BWB × Stellar
Technical Architecture
A controlled extension of BWB's operating real estate investment platform: embedded Stellar accounts, regulated Soroban offerings, BRL access, distribution attribution, and a separately governed yield and lending experience.
1 Scope and architectural intent
BWB already operates a regulated investment and distribution platform on Base. The existing product coordinates investors, issuers, distributors, eligibility, offering lifecycles, investments, ownership records, and commission reconciliation. This program adds Stellar as a first-class execution and settlement rail without replacing the operating platform or weakening its compliance boundaries.
The design reuses BWB's provider-independent domain layer and introduces a Stellar adapter set for Privy, Abroad, Soroban, DeFindex, and Blend v2. Personal data remains off-chain. Investor authorization remains explicit. Every external transition is recorded, reconciled, and recoverable.
Stellar enters the existing account, offering, distribution, and reconciliation domains through capability adapters.
Identity, product eligibility, allocation limits, disclosures, and authorization form sequential gates.
Contracts receive wallet states and business identifiers—not identity files, personal data, or private documents.
Events, callbacks, state transitions, and reconciliation records create a reproducible operational trail.
2 Target system architecture
The application remains the system of orchestration. Stellar becomes a verifiable execution layer for eligible products, while specialist providers stay behind narrow integration boundaries.
3 Existing foundation and Stellar extension
The implementation starts from an operating product, not a greenfield prototype. Existing capabilities are preserved and extended through the same domain contracts used by the Base deployment.
Regulated investment platform
- Investor, issuer, distributor, and operations workspaces.
- KYC/KYB states, investor qualification, and allowlist controls.
- Sequential investment gates and explicit authorization.
- Offering lifecycle, cooling-off, cancellation, and refund logic.
- Attribution, commission reconciliation, and ownership records.
- Event-driven processing, retry queues, and idempotent webhooks.
Stellar-native execution rail
- Embedded Stellar wallets and user-authorized transactions through Privy.
- Soroban contracts for eligibility, allocation, lifecycle, and refunds.
- Stellar event indexing linked to investment and commission ledgers.
- Abroad KYC/KYB and BRL funding states mapped to eligibility.
- DeFindex vault and Blend v2 lending experiences in a separate product area.
- STRIDE threat model, on-chain monitoring, and production evidence.
A network-specific adapter may change how a transaction is built, signed, submitted, and observed. It may not bypass BWB eligibility, authorization, lifecycle, attribution, reconciliation, or audit rules.
4 Regulated investment transaction flow
The transaction path separates off-chain compliance decisions from on-chain enforcement. A Stellar submission is created only after every required gate passes.
5 Two product rails, one control plane
Regulated real estate offerings and optional DeFi products share account, identity, authorization, monitoring, and evidence infrastructure. They do not share product economics, balances, disclosures, or performance reporting.
6 Stellar integration map
Each external dependency has a narrow responsibility and a corresponding BWB control boundary.
| Component | Role | BWB integration | System of record |
|---|---|---|---|
| Privy | Authentication and embedded Stellar wallet access. | Account provisioning, asset views, transaction review, and user authorization. | Stellar for balances and transaction state; BWB for account linkage. |
| Soroban contracts | Programmable controls for regulated private offerings. | Eligibility, allocation limits, pause, cooling-off, cancellation, refund, and auditable events. | Contract state and emitted events, reconciled to BWB records. |
| Stellar data services | Network query, event observation, and transaction submission evidence. | Normalize network activity into idempotent investment, attribution, and commission transitions. | Stellar terminal state plus BWB reconciliation record. |
| Abroad | KYC/KYB and BRL entry/exit. | Map approved, rejected, expired, and manual-review states; authenticate callbacks; reconcile BRL operations to Stellar. | Abroad for provider decisions; BWB for product eligibility and reconciliation. |
| DeFindex | Vault and yield-strategy integration layer. | Deposit, withdrawal, position reporting, failure handling, and reconciliation in a distinct product area. | Vault position on Stellar; BWB for presentation and operational evidence. |
| Blend v2 | Lending market infrastructure. | User-authorized supply or borrowing, collateral and liability reporting, and protocol-risk disclosure. | Protocol position on Stellar; BWB for presentation and evidence. |
7 Security and operational model
Security controls follow the transaction lifecycle from identity decision to reconciled terminal state. The Tranche 2 threat model formalizes actors, assets, trust boundaries, STRIDE threats, mitigations, ownership, and monitoring coverage.
Authorization
Audience-specific access controls, eligibility gates, explicit wallet signatures, and least-privilege operational roles.
Data minimization
No identity documents or personal information on-chain; only necessary states, identifiers, values, and events.
Idempotency
Callbacks, submissions, and indexed events are deduplicated and applied through controlled state transitions.
Transaction integrity
Prepared intent, signed authorization, network transaction, and reconciled outcome remain separately traceable.
Operational resilience
Retries, timeouts, provider outages, pauses, reversals, refunds, and recovery procedures have explicit states.
Monitoring
Contracts, wallets, vaults, lending positions, callbacks, reconciliation gaps, and critical state changes map to owned alerts.
8 Delivery mapping
The architecture is delivered in three controlled increments. Testnet capabilities precede mainnet deployment; production launch requires security evidence, operational ownership, and reconciliation readiness.
Wallet, Soroban offering, distribution MVP
Privy Stellar accounts, shared transaction service, offering lifecycle controls, event indexing, attribution, and commissioning.
Security, Abroad, DeFindex, Blend v2
STRIDE model and monitoring plan, KYC/KYB and BRL test flows, vault operations, lending positions, and failure-state validation.
Mainnet, hardening, reusable release
Regulated distribution launch, end-to-end operational hardening, monitoring activation, documentation, and reproducible evidence.
No production offering launches until contract controls, integration fallbacks, alert routing, pause and recovery procedures, and end-to-end reconciliation have passed their acceptance tests.