Web3

Steal Main

TypeScriptNext.jsRustZero-Knowledge ProofsSmart Contracts

Role

Developer

Technologies

TypeScriptNext.jsRustZero-Knowledge ProofsSmart Contracts

Links

Visit Live Site Source Code

Overview

Confidential credit on Stellar. Borrow, lend, and liquidate without revealing collateral, debt, or credit scores.

Steal App is a ZK-powered lending protocol built on Noir + UltraHonk + Soroban (Protocol 26). A borrower deposits collateral and borrows USDC — both amounts hidden behind Poseidon commitments. A credit score attestation (ZK-proof of score ≥ threshold) unlocks dynamic loan-to-value ratios, including under-collateralized borrowing for high scores. Liquidators prove a position is unhealthy and trigger liquidation without ever seeing the actual values. Auditors decrypt positions in full using a view key shared by the borrower. Every zero-knowledge proof is generated client-side in WebAssembly and verified on-chain in Soroban using BN254 host functions.

One lending pool. Three roles. Zero visibility into private values. > > - Borrower opens a position by committing collateral + debt commitments on-chain, proves credit score ≥ threshold and health factor ≥ 1 in ZK. > - Liquidator proves health factor - Auditor decrypts the full position using a shared view key (Poseidon-based encryption).

The Challenge

Stellar is transparent by design. Every payment, every balance, and every contract entry is public and permanently indexed. For lending, that transparency is a dealbreaker: Existing lending protocols on Stellar expose everything. There is no way to: How might we let a user borrow on Stellar where the amounts stay private, solvency is proven in ZK on-chain, and a designated auditor can still verify the numbers?

System Architecture

The Solution

Steal App solves this with four core primitives: 1. Poseidon2 Commitments for Position Hiding. Collateral amounts and debt amounts are never stored in the clear on-chain. Instead, the borrower stores Poseidon2([amount, salt]) — a commitment that hides the value. The salt is kept private by the borrower. 2. Client-Side ZK Proving (bb.js WASM). Every proof is built in the browser using Noir circuits compiled to WASM via Barretenberg's bb.js.