Install and enable

Turning the Staking addon on — the extension flag, the hourly cron, permissions, KYC gates and the Super Admin the fee collector depends on.

10 min readUpdated 26 August 2026install, extension, cron, permissions, kyc

Staking is installed from inside the admin panel. There is no archive to extract by hand and no migration to run by hand — the Extension Manager downloads the release and pnpm updator applies it. What you do have to do is activate the licence, install the release, switch the addon on, confirm the scheduled task exists, and hand out the permissions.

Do core install first. Staking assumes a working platform with wallets and a running cron process.

Turn the extension on

The Staking Crypto card — click it to open the product page
Its switch stays disabled until the licence is activated

Open the Extension Manager — sign in as an administrator and go to Admin → System → Extension Manager (/admin/system/extension; the page heading is Add-ons & Integrations). You need the edit.extension permission; Super Admin has it. On the Extensions tab, or by searching for Staking, find the Staking Crypto card — product ID 37434481 — and click it. Until its licence is activated the card's chip reads Activate and its switch is disabled with the tooltip Activate license first.
Activate the licence. On the product page press Activate License. Paste the purchase code from your MashDiv dashboard, optionally add a Notification Email for update notifications, and press Activate License; the screen confirms License Activated! and returns you to the product page a couple of seconds later. If the server has no outbound access, the License File tab on the same screen takes the licence certificate downloaded from your MashDiv dashboard instead — place it as license.txt in the /lic folder at the project root, then press the button on that tab.
1. Paste the purchase code here
2. Activate License — then wait for the redirect back to the product page
3. License File — the offline route, for a server with no outbound HTTPS
Install the release. Back on the product page, now licensed, the Overview tab has a release panel. If it offers Install v…, press it; if it says Up to date on a product you have only just licensed, press Check for Updates once, then install whatever it offers. The Releases tab holds the notes for the version you are being offered — read them first.

Install downloads the release, verifies it and extracts it over the project root. It runs no migrations, builds nothing and restarts nothing, so finish it from a shell on the server:
```
pnpm updator
```
That is the finalise chain — stop, dependencies, schema, seed data, frontend build, start — and it is what makes the staking tables, routes and screens exist. If the panel still says Up to date after the check there is nothing to download; go straight to the next step.
1. Check for Updates, then Install v… when it is offered
2. Releases — the notes for the version you are about to install
3. The Enabled switch — step 4, not yet
Switch it on. Turn the Enabled switch on — in the product page heading, or on the card in the Extension Manager, which is usable now that the licence is verified. This is what makes Staking Services appear under Admin → Extensions and Staking Rewards appear in the user navigation; until it is on, neither exists. It takes effect without a restart — reload the admin panel and both menus are there.

If the toggle animates on and then reverts on reload, the update threw. Check the backend log for EXTENSION. Earlier builds returned a 200 with an error key in the body, which the frontend read as success — the switch stayed on screen while the addon never actually came on. That is fixed, but an old install can still show it.

Confirm the scheduled task

Everything automatic in this product is one cron entry.

The task is registered as processStakingPositions under the staking category, with a period of one hour. Its title on screen is Process Staking Logs. It accrues due rewards and settles matured positions.

Go to /admin/system/cron and confirm Process Staking Logs is listed and running. It executes once an hour on the dedicated cron process (port 4001), not on the API process.

The cron is the only thing that returns principal at the end of a lock period. If it is not running, matured positions sit at ACTIVE forever, users' money stays locked past the term they agreed to, and the admin overview will start counting them under stale matured after 24 hours. This is a breach of the agreement the user accepted when they staked, not a cosmetic delay.

The task is safe to run repeatedly and safe to retry. Accrual is delta-based against a per-position watermark and every write is keyed to a distribution period, so a run that overlaps a previous one credits nothing twice.

Make sure a Super Admin exists

Both staking fees — the admin fee on rewards and the early-withdrawal fee on principal — are collected by crediting the wallet of the oldest user holding the Super Admin role.

