I've created an app that includes a Stellar account creation as part of he sign up process. Someone is problematically creating accounts, which keeps draining my distribution account that I use to seed the account creation step with 1XLM.

How can I keep my app live and prevent this?

My login methods include Google, Facebook and email/password. The latest attack used the email/password option. The implementation is a Firebase one, and requires email verification.

2 Answers 2


When someone is programmatically creating accounts, the simple way to stop them is by increasing their cost of account creation. This problem is not only existent for you, but even my company also underwent such bot attacks, and invalid signups. So what can you do to check the authenticity of signup? and how exactly can you increase the costs for the program owner?

  1. Implement Captcha. Captcha solving is expensive for most of the attackers. So a captcha would for sure stop them creating random accounts on your site, and the best part of it is, you'll get the result almost immediately.
  2. Log the IP, check the Whois. Program some code which actually blocks usage of Datacenter IP addresses and forces the user not to use a VPN. Attackers don't get residential proxies for a cheaper price. So, if you do this alone, they would leave your site.
  3. Finally, if feasible for you, get new signups with a VPN flagged for a manual review and KYC. Because processing KYC for all your users won't be a viable option. If you ask KYC only for flagged ones, the volume of work would reduce.

Hope this answer helps you :)

  • Thanks for this advice. I thought about Captcha after posting my question. Number 2 is an interesting option. I'm going to investigate this further. I'm going to avoid 3 for now, given I'm still in beta, but will come back to it. Commented Jul 27, 2020 at 17:27

This is a really good questions and one without a specific "right" answer. It essentially boils down to what the most acceptable compromise is.

Either A) You force users to pay their base fee for account creation.
Or B) You live with the possibility of manipulation.
C) Some combination of the two.

Here are some possible compromises:

  1. Lobstr uses a loan repayment method where you "borrow" the base fee until you have enough XLM in your account to pay it back. In essence you have an unfunded account which doesn't really exist until you pay back the base fee from some external account.
  2. You maintain signing control over newly created accounts for a short period of time until you're able to prove the account is legitimate. (If the base fee is 5 XLM don't sign for txns which would take the balance below 5 XLM).
  3. Employ better unique personhood proofs. This one is the most difficult as at the end of the day it's just not that hard to spoof unique personhood without invasive KYC forms. Depending on your app though this may be an acceptable compromise.

Right now my ideal scenario is a spin on 2. involving a new in-progress SEP involving smart contracts and Turing Signing Servers. Essentially you'd write a smart contract which would lock up an account either indefinitely, for a period of time or until specific condition(s) were met. Some actions could be allowed but only through the Turing Signing Server. You'd maintain a custody free operation while still holding contractural control over newly created accounts.

You can watch this video to get a sense of what I'm talking about: https://youtu.be/T7FlHKbew4U

Hopefully that helps, I'm certainly happy to explain more or to help setup such a smart contract. You can find me on Keybase tyvdh.

  • I like approach number 2. Essentially the user earns their account through a sort of implicit KYC, such as a minimum number of in-app interactions. I stopped funding accounts (other than the base fee) and the bot(s) keep hammering my app. This means it's not even about the XLMs. I'm going to try a Captcha for now and then see if I need to take heavier handed in-app measures. I'll connect on Keybase to chat further. My app is Picl, btw. It was one of the latest SCF entrants. Commented Jul 27, 2020 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.