Real Soroban measurements
Fee and CPU costs were captured at each step of the flow, giving a concrete performance baseline for confidential transfers on Soroban rather than a theoretical estimate.
Delivery roadmap
From proven testnet to regulated mainnet
A capability-led path that moves from a working confidential-transfer proof-of-concept to an audit-gated mainnet launch, delivered as an open-source public good for the Stellar ecosystem.
- Grant
- $134K
- Backer
- Stellar Community Fund
- Status
- Testnet PoC proven
End-to-endFull flow proven on testnet
Fee-freeSponsored user model confirmed
SorobanFee & CPU benchmarks captured
De-risked
Already proven on testnet.
A functional proof-of-concept already demonstrates the complete confidential-settlement flow end to end on Stellar testnet. The sequence below is not a plan — it is a run that has been executed and measured.
TESTNET PROOF-OF-CONCEPTREGISTER → WITHDRAW
1
01 Register
An account is created and its auditor viewing key is escrowed at registration, enforced on-chain by a zero-knowledge proof so compliance visibility is a precondition, not an afterthought.
2
02 Deposit
Public USDC is moved into a confidential balance, wrapping real USDC through Stellar's Asset Contract pattern with no dependency on issuer cooperation.
3
03 Confidential transfer
Value moves with the amount and both balances kept hidden on-chain, each transfer verified by a zero-knowledge proof before it settles.
4
04 Recipient decrypt
The recipient decrypts the incoming amount with their own key and reconciles it against their confidential balance.
5
05 Auditor decrypt
An authorized reviewer selectively decrypts that one transaction through the auditor viewing key, without exposing any unrelated activity.
6
06 Withdraw
The confidential balance settles back out to public USDC, closing the loop between on-chain confidentiality and the regulated fiat last mile.
Sponsored, fee-free users
The sponsored-transaction model was confirmed in practice: fee-bump and sponsored reserves cover costs so senders and recipients never need to hold or manage XLM.
The grant
A $134K Stellar Community Fund grant.
The grant funds capability, not speculation. Every deliverable is released as an open-source public good that any regulated operator can inspect, reuse and extend.
Open-source dashboards
The Admin (operator), Banking / Partner and Auditor / Compliance dashboards, released open source as reference control surfaces.
Partner & Compliance APIs
A Partner API with REST, webhooks and a sandbox, plus a Compliance API for screening hooks, selective-disclosure endpoints and audit-trail queries.
Client SDK & proving service
A client SDK and a proving service so integrators can construct valid confidential transfers without building bespoke cryptography.
Sponsored-transaction relayer
A relayer that applies fee-bump and sponsored reserves so end users transact fee-free and never hold XLM — no asset gate on participation.
Soroban cost benchmark
A published zero-knowledge cost and performance benchmark for confidential transfers on Soroban, contributed back to the ecosystem.
Delivery phases
Delivered in three capability phases.
The roadmap advances by capability rather than by calendar. Each phase adds a layer of the system, and the final phase is unlocked only once the security gate is cleared.
1
PHASE 01 Confidential core & foundation
Stand up the confidential-transfer layer for USDC and the foundations users touch — a testnet MVP that proves the core mechanics.
- Confidential-transfer layer for USDC, with amounts and balances kept private on-chain.
- Sponsored fees so users and recipients transact without holding XLM.
- Wallet access to hold and move confidential balances.
- The operator control surface for administering the system.
2
PHASE 02 Bank-grade system, dashboards & compliance
Build the regulated operating layer around the core, still on testnet, so the system behaves like production infrastructure.
- The three dashboards for operators, partners and compliance reviewers.
- Partner & Compliance APIs, with selective disclosure for authorized review.
- The regulated-payout link via Anchor Platform (SEP-24, SEP-31, SEP-12) to the fiat last mile.
- The published zero-knowledge cost report from real Soroban measurements.
3
PHASE 03 Production hardening & mainnet launch
Harden the system, pass the independent security gate, and only then deploy to mainnet. Mainnet is explicitly conditional on the audit outcome.
- Independent security review — the audit gate that must be cleared first.
- Mainnet deployment with role-based access control.
- Versioned APIs and SDKs, plus an operational runbook.
- Final architecture and compliance documentation.
Milestone map
The three phases at a glance.
| Phase | Focus | Key capabilities | Environment |
|---|---|---|---|
| 01 | Confidential core & foundation | Confidential USDC transfers, sponsored fees, wallet access, operator console | Testnet MVP |
| 02 | Bank-grade system, dashboards & compliance | Three dashboards, Partner & Compliance APIs, selective disclosure, regulated-payout link, published cost report | Testnet |
| 03 | Production hardening & launch | Independent security review, RBAC, versioned APIs & SDKs, operational runbook, final documentation | Audit-gated mainnet |
Security gate
Mainnet is conditional on the audit outcome.
The confidential-transfer stack is an unaudited ecosystem preview today. It reaches mainnet only after an independent security review clears — a gate, not a date.
Independent review first
Before any mainnet deployment, the stack is submitted for an independent security review. The result — not a target date — determines whether launch proceeds.
A gate, not a milestone
Mainnet launch is not scheduled ahead of the review. It is unlocked only when the review outcome is cleared, keeping delivery honest about what has actually been verified.
Nothing at risk early
Until the gate clears, everything runs on testnet with no real value in motion. The path to production is deliberate, reviewable and reversible.
Public good
An open-source reference implementation for the ecosystem.
The output is not a private product moat. It is a reusable reference implementation that any regulated operator can build confidential payments on Stellar with.
Reusable by any operator
Regulated remittance operators, partner banks and PSPs can adopt the same dashboards, APIs, SDK and relayer to launch confidential USDC settlement without rebuilding the cryptography.
The application & compliance layer
Remi contributes the software, compliance and operations layer that makes Stellar's confidential-transfer capability usable — not a new asset and not a financial instrument.
Advances the standard
The work exercises Stellar's Protocol 25/26 zero-knowledge host functions and the emerging confidential-transfer contract standard, feeding real-world learnings back to the ecosystem.
Open by default
Dashboards, APIs, the client SDK, the relayer and the Soroban benchmark are all published for the community to inspect, reuse and extend.