Overview
How Account Demolisher is built, what runs where, and where to find the detail.
Account Demolisher is a Next.js application that closes Stellar accounts. The close runs in the browser: the account audit, DeFi discovery, plan generation, simulation, the sign-time checks, and signing all happen client-side, and the browser submits every transaction itself.
The server has three narrow jobs, and none of them involves the account owner's key.
What runs where
| Runs in the browser | Runs on the server |
|---|---|
| Reading the account from Horizon | Minting, renewing and co-signing exchange forwards (the mediator) |
| Discovering DeFi positions on chain | Holding multisig signing requests in memory (the signing relay) |
| Generating the plan and simulating every step | Recording first-party usage metrics and verified closes |
| Checking every step before it is signed | |
| Signing through the wallet and submitting |
Position discovery needs no server and no API key. Blend, Soroswap and Aquarius concentrated pools are read directly from their contracts. Aquarius standard pools are read from the Aquarius REST API and from an on-chain event scan, and the two results are combined.
Start here
Architecture
The module map, the request flow, and the trust boundaries.
Closure lifecycle
Audit, plan, simulate, execute, and what each stage guarantees.
How it works
Account audit
What is read from Horizon and how the merge verdict is computed.
Position discovery
Per-protocol discovery and exit construction.
The plan graph
Node kinds, dependency edges, validation, and ordering.
The classic batch
How the classic close is ordered and split across transactions.
Simulation
What is simulated, what is baked into the envelope, and what is not.
Execution and recovery
The topological walk, retry rules, and the checks before the merge.
Protocol
Mediator forward
Per-close key derivation, renewal, and the single envelope shape the server co-signs.
Signing relay API
Routes, guards, and signature merging for multisig closes.
SEP-41 allowances
The event scan, on-chain confirmation, and the revoke call.
Exchange integration
For exchange operators: the registry, memos, and what you receive.
Wallet integration
For wallet developers: the wallet calls the app makes.
SEP support
Which Stellar Ecosystem Proposals this implements.
Security and reference
Security model
Assets, adversaries, trust boundaries, and the code that defends each.
Contract allow-list
The pinned contract set and how it is enforced.
Audit status
The pre-audit review, what it found, and what was fixed.
Configuration
Every environment variable, its default, and its effect.
Networks
Horizon, RPC, passphrase, and friendbot per network.
Failure reference
The failure taxonomy and the error types raised across the codebase.
Self-hosting
Install, configure, run, and deploy under your own domain.
Source
github.com/bytemaster333/account-demolisher, licensed under Apache 2.0.