Stellar Ecosystem
News

OtterSec researchers discovered critical vulnerabilities in React Native WebView and similar mobile wallet libraries. Missing origin isolation allows malicious dApps to access camera, GPS, and other permissions without user consent, affecting over 20 production wallets across the ecosystem.

OctoPos RMS, a real-time DeFi risk monitoring system built by crediolabs, went live on Stellar to monitor Blend's lending pools. The tool detects oracle anomalies and health risks, addressing an operational gap as institutional capital moves on-chain.

Protocol 25 and 26 introduced zero-knowledge primitives (BN254, Poseidon) that make private payment systems practical on Stellar. Arcane is building production infrastructure for compliance-ready privacy, enabling builders to protect sensitive financial flows on public rails while maintaining clear disclosure and reporting paths.

The Stellar Development Foundation announced a three-stage roadmap to migrate the network to post-quantum cryptography by 2027+. Quantum computers will eventually break the elliptic curve cryptography securing blockchains. Stellar's separation of account identity from signing keys avoids disruptive address migration unlike Bitcoin and Ethereum.

Stellar Security Portal redesigned for June 2026 with threaded comments on vulnerability reports, community ratings for protocols and auditors, and major performance improvements. Contributor access expanded beyond the Pilot tier, allowing SCF members and navigators to add and edit audits. The portal now tracks nearly 700 vulnerabilities ecosystem-wide.

Homomorphic encryption enables computations on encrypted data without decryption—the results match plaintext outcomes. For enterprise and tokenized real-world assets, this unlocks confidential balances, compliance checks, and transaction logic that stays hidden from counterparties while the network coordinates outcomes.

Nectar Network announced a $75K Build award from SCF #42 for its liquidation protocol on Soroban. The keeper network replaces single-operator liquidation bots with pooled capital and competing staked operators, removing a systemic risk point in lending markets. Live on testnet.

EduNode explains zero-knowledge proofs on Stellar: cryptographic foundations, the three pillars of ZK, and five real-world use cases from private transactions to off-chain computation. Privacy Pools on Soroban are under development.

Shopify and Stripe now accept USDC at checkout, but stablecoin payments expose sensitive data: amounts, wallets, merchant relationships, and repeat purchase patterns. Fairblock addresses this gap by providing a modular encryption SDK that preserves payment privacy without requiring new wallets, bridges, or payment networks.

Blockaid and Stellar validators contained a $10M oracle-manipulation attack on Blend lending protocol. An attacker inflated USTRY's price 100x via low-liquidity Reflector oracle feeds, borrowed $61M XLM using fraudulent collateral, and began bridging funds. Validators coordinated in real-time to quarantine ~48M XLM onchain before further damage.

CertiK explores two critical vulnerabilities in Soroban contract state storage: storing long-term data in Temporary storage risks irreversible loss when entries expire; relying on TTL expiry alone for nonce validation enables signature replay attacks. The article walks through vulnerable code patterns and secure alternatives using Persistent and Instance storage.

Stellar introduces CAP-77 Quorum Freeze, the first protocol-native onchain account freeze mechanism on a major L1 blockchain. Validators can reach consensus to freeze attacker addresses in minutes without chain halts or emergency upgrades, with full auditability and reversibility built into the ledger.

Soundness deployed the only post-quantum signature migration strategy that scores YES on all four properties in Coinbase's Independent Advisory Board report. The approach uses zero-knowledge proofs of seed knowledge to enable quantum-safe wallets without address changes, asset migration, or hard forks.

Kuyfi, a black-box security scanner for Soroban smart contracts, launches its first phase. It analyzes contract bytecode without requiring source code, addressing a critical gap in DeFi security for protocols like Soroswap and Blend.

Certora and the Stellar Development Foundation published a comprehensive guide for preparing Soroban smart contracts for security audits through the Audit Bank program, covering threat modeling, code quality, testing, and security tooling.

OpenZeppelin's Role Manager uses SubQuery's decentralized indexing to provide a unified interface for managing smart contract access control across 30+ networks, including Stellar mainnet and testnet, eliminating fragmented manual processes.

Quantum computing progress has accelerated the timeline for cryptographic threats to blockchain. Research shows qubit requirements to break elliptic curve cryptography fell 44%, Google targets 2029 for quantum-safe systems, and major chains face a race condition during migration that leaves zero margin for error.

LumosCore launches Private Mode, allowing users to mask their identity while trading across Stellar, XRPL, and other supported networks. The feature lets traders toggle privacy on or off instantly, hiding usernames from public feeds and reducing exposure to wallet watching and social engineering.

This article explores the privacy paradox on public blockchains, examining how transparent networks can enable confidential transactions while maintaining compliance. It identifies 'self-doxxing' as the core privacy problem and discusses potential solutions involving issuers and privacy providers.

YieldBlox lost $10.97 million on Blend V2 when an attacker manipulated the price of USTRY collateral 100x using a single trade in an illiquid market, then borrowed against the inflated valuation. The oracle reported the manipulated price accurately, but the protocol had no safeguards for detecting market anomalies or liquidity thresholds.

Normal Finance completed a comprehensive security audit with Halborn, emphasizing that security must be a foundational design principle rather than a launch checkbox. The protocol prioritized clarity and modularity from inception to manage the elevated risks of index protocols handling pooled capital.

This article compares Proof-of-Stake consensus models with Stellar's Consensus Protocol (SCP), arguing that PoS networks create structural incentives for MEV extraction and validator misconduct, while Stellar's explicit trust model and revocable authority provide better protection for regulated asset issuers.

Chainalysis expanded its blockchain monitoring platform to support Stellar tokens, enabling automatic coverage for fungible and non-fungible tokens deployed to the network. The integration includes KYT alerts, entity screening, and transaction investigation tools for tracking fund flows and identifying illicit activity.

This article explains the Stellar Consensus Protocol (SCP) and its innovative use of quorum slices and Federated Byzantine Agreement (FBA) to achieve decentralized consensus. It details how SCP enables Stellar to operate with high security, low costs, and high performance while promoting organic network growth through open participation.