Trust model

The trust boundary is your browser.

LumenWipe builds transactions that drain accounts irreversibly, so the design starts from that fact. Your keys are created and used only in your browser and never reach a server. The backend can't touch your account: its one signing key is the shared exchange mediator, which can only co-sign a forwarding payment you already authorized.

Your browser
Wallet · transaction builder · signing · session
keys live here
Read-only backend
Account analysis · DeFi adapters · routing · cache
co-sign only · no custody
Stellar network & data
Stellar RPC · stellar.expert · Soroswap API
read · simulate · submit

0 servers can move your funds

  • Private key
    Never transmitted. It stays in your wallet, or in memory only for the duration of the close, never persisted and wiped when you finish, abort, or navigate away.
  • Every destructive step
    Reviewed as raw XDR and explicitly confirmed before signing. The full plan is shown up front and each step is simulated first.
  • Exchange memo
    Required and validated against a registry of known exchanges that enforces the memo type; a missing memo blocks submission so deposits don't go missing.
  • Backend compromise
    Its only key is the shared mediator, which can't sign for your account or divert funds (the forwarding payment is atomic and validated). Wrong read data is caught by simulation and confirmations.
  • Strict CSP
    No inline scripts, no unsafe-eval. Dependencies are lockfile-pinned and audited in CI; the transaction builder is a pure, unit-tested module with zero network side effects.
Open the appRead the security model