Skip to main content
15 votes
Accepted

Why is Stellar on HTTP and not HTTPS?

As you can see from the developer documentation, SDF does serve both Horizon instances through HTTPS. When they say "RESTful HTTP API" it's to signal to developers that they use standard web ...
Francesco's user avatar
  • 1,386
12 votes
Accepted

How to find the public key given only the seed?

Java Script let StellarSdk = require("stellar-sdk"); let keypair = StellarSdk.Keypair.fromSecret("S..."); console.log(keypair.publicKey()); http://stellar.github.io/js-stellar-sdk/Keypair.html#....
Bartek Nowotarski's user avatar
11 votes
Accepted

How do I use the flag: authorization revocable

Haven't tested it myself, but here is quote form Stellar documentation: Controlling asset holders As an anchor, you can mark the issuing account AUTHORIZATION REQUIRED. With this setting, the ...
Orbit Lens's user avatar
  • 6,886
9 votes
Accepted

What is the Safest Way for Users to Sign Transactions Over the Web?

You are right, the scheme you described is far from being secure. User should sign the transaction on the client-side. I can see three options for your case: Build and sign the transaction in the ...
Orbit Lens's user avatar
  • 6,886
8 votes
Accepted

How many public addresses can be generated for a stellar public key?

1) As per Orbit Len's comment: Stellar uses ED25519 keypairs. There is only one public key that matches the given secret key. Source 2) Here is an example for bitcoin and someone trying to guess your ...
pantheon52's user avatar
8 votes
Accepted

Securing Stellar node

TL;DR: only expose port 11625 on stellar-core. Stellar Core Port 11625 Port 11625 of stellar-core must be exposed outside your network to allow it to communicate with peers. The stellar-core ...
nikhils's user avatar
  • 1,080
7 votes

How many public addresses can be generated for a stellar public key?

Going by the actual source code, there are 32 secret keys that generate the exact same public key -- only 251 bits of the seed hash are used in the elliptic curve exponentiation. For signing, another ...
Johan Stén's user avatar
  • 1,947
7 votes
Accepted

Storing Secret Key for Smart Contracts

Generally speaking, if you're owning all the accounts and everyone trusts you then I'd suggest adding your own private keys to the accounts instead of taking theirs. If you add your own key that is ...
MikeFair's user avatar
  • 396
7 votes
Accepted

Can an inflation pool be hacked to send all weekly lumens to 1 address? [third-party]

In short, yes. The inflation pool wallet can be hacked just like any other crypto wallet can be hacked. You would need the private key. Thus, the security implications are the same and it is up to the ...
Nekrataal's user avatar
  • 1,009
7 votes

How does Stellar solve the problem of "double-spending"?

Double spending in Stellar is dealt with at two layers: SCP guarantees that the "blockchain" (ledger chain really) is made of only one chain, and doesn't have forks (in other systems temporary forks ...
MonsieurNicolas's user avatar
7 votes

How does Stellar solve the problem of "double-spending"?

The digital currency is an Asset on Stellar's public ledger only. You can not download it, clone it and spent it again. It exists as a balance on an account that can be transferred to another account ...
alpe1's user avatar
  • 1,300
5 votes

Web Wallet requirements

Something you could do is to host the site directly on github pages so users can inspect the code as well as clone the wallet and run it locally. A project that has implemented this is Ark whose ...
Andrei Savin's user avatar
4 votes
Accepted

How to find a secure wallet

The security considerations for choosing a Stellar Wallet is same as the ones you consider when storing other crypto assets. Make sure you install an open source client/wallet whose code is audited ...
SeaWarrior404's user avatar
4 votes
Accepted

Secured ways to check if a node is up working?

You can get the latest ledger header from horizon, for instance the following command would work from the command line: curl 'https://horizon.stellar.org/ledgers?limit=1&order=desc' Obviously ...
user3188445's user avatar
  • 1,221
4 votes

Can the Horizon Server be hacked?

