Add staking-vault skill — deploy your own ERC-4626 staking vault

[0xAxiom]

Summary

Generic, parameterized port of the StakedAxiom (xAXIOM) contract that any agent or project can lift, configure, and ship as a share-price-rebase staking vault for their own ERC-20.

Reward distribution = single stakeToken.transfer(vault, amount) call that rebases share price pro rata. No claim step, no reward debt, no per-holder gas. ERC-4626 spec-compliant so aggregator UIs (Yearn, Beefy, Morpho) work out of the box.

What's in the skill

• src/StakingVault.sol — ERC-4626 vault, ~200 lines. Aave-style two-step cooldown, JIT-resistant (cooldown rebases on inbound shares — defeats the "tiny-cooldown-then-huge-deposit" attack), inflation-attack hardened (_decimalsOffset = 6), Ownable2Step. Owner can adjust cooldown params (bounded ≤ 30 days / ≥ 1 day) and rescue non-stake tokens. Cannot mint, burn, pause, upgrade, or rescue the stake token.
• script/Deploy.s.sol — env-driven forge script (STAKE_TOKEN, OWNER, VAULT_NAME, VAULT_SYMBOL, optional COOLDOWN_PERIOD / WITHDRAW_WINDOW).
• test/StakingVault.t.sol — 24 forge tests, all passing on solc 0.8.28 with OZ 5.6.1. Covers share math, pro-rata rewards, cooldown gating, JIT regression, transfer-during-cooldown blocking, inflation-attack mitigation, and ERC-4626 maxRedeem / maxWithdraw spec compliance.
• scripts/init.sh — installs forge-std + OpenZeppelin/openzeppelin-contracts, builds, runs tests.
• scripts/deploy.sh — wraps forge script with .env loading; supports base / base_sepolia / mainnet.
• references/SECURITY.md — full audit findings (1 critical, 1 medium, 1 low accepted, 1 informational — all fixed and regression-tested).
• references/integration.md — reward-flow patterns (daily cron / streaming / governance), frontend display notes (convertToAssets for user balances, cooldownStatus for UI state machine), operational checklist.

Reference deployment

Originally deployed as xAXIOM on Base. Live frontend at https://clawbots.org/stake. This skill is the public, generalized port — name and symbol lifted to constructor args so any project can spin up their own xToken with their own ticker/cooldown.

Test plan

• forge build clean on solc 0.8.28
• forge test -vv — 24/24 passing
• Reward distribution test confirms pro-rata share-price rebase (10/30/60 split → 200/600/1200 after 1000 reward)
• JIT attack regression: tiny-cooldown + huge mid-cooldown deposit reverts on redeem
• Inflation attack regression: 1-wei seed + 1000-token donation, victim's 100-token deposit redeems > 99 tokens
• Transfer-during-cooldown blocked (sender-side guard)
• maxRedeem / maxWithdraw spec-compliant (0 outside withdraw window)
• Owner cannot rescue stake token
• Owner cannot extend cooldownPeriod beyond MAX_COOLDOWN = 30 days or set withdrawWindow below MIN_WITHDRAW_WINDOW = 1 day
• Manual deploy to Base Sepolia via bash scripts/deploy.sh base_sepolia (requires deployer-side .env — not part of CI)

🤖 Generated with Claude Code