Stellar Ecosystem
News

Stellar introduces Confidential Tokens, a privacy layer for SEP-41 tokens built by OpenZeppelin and Nethermind. The wrapper contract architecture hides balances and transfer amounts via zero-knowledge proofs while keeping addresses visible—designed for institutional use cases like payroll and treasury management. Testnet live now.

Q2 of the Stellar Community Fund Public Goods Award wrapped with 17 projects funded and over USD 400,000 disbursed via privacy-preserving on-chain voting. This was the first round where award voting ran as encrypted on-chain governance using Tansu's governance infrastructure on Stellar.

The Notorious Bug Digest #9 dissects three critical blockchain vulnerabilities: a rule selection downgrade in Stellar smart account authorization, a ZK circuit misconstraint that halts privacy protocols, and signed-integer bit-smuggling in perpetuals. Detailed code analysis and remediation guidance for developers.

Drips Wave 6 launches with smarter contributor dashboard defaults, improved issue review automation, repo application limits (5 per wave + KYC requirement), and performance improvements. The new dashboard surfaces relevant issues at launch, while the bot now catches CI/CD gaps and avoids stale pull requests.

Arrel achieved ISO 27001 and SOC 2 Type II certification, received a Circle grant to integrate CCTP for native USDC settlement, and partnered with Sodot to add threshold signature MPC technology. The upgrades position Arrel as mature institutional infrastructure for cross-chain digital assets on Stellar and other networks.

OtterSec researchers discovered critical vulnerabilities in React Native WebView and similar mobile wallet libraries. Missing origin isolation allows malicious dApps to access camera, GPS, and other permissions without user consent, affecting over 20 production wallets across the ecosystem.

OctoPos RMS, a real-time DeFi risk monitoring system built by crediolabs, went live on Stellar to monitor Blend's lending pools. The tool detects oracle anomalies and health risks, addressing an operational gap as institutional capital moves on-chain.

Protocol 25 and 26 introduced zero-knowledge primitives (BN254, Poseidon) that make private payment systems practical on Stellar. Arcane is building production infrastructure for compliance-ready privacy, enabling builders to protect sensitive financial flows on public rails while maintaining clear disclosure and reporting paths.

The Stellar Development Foundation announced a three-stage roadmap to migrate the network to post-quantum cryptography by 2027+. Quantum computers will eventually break the elliptic curve cryptography securing blockchains. Stellar's separation of account identity from signing keys avoids disruptive address migration unlike Bitcoin and Ethereum.

Stellar Security Portal redesigned for June 2026 with threaded comments on vulnerability reports, community ratings for protocols and auditors, and major performance improvements. Contributor access expanded beyond the Pilot tier, allowing SCF members and navigators to add and edit audits. The portal now tracks nearly 700 vulnerabilities ecosystem-wide.

Homomorphic encryption enables computations on encrypted data without decryption—the results match plaintext outcomes. For enterprise and tokenized real-world assets, this unlocks confidential balances, compliance checks, and transaction logic that stays hidden from counterparties while the network coordinates outcomes.

Nectar Network announced a $75K Build award from SCF #42 for its liquidation protocol on Soroban. The keeper network replaces single-operator liquidation bots with pooled capital and competing staked operators, removing a systemic risk point in lending markets. Live on testnet.

EduNode explains zero-knowledge proofs on Stellar: cryptographic foundations, the three pillars of ZK, and five real-world use cases from private transactions to off-chain computation. Privacy Pools on Soroban are under development.

Shopify and Stripe now accept USDC at checkout, but stablecoin payments expose sensitive data: amounts, wallets, merchant relationships, and repeat purchase patterns. Fairblock addresses this gap by providing a modular encryption SDK that preserves payment privacy without requiring new wallets, bridges, or payment networks.

Blockaid and Stellar validators contained a $10M oracle-manipulation attack on Blend lending protocol. An attacker inflated USTRY's price 100x via low-liquidity Reflector oracle feeds, borrowed $61M XLM using fraudulent collateral, and began bridging funds. Validators coordinated in real-time to quarantine ~48M XLM onchain before further damage.

CertiK explores two critical vulnerabilities in Soroban contract state storage: storing long-term data in Temporary storage risks irreversible loss when entries expire; relying on TTL expiry alone for nonce validation enables signature replay attacks. The article walks through vulnerable code patterns and secure alternatives using Persistent and Instance storage.

Stellar introduces CAP-77 Quorum Freeze, the first protocol-native onchain account freeze mechanism on a major L1 blockchain. Validators can reach consensus to freeze attacker addresses in minutes without chain halts or emergency upgrades, with full auditability and reversibility built into the ledger.

Soundness deployed the only post-quantum signature migration strategy that scores YES on all four properties in Coinbase's Independent Advisory Board report. The approach uses zero-knowledge proofs of seed knowledge to enable quantum-safe wallets without address changes, asset migration, or hard forks.

Kuyfi, a black-box security scanner for Soroban smart contracts, launches its first phase. It analyzes contract bytecode without requiring source code, addressing a critical gap in DeFi security for protocols like Soroswap and Blend.

Certora and the Stellar Development Foundation published a comprehensive guide for preparing Soroban smart contracts for security audits through the Audit Bank program, covering threat modeling, code quality, testing, and security tooling.

OpenZeppelin's Role Manager uses SubQuery's decentralized indexing to provide a unified interface for managing smart contract access control across 30+ networks, including Stellar mainnet and testnet, eliminating fragmented manual processes.

Quantum computing progress has accelerated the timeline for cryptographic threats to blockchain. Research shows qubit requirements to break elliptic curve cryptography fell 44%, Google targets 2029 for quantum-safe systems, and major chains face a race condition during migration that leaves zero margin for error.

LumosCore launches Private Mode, allowing users to mask their identity while trading across Stellar, XRPL, and other supported networks. The feature lets traders toggle privacy on or off instantly, hiding usernames from public feeds and reducing exposure to wallet watching and social engineering.

This article explores the privacy paradox on public blockchains, examining how transparent networks can enable confidential transactions while maintaining compliance. It identifies 'self-doxxing' as the core privacy problem and discusses potential solutions involving issuers and privacy providers.