OpenZeppelin ships confidential balances for Stellar in stellar-contracts v0.8.0

OpenZeppelin released confidential-balance and confidential-transfer contracts for Stellar's Soroban runtime on October 22, 2026, shipping them in stellar-contracts v0.8.0. The design wraps any SEP-41 token with a Soroban contract that hides balances and transfer amounts while settlement still writes to the ledger. The announcement, OpenZeppelin Brings Confidential Balances and Transfers to Stellar, credits a deep dive by Boyan Barakov on the mechanics.

The primitive

A wrapper contract sits on top of an existing SEP-41 token. Users deposit the underlying asset, transact confidentially inside the wrapper, and withdraw when they want to exit. The underlying token is not modified, which lets confidential rails ship against assets already in circulation — stablecoins, tokenized treasuries, issuer-controlled payment tokens.

The release does not include standalone confidential issuance (new assets minted directly inside the confidential system). The team describes it as a supported design pending future work.

Cryptography

• Balances are stored as Pedersen commitments, not plaintext ledger values.
• Every operation on private state ships an UltraHonk proof, verified onchain. The release treats these as zero-knowledge proofs without using the label in prose.
• Verification keys are pinned per circuit. Noir supplies the proof circuits.
• There is no ElGamal stage, which separates the design from the Solana Token-22 confidential-transfer extension that readers may be familiar with.

The onchain Soroban contracts and the circuits are in audit scope. The accompanying SDK and client-side tooling are described as an unaudited demo.

Compliance surface

The design keeps the issuer's control plane. Each token can plug in:

• Allow-list or block-list identity registries (compatible with the T-REX / ERC-3643 toolkit the article links).
• Scoped visibility for designated reviewers — a compliance role can see balances and flows a regulator or auditor needs, with no blanket decryption.
• Selective disclosure by the holder, including proving a single transaction amount or a balance-threshold claim to a single counterparty.
• Freezing that cascades from the Stellar Asset Contract controls.
• Authorized clawback, with the administrator role separated from the auditor role.
• An auditor registry and a verification-key registry.

Interface

The contracts implement the ERC-7984 confidential-token interface, which gives tooling written for the Ethereum-side confidential standard a mapping onto Soroban. Example projects live under examples/confidential in the repo: a compliant token, an allowlist policy, and a factory.

- Library: github.com/OpenZeppelin/stellar-contracts
- Release: v0.8.0 (Oct 22, 2026)
- Package path: packages/confidential
- Interface: ERC-7984 (confidential token)
- Token standard wrapped: SEP-41
- Example: examples/confidential/README.md

Why this matters

Stellar runs a sizable regulated-asset base: OpenZeppelin frames the release in the context of >$1.7B TVL already running on contracts the firm maintains, and names the Stellar Development Foundation as the collaborating partner. Franklin Templeton's BENJI on Stellar — now part of the FOBXX move to XRPL — and the growing tokenized-treasury book on the chain are the practical users: issuers who need balance privacy against competitors but keep compliance obligations to regulators.

The pattern matches a broader move in confidential tokens this quarter: the Zama–Morpho confidential USDC vault, the ckBTC-style wrappers, and now Stellar's wrapper design, each paired with issuer-grade compliance controls rather than fully anonymous rails. Readers tracking the surface should also note OpenZeppelin's standards partnership with Chainlink earlier this week, which pulls audit-primitives into the CCIP tool chain.

Caveats

• The SDK and client tooling are not in audit scope — anything shipping against this should pin to the audited Soroban contracts and treat the demo client as reference, not production.
• Standalone issuance inside the confidential system is on the roadmap but not available today.
• Pedersen-commitment balances are information-theoretically binding but not hiding against a party that can brute-force the commitment randomness; the standard-practice argument is that proof circuits enforce the invariants that make this acceptable in practice. Protocols composing with the wrappers should still verify the compliance model against their own policy.

Sources:

• OpenZeppelin — OpenZeppelin Brings Confidential Balances and Transfers to Stellar (Oct. 22, 2026, primary).
• GitHub — OpenZeppelin/stellar-contracts v0.8.0 (release).
• Documentation — Confidential tokens on Stellar.
• GitHub — security advisory GHSA-jpg9-m7w4-c7wc (prior disclosure referenced in the release notes).