Stardust Watch an account

Security Practices

How we protect your assets and our commitment to transparency.

Security Overview

Stardust Staking operates a fully non-custodial architecture. There is no backend server, no database, and no user accounts. Each staking application is a static frontend that communicates directly with the respective blockchain network through your wallet. We never have access to your private keys or funds at any point.

Non-Custodial Architecture

  • No private keys stored. All transaction signing happens exclusively in your wallet extension. The frontend never sees or transmits your private key.
  • No backend or database. The applications are static HTML/JS/CSS files served via nginx. There is no server-side code processing requests.
  • No user accounts. There is no registration, login, or session management. Your wallet address is the only identifier.
  • Client-side only. All staking operations (delegate, undelegate, claim) are constructed in the browser and submitted to the blockchain through your wallet for approval.

Transport & Browser Security

  • HTTPS/TLS. All traffic is encrypted using TLS 1.2+ with certificates from Let's Encrypt, automatically renewed.
  • HSTS. Strict-Transport-Security is enforced with a one-year max-age, ensuring browsers always use HTTPS.
  • Content Security Policy. CSP headers restrict script sources to 'self' only, preventing code injection. Each domain has a tailored policy.
  • X-Frame-Options: DENY. Prevents clickjacking by disallowing the site from being embedded in frames.
  • X-Content-Type-Options: nosniff. Prevents MIME-type sniffing attacks.
  • Permissions-Policy. Camera, microphone, and geolocation are explicitly disabled.
  • Referrer-Policy. Set to strict-origin-when-cross-origin to limit information leakage.

Wallet Integration

  • Official wallet adapters. We use official, audited wallet adapter libraries for each chain (Leo/Puzzle for Aleo, Wallet Standard for Solana and Sui, wagmi/viem for Monad).
  • Transaction transparency. Every transaction is presented to you in your wallet for review before signing. You can verify the exact program call, amounts, and recipient.
  • No blanket approvals. Each staking operation requires individual wallet confirmation. We never request unlimited token approvals or broad permissions.

Infrastructure

  • Static deployment. All applications are pre-built static bundles deployed to a web server. There is no dynamic server-side rendering or API processing.
  • Hardened nginx. The web server is configured with security headers on every response, restrictive CORS policies, and no directory listing.
  • Let's Encrypt SSL. TLS certificates are provisioned and auto-renewed via Certbot. OCSP stapling and strong cipher suites are enforced.
  • No server-side code. There are no APIs, databases, or application servers that could be compromised to affect user funds.

Risk Disclosure

  • Blockchain risk. Staking involves interacting with decentralized networks that may experience downtime, forks, or consensus failures.
  • Slashing risk. Some networks penalize validators for misbehavior or downtime, which may reduce your staked amount. We operate our validators with high-uptime infrastructure to minimize this risk.
  • Protocol risk. Smart contracts and on-chain staking programs may contain undiscovered vulnerabilities. We only integrate with well-established, audited protocols.
  • Frontend risk. While we take extensive precautions, any web application could theoretically be compromised. Always verify the URL and review transactions in your wallet before signing.
  • Wallet responsibility. The security of your funds ultimately depends on your wallet and private key management. We recommend hardware wallets for significant holdings.

Responsible Disclosure

If you discover a security vulnerability, please report it to us responsibly.

  • Contact: admin@stardust.pub
  • Scope: All *.stardust.pub domains, nginx configurations, frontend applications, and related infrastructure.
  • Response timeline: We aim to acknowledge reports within 48 hours and provide a resolution timeline within 7 days.
  • Safe harbor: We will not pursue legal action against security researchers who act in good faith and follow responsible disclosure practices.

Best Practices for Users

  • Verify the URL. Always confirm you are on the correct domain (*.stardust.pub) before connecting your wallet.
  • Use a hardware wallet. For significant holdings, use a hardware wallet (Ledger, Trezor) for an additional layer of security.
  • Never share your seed phrase. No legitimate service will ever ask for your recovery phrase. Stardust will never request it.
  • Review transactions. Carefully review every transaction detail in your wallet popup before approving. Verify amounts, recipients, and program calls.
  • Bookmark official URLs. Save official Stardust URLs to avoid phishing sites. Our domains: stardust.pub, aleo.stardust.pub, sol.stardust.pub, sui.stardust.pub, mon.stardust.pub, near.stardust.pub.