLD_1 {
            // 10—0 days remaining: 20% penalty
            let penalty = ((amount as u128) * (PENALTY_RATE_LATE as u128) / 100u128) as u64;
            (penalty, amount - penalty)
        } else if time_until_unlock <= EARLY_UNSTAKE_THRESHOLD_2 {
            // 20—10 days remaining: 30% penalty
            let penalty = ((amount as u128) * (PENALTY_RATE_EARLY as u128) / 100u128) as u64;
            (penalty, amount - penalty)
        } else {
            // More than 20 days remaining: Unstake blocked
            return Err(ErrorCode::UnstakeBlocked.into());
        };

        let user_token_account = &ctx.accounts.user_token_account;
        let pool_token_account = &ctx.accounts.pool_token_account;

        // Setup PDA signer
        let authority_seed = b"staking_pool";
        let bump_bytes = [staking_pool.bump];
        let signer_seeds = &[authority_seed.as_ref(), bump_bytes.as_ref()];
        let signer = &[signer_seeds.as_ref()];

        // Transfer net amount to user
        if net_amount > 0 {
            let cpi_accounts = Transfer {
                from: pool_token_account.to_account_info(),
                to: user_token_account.to_account_info(),
                authority: staking_pool.to_account_info(),
            };
            let cpi_program = ctx.accounts.token_program.to_account_info();
            let cpi_ctx = CpiContext::new_with_signer(cpi_program, cpi_accounts, signer);
            token::transfer(cpi_ctx, net_amount)?;
        }

        // Add penalty to the penalty vault (stays in pool for enrolled users)
        if penalty_amount > 0 {
            staking_pool.penalty_vault_amount = staking_pool
                .penalty_vault_amount
                .checked_add(penalty_amount)
                .ok_or(ErrorCode::NumericOverflow)?;
        }

        // If enrolled, reduce the enrolled pool weight by the amount being unstaked
        if stake_account.enrolled_in_bonus {
            staking_pool.total_enrolled_stake = staking_pool
                .total_enrolled_stake
                .saturating_sub(amount);
        }

To address this issue, consider removing redundant validations and maintaining only the necessary checks.

PARTIALLY SOLVED: The QuStream team partially solved this issue by removing the redundant parts found in enroll_in_bonus and get_stake_info instructions.