DeFi, payments, tokenization, Soroban, governance, and project launches — curated daily from publications, project blogs, and community channels across the Stellar blockchain ecosystem.
Normal rebuilt its core infrastructure over summer to support 100k+ users. Portfolio loading improved 61x (22 seconds to 0.36 seconds), test coverage jumped from zero to 566 automated tests, and unauthenticated API routes dropped from 18 to zero. Cross-chain swaps now require one signature instead of up to four.
Arcane and Predicate are building complementary infrastructure for private financial applications on Stellar. The piece explains how these platforms handle compliance before, during, and after private transactions: pre-screening participants, applying policy over time, responding when risk changes, and providing governed access to confidential evidence when investigation or disclosure is required.
Firelight Protocol raised $8 million to provide DeFi exploit protection for fintechs moving yield products on-chain. The protocol expands backing collateral from XRP to Bitcoin and Stellar's XLM, with a 10-day claims settlement model designed for institutional adoption.
Certora compared three Soroban security tools—Sunbeam (formal verifier), Komet (hybrid fuzzing/proving), and cargo-fuzz—on detecting bugs and proving correctness. Fuzzing found obvious failures quickly but missed rare edge cases. Sunbeam detected all bugs and proved correct code was mathematically sound.
On August 25, an attacker exploited a Comet smart contract bug that failed to verify token inputs in swap functions, extracting 717,518 USDC from the BLND-USDC liquidity pool. Community white hats quickly recovered 190k USDC and 23M BLND before copycat attacks. Script3 is leading recovery and remediation efforts; Blend protocol lending continues but backstop deposits are at risk due to the non-upgradeable LP token.
A Trustless Work engineer took second place at Stellar Summit for a testnet POC combining Confidential Tokens with escrow infrastructure. Green Road emerged as a personal learning project exploring privacy-preserving payment mechanics — specifically, what balances can hide versus what relationships remain visible. The work surfaces important trade-offs around selective disclosure and transaction correlation that future privacy-escrow designs must address.
Three major institutions are joining Stellar as Tier 1 validators: MoneyGram (payments), Figure (RWA stablecoins), and Range (compliance services). Despite earning zero block rewards or staking yields, they're validating because their core businesses depend on Stellar's decentralized governance model and security.
Nethermind optimized Noir UltraHonk verification for Soroban by moving cryptographic operations from guest WASM to Protocol 25/26 native host functions. The result: 64% reduction in CPU instructions, verification fees cut from 0.23 to 0.09 XLM, and shielded-pool applications now feasible.
Zarf is a token distribution protocol that lets users claim distributions using only an email address and zero-knowledge proofs, eliminating wallet creation friction. Trion Labs made deliberate technical choices—zkJWT over zkEmail, Noir over Circom, Protocol 25 BN254 functions—that prioritize user experience without sacrificing privacy.
Stablecoin and payment volumes on Stellar have reached a point where fintech companies must choose: use public-chain settlement or protect sensitive business data. Compliance-ready privacy (transactions private by default with scoped, auditable disclosure for regulators) is now a business requirement. Arcane Finance is building that infrastructure layer on Stellar.
Institutional finance requires privacy on-chain: traders can't broadcast positions, strategies, or counterparties without inviting front-running. OpenZeppelin examines three approaches—private permissioned networks like Canton, confidential tokens using FHE or zero-knowledge proofs, and privacy overlays on existing chains—each with different tradeoffs in complexity, composability, and regulatory auditability.
DFNS introduces Transaction Screening, which catches address poisoning attacks before transfers. Address poisoning exploits wallet copy-paste: attackers generate lookalike addresses matching visible characters, then plant them in transaction history via dust transfers. A Carnegie Mellon study found 270 million such attacks draining $83.8 million, often targeting institutional wallets. DFNS's lookalike detection flags addresses with matching visible prefixes or suffixes, informed by Carnegie Mellon research. The feature scopes per wallet, warns without blocking, and keeps repeat destinations unaffected.
K2 launches on Stellar with lending infrastructure built for regulated assets and institutions. Offers pooled markets for broad liquidity, isolated markets for new assets, and new gated markets for whitelisted institutional participants. Audited by Halborn, Watchpug, Code4rena; monitored by Hypernative for threats.
SDF publishes security standards for Stellar DeFi protocols, defining audit, disclosure, risk management, and governance requirements as the ecosystem scales from experimental to production. The standards include audits before user funds, bug bounties, capital buffers, and emergency pause controls, reflecting practices mature DeFi teams already use elsewhere, adapted for Stellar.
Range begins operating a Tier 1 validator on Stellar alongside MoneyGram and Figure Markets, expanding the network's consensus infrastructure. As a platform securing $30 billion in stablecoin and fiat activity across 200+ blockchains, Range brings its security and monitoring expertise directly to Stellar's consensus layer.
Three major institutions—MoneyGram, Figure Markets, and Range—have joined as Tier 1 validators on the Stellar network, expanding decentralization and resilience of its core consensus infrastructure. All three operate real businesses on Stellar and maintain a direct stake in the network's long-term security and neutrality.
Nethermind ships Stellar Private Payments, a privacy protocol combining confidential transfers with compliance safeguards. Identity-level access controls enforce KYC-gated participation and account-level freeze capability, while selective disclosure lets users prove ownership to auditors. Live on testnet, open source, featured on PSE's Private Transfers Dashboard.
Lusty Finance is evolving an options protocol on Stellar from a working testnet version to a fully trustless architecture on mainnet. With Stellar Community Fund backing, the team is migrating collateral, settlement, and premium distribution from backend servers to Soroban smart contracts, using Reflector oracles for price feeds. Already live on testnet with 211 connected wallets and $1,500 in real user premiums paid.
OpenZeppelin and T-REX Network partner to advance institutional compliance infrastructure. The collaboration includes hardening the T-REX Protocol, evolving ONCHAINID, delivering ERC-3643 as an audited OpenZeppelin Contracts library component, and expanding to non-EVM networks with a Stellar-native implementation already complete.
Q2 of the Stellar Community Fund Public Goods Award wrapped with 17 projects funded and over USD 400,000 disbursed via privacy-preserving on-chain voting. This was the first round where award voting ran as encrypted on-chain governance using Tansu's governance infrastructure on Stellar.
The Notorious Bug Digest #9 dissects three critical blockchain vulnerabilities: a rule selection downgrade in Stellar smart account authorization, a ZK circuit misconstraint that halts privacy protocols, and signed-integer bit-smuggling in perpetuals. Detailed code analysis and remediation guidance for developers.
Stellar introduces Confidential Tokens, a privacy layer for SEP-41 tokens built by OpenZeppelin and Nethermind. The wrapper contract architecture hides balances and transfer amounts via zero-knowledge proofs while keeping addresses visible—designed for institutional use cases like payroll and treasury management. Testnet live now.
Almanax, an AI-powered smart contract auditor that has worked on Stellar, Solana, and Aptos, joins depthfirst. The acquisition positions depthfirst to become the leading product security platform for enterprises.
Drips Wave 6 launches with smarter contributor dashboard defaults, improved issue review automation, repo application limits (5 per wave + KYC requirement), and performance improvements. The new dashboard surfaces relevant issues at launch, while the bot now catches CI/CD gaps and avoids stale pull requests.
Arrel achieved ISO 27001 and SOC 2 Type II certification, received a Circle grant to integrate CCTP for native USDC settlement, and partnered with Sodot to add threshold signature MPC technology. The upgrades position Arrel as mature institutional infrastructure for cross-chain digital assets on Stellar and other networks.