That's a broad question. How can you guarantee that Google Mail is not hacked? Potentially, any service can be hacked, and not necessarily on the server side. For example, DNS hijacking allows hacker ...
Orbit Lens's user avatar
  • 6,886
4 votes
Accepted

What is asymptotic security and why does Stellar, but not POW exhibit this?

As a practical matter, SCP's asymptotic security follows from the fact that it depends only on digital signatures (and hash functions) for security, and that these can be tuned to resist arbitrarily ...
user3188445's user avatar
  • 1,221
3 votes
Accepted

What tool is used for browser interactivity?

Right now I believe SEP-7 is the best answer. It defines a link format that an app such as yours can use to create a transaction that you'd like a user's wallet to sign and submit. The flow is this: ...
Tom Q.'s user avatar
  • 176
3 votes

What is asymptotic security and why does Stellar, but not POW exhibit this?

You're mixing up two completely different concepts here. One is about transaction finality, and the other is about resistance to sybil attacks. POW has probabilistic finality, since there's always ...
Johan Stén's user avatar
  • 1,947
3 votes
Accepted

How does the Stellar Network prevent an actor with small quorum intersection from halting the network

tl;dr: the rest of the network can still reach consensus and it will not halt the network. In your case, there is only one non-compromised validator. Any node outside the set of compromised nodes ...
nikhils's user avatar
  • 1,080
3 votes
Accepted

Why does the high level threshold level for quorum have to be above 66%?

This is by analogy with symmetric Byzantine agreement protocols (in which everyone has the same quorum slices). You need any two quorums to intersect at an honest node. If your threshold is 2/3 or ...
user3188445's user avatar
  • 1,221
3 votes

How do 2 people sign a transaction from different clients?

Maybe this flow is working on the backend process. You create transaction with signed rootKeypair and save transaction object somewhere else waiting for person B to signed that transaction ?
Tanapat Xu's user avatar
3 votes
Accepted

Inflation pool ledger protocol

If the start of the hash displayed by the ledger is the same of the one displayed on laboratory, then is just a visualization bug You can check here Just to be safe, after you sign a transaction, ...
Nekrataal's user avatar
  • 1,009
2 votes

Can an inflation pool be hacked to send all weekly lumens to 1 address? [third-party]

All of the concerns you have are the same for any wallet this is not just confined to an inflation pool. Making the website separate from the wallet helps keep the two separate and reduces the ...
ExMachima's user avatar
  • 619
2 votes
Accepted

Formal Verification of Smart Contract in Stellar

The official testnet's Horizon is a free tool to test your code. It involves no real costs to you. The Laboratory is another good testing tool with a good UI, and you can use it without coding ...
cesarm's user avatar
  • 1,527
2 votes
Accepted

Do sequential secret seeds create a security risk?

That's alright as long as your Master Secret Seed is truly random. Remember that thousand of seeds is still a drop in the ocean of all possible keys. Even though seeds will be sequential - you won't ...
umbrel's user avatar
  • 938
2 votes

Best Practices for Securing Secret Keys in a Tier-3 DLT App Built on Stellar

There is a catchphrase that says: Not your keys, not your coins. Private keys should only be known/managed/used by their owner and nobody else. If you want it the trustless crypto way: Pass an ...
sui's user avatar
  • 2,534
1 vote

How can I preg_match a Stellar public address in PHP?

A stellar address begins with "G", followed by "[A-D]" and then 54 characters from this base32 alphabet "[ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]", so: preg_match('/^G[ABCD]{1}[...
sui's user avatar
  • 2,534
1 vote

Storing Secret Key for Smart Contracts

If you can avoid taking the secret key from the user it will reduce your liability and the user will be likely to trust your application or service. SEP-0007 introduces a custom URI Scheme web+...
nikhils's user avatar
  • 1,080
1 vote

How is Stellar network protected against spam? Are there scalability solutions?

I have no clue for the 2nd question. For the first one... Horizon server submits transactions to the Stellar network. This server does not let you to sustain 1000tx/s from the same IP for more than ...
cesarm's user avatar
  • 1,527
1 vote

Is it possible to run Stellar over Tor?

It may be feasible - Stellar uses TCP for its peer discovery protocol.
EndingWithAli's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible