Stellar: who orders transactions?

Control profile

Transaction ordering

Seven Tier 1 organizations (21 validators) effectively ran consensus at this review, tolerating two org failures; three more orgs were slated to join by mid-August 2026

Escape hatch

n/a — L1

Upgrade authority

A real validator vote, but SDF authors all core code and the network follows its lead in practice. One production implementation (stellar-core).

Liveness record

One confirmed full halt (2019-05-15, 67 minutes; SCP halts rather than forks by design). The 2021 incident cut the other way: SDF's own nodes were fully offline for 10 hours and the chain kept closing ledgers. The recent record is worse at the state layer: a Protocol 23 bug corrupted ledger state for 35 days (Sept-Oct 2025), and 84 entries were never repaired.

Ketju control assessment

ADVERSE CONTROL ASSESSMENT. on control, not on liveness. Stellar is the one chain we have reviewed where freezing is a protocol primitive on every issued asset, marketed by its foundation as a compliance feature. Every issued asset carries issuer-level authorization-revocation, and clawback (Protocol 17, 2021) lets an issuer burn its asset out of any holder's balance whose trustline was opened after the issuer set the flag. Since Protocol 26, CAP-77 gives the validator quorum itself an implemented mechanism to vote specific accounts, trustlines, and contract data frozen, with a bypass allowlist for designated recovery transactions, verified against the CAP text, status Implemented. That quorum was seven named organizations at review, US- and EU-based companies, with fault tolerance of two; an announced expansion toward 13 organizations would raise the tolerance without changing what the quorum can now vote to freeze. This is a well-run payments network built for exactly the compliance surface our sovereignty grade exists to detect, and no protocol quality on top of it can outrank the settlement layer. The practical facts agree with the structural ones: one production implementation, whose Protocol 23 bug corrupted ledger state for 35 days in late 2025, and about $230M of total chain DeFi, a scale observation that does not by itself establish executable capacity if the chain were a protocol. Blend and the other Stellar venues are disposed of entirely by this verdict.

Observable review triggers

• n/a — rejected

These triggers make the assessment monitorable. They are not predictions; each identifies a fact that would change or reopen the current control assessment.

Advisor implementation questions

1. Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
2. Can the client exit without cooperation from the normal transaction-ordering party?
3. Who can upgrade bridges or contracts, and what delay applies?
4. Does the asset introduce an issuer weaker than the chain grade?
5. What evidence will show a halt, censorship event, or governance change?