If there is no Super Admin role, or the role exists with no users, the fee collector logs [CRITICAL] No Super Admin ... platform fees are being dropped and returns nothing. The staking code then deliberately skips writing the bookkeeping row, so your earnings screen stays honest — but the revenue is gone and there is no retry.

One more consequence worth knowing: when the actor performing a fee-bearing action is the Super Admin, the fee is skipped entirely rather than credited back to themselves. Testing distributions from the Super Admin account will show zero platform fees. That is correct behaviour, not a bug.

Grant the permissions

Open the role that will run staking

Thirty-seven keys control the addon: nineteen for the fixed-rate product and eighteen for the on-chain consoles. Assign them at /admin/crm/role.

Key	Opens
`access.staking`	The admin overview and the solvency dashboard endpoint
`access.staking.pool` · `view.staking.pool`	The pool list and pool detail
`create.staking.pool` · `edit.staking.pool` · `delete.staking.pool`	Creating, editing, reordering and deleting pools
`access.staking.position` · `view.staking.position`	The position table
`create.staking.position` · `edit.staking.position` · `delete.staking.position`	Position edits, approving or rejecting withdrawals, terminal transitions
`access.staking.earning` · `view.staking.earning`	The earnings desk
`create.staking.earning` · `edit.staking.earning`	Both distribute endpoints and claiming an admin earning row
`view.staking.performance` · `create.staking.performance`	External pool performance records
`view.staking.activity`	The staking admin activity log
`access.staking.settings`	The staking settings screen
`access.staking.chain` · `view.staking.chain` · `create.staking.chain` · `edit.staking.chain`	The Chains screen and chain activations (activate and retire also need Super Admin)
`access.staking.wallet` · `view.staking.wallet` · `create.staking.wallet` · `edit.staking.wallet`	The staking wallets (create, freeze and unfreeze also need Super Admin)
`access.staking.validator` · `view.staking.validator` · `create.staking.validator` · `edit.staking.validator`	Validator sets and the screened candidate list
`access.staking.batch` · `view.staking.batch` · `edit.staking.batch`	The batch ledger and retry
`access.staking.incident` · `view.staking.incident` · `edit.staking.incident`	Incidents and the reconciler

edit.staking.position is the one that moves money: approving a withdrawal request settles the position and returns principal. Treat it as a finance-desk permission, not a support one. See Permissions for how a key maps to an admin path.

Set the KYC gates

Three feature gates apply, enforced server-side on the user endpoints:

Feature	Blocks	Enforced on
`view_staking`	Browsing staking opportunities	The user-facing surfaces
`invest_staking`	Opening a position	`POST /api/staking/position`
`withdraw_staking`	Claiming rewards and requesting a withdrawal	The claim and withdraw endpoints

Configure them with the rest of your verification levels in the KYC settings. Leaving them ungated is a deliberate choice, not an oversight — but note that withdraw_staking covers both leaving a position and claiming rewards, so gating it locks users out of money they have already earned until they verify.

Affiliate rewards

Two seeded referral conditions fire from staking, if you run the affiliate system:

STAKING — Staking Commission. Fires when a referred user opens a position, on the staked amount. Seeded at 2% and enabled.
STAKING_LOYALTY — Staking Loyalty Bonus. Fires once when a position completes, on the original principal. Seeded at 3% and disabled; enable it in the affiliate conditions screen if you want it.

Both are processed after the money transaction commits and are best-effort — a failure there is logged and never rolls back a stake or a settlement.

Verify the install

Work through this on a staging install before you publish a pool:

The Staking Crypto card at /admin/system/extension reads Verified and its switch is on
Staking Services appears under Extensions in the admin menu
Process Staking Logs is listed at /admin/system/cron and has run
A Super Admin user exists and is not the account you test with
Your admin role holds at least access.staking and view.staking.pool
/admin/staking loads without a permission error
/admin/staking/settings loads and shows the Platform and Earnings tabs
A test user can reach /staking and see the pool list

Then read Creating pools — a pool has more fields that cannot be changed later than fields that can.