Stellar: who orders transactions?

Who controls it

Transaction ordering

At this review, seven Tier 1 organizations (21 validators) ran consensus in practice and could tolerate the failure of two. Three more organizations were due to join by mid-August 2026.

Escape hatch

n/a: L1

Upgrade authority

Validators hold a real vote, but SDF writes all core code and the network follows its lead in practice. One production implementation exists (stellar-core).

Halts and outages

Stellar has had one confirmed full halt, on 2019-05-15, for 67 minutes; by design, SCP halts instead of forking. In 2021, SDF’s own nodes were offline for 10 hours and the chain kept closing ledgers. The recent record is worse at the state layer. A Protocol 23 bug corrupted ledger state for 35 days (Sept-Oct 2025), and 84 entries were never repaired.

Ketju assessment

Ketju does not approve Stellar: freezing is built into the protocol for every issued asset, and since Protocol 26 the validator quorum can vote to freeze specific accounts. Stellar’s foundation markets these controls as a compliance feature. Stellar is the only chain Ketju has reviewed with freezing as a protocol primitive, and its liveness record did not decide the verdict. Every issued asset carries issuer-level authorization revocation. Clawback (Protocol 17, 2021) lets an issuer burn its asset out of any holder’s balance whose trustline opened after the issuer set the flag. CAP-77 (Protocol 26) gives the validator quorum a mechanism to vote specific accounts, trustlines and contract data frozen. It includes a bypass allowlist for designated recovery transactions. We verified this against the CAP text, status Implemented. At review the quorum was seven named organizations, US- and EU-based companies, with a fault tolerance of two. A planned expansion toward 13 organizations would raise that tolerance but would not change what the quorum can vote to freeze. Stellar is a well-run payments network, but it is built for the freeze controls that Ketju’s chain grade exists to detect. No protocol on top of it can rank above the chain beneath it. Stellar also has one production implementation, whose Protocol 23 bug corrupted ledger state for 35 days in late 2025. Total DeFi on the chain is about $230M. Ketju does not approve Blend or the other Stellar venues because they run on this chain.

Review triggers

• None: Ketju does not approve this chain.

Each trigger names a fact anyone can observe. If one occurs, Ketju will review the assessment again. None is a forecast.

Questions before use

1. Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
2. Can the client withdraw without help from the party that normally orders transactions?
3. Who can upgrade bridges or contracts, and what delay applies?
4. Does the asset introduce an issuer weaker than the chain grade?
5. What evidence will show a halt, censorship event, or governance change?