SorobanShield is an open, local-first security and audit-preparation MVP for Soroban Rust contracts on Stellar. It gives developers fast, explainable review points for authorization, storage, cross-contract calls, and arithmetic before testnet or mainnet deployment.
Repository: github.com/Ekpemark/sorobanshield
Live Application Demo: sorobanshield.vercel.app
Security notice: SorobanShield is audit preparation tooling, not a professional security audit or a guarantee that a contract is safe.
Prerequisite: Node.js 20+.
npm.cmd install
npm.cmd run devThen open http://localhost:3000. The app works fully in-browser: paste a Soroban Rust contract, run the heuristic scan, and download a Markdown security report.
- 10 Soroban-specific security rules covering authorization (
require_auth), persistent storage lifecycle, TTL extension, cross-contract calls, unchecked arithmetic,unwrap()/expect()panic risks, explicitpanic!, hardcoded addresses, dynamicSymbol::newallocations, and unauthenticated event publishing. - Interactive Contract Presets: Switch instantly between Unsafe Vault, DeFi Swap, and Secure Vault (Clean Soroban Contract).
- Audit Readiness Reports: Exportable Markdown reports with severity tags, exact source line numbers, evidence snippets, and actionable remediation steps.
- Instaward request draft
- SCF interest-form submission packet
- Technical architecture
- Threat model
- 30-day and three-month roadmap
- Demo walkthrough
- Pitch deck copy
- Grant-readiness checklist
- Vulnerability database
- Eligibility and submission checklist
- Security policy
- Contribution guide
The current scope is an execution-ready 30-day Instaward sprint. It does not claim