Security Practices

Security Overview

Stardust Staking operates a fully non-custodial architecture. There is no backend server, no database, and no user accounts. Each staking application is a static frontend that communicates directly with the respective blockchain network through your wallet. We never have access to your private keys or funds at any point.

Non-Custodial Architecture

• No private keys stored. All transaction signing happens exclusively in your wallet extension. The frontend never sees or transmits your private key.
• No backend or database. The applications are static HTML/JS/CSS files served via nginx. There is no server-side code processing requests.
• No user accounts. There is no registration, login, or session management. Your wallet address is the only identifier.
• Client-side only. All staking operations (delegate, undelegate, claim) are constructed in the browser and submitted to the blockchain through your wallet for approval.

Transport & Browser Security

• HTTPS/TLS. All traffic is encrypted using TLS 1.2+ with certificates from Let's Encrypt, automatically renewed.
• HSTS. Strict-Transport-Security is enforced with a one-year max-age, ensuring browsers always use HTTPS.
• Content Security Policy. CSP headers restrict script sources to 'self' only, preventing code injection. Each domain has a tailored policy.
• X-Frame-Options: DENY. Prevents clickjacking by disallowing the site from being embedded in frames.
• X-Content-Type-Options: nosniff. Prevents MIME-type sniffing attacks.
• Permissions-Policy. Camera, microphone, and geolocation are explicitly disabled.
• Referrer-Policy. Set to strict-origin-when-cross-origin to limit information leakage.

Wallet Integration

• Official wallet adapters. We use official, audited wallet adapter libraries for each chain (Leo/Puzzle for Aleo, Wallet Standard for Solana and Sui, wagmi/viem for Monad).
• Transaction transparency. Every transaction is presented to you in your wallet for review before signing. You can verify the exact program call, amounts, and recipient.
• No blanket approvals. Each staking operation requires individual wallet confirmation. We never request unlimited token approvals or broad permissions.

Infrastructure

• Static deployment. All applications are pre-built static bundles deployed to a web server. There is no dynamic server-side rendering or API processing.
• Hardened nginx. The web server is configured with security headers on every response, restrictive CORS policies, and no directory listing.
• Let's Encrypt SSL. TLS certificates are provisioned and auto-renewed via Certbot. OCSP stapling and strong cipher suites are enforced.
• No server-side code. There are no APIs, databases, or application servers that could be compromised to affect user funds.

Risk Disclosure

• Blockchain risk. Staking involves interacting with decentralized networks that may experience downtime, forks, or consensus failures.
• Slashing risk. Some networks penalize validators for misbehavior or downtime, which may reduce your staked amount. We operate our validators with high-uptime infrastructure to minimize this risk.
• Protocol risk. Smart contracts and on-chain staking programs may contain undiscovered vulnerabilities. We only integrate with well-established, audited protocols.
• Frontend risk. While we take extensive precautions, any web application could theoretically be compromised. Always verify the URL and review transactions in your wallet before signing.
• Wallet responsibility. The security of your funds ultimately depends on your wallet and private key management. We recommend hardware wallets for significant holdings.

Responsible Disclosure

If you discover a security vulnerability, please report it to us responsibly.

• Contact: admin@stardust.fun
• Scope: All *.stardust.fun domains, nginx configurations, frontend applications, and related infrastructure.
• Response timeline: We aim to acknowledge reports within 48 hours and provide a resolution timeline within 7 days.
• Safe harbor: We will not pursue legal action against security researchers who act in good faith and follow responsible disclosure practices.

Best Practices for Users

• Verify the URL. Always confirm you are on the correct domain (*.stardust.fun) before connecting your wallet.
• Use a hardware wallet. For significant holdings, use a hardware wallet (Ledger, Trezor) for an additional layer of security.
• Never share your seed phrase. No legitimate service will ever ask for your recovery phrase. Stardust will never request it.
• Review transactions. Carefully review every transaction detail in your wallet popup before approving. Verify amounts, recipients, and program calls.
• Bookmark official URLs. Save official Stardust URLs to avoid phishing sites. Our domains: stardust.fun, aleo.stardust.fun, sol.stardust.fun, sui.stardust.fun, mon.stardust.fun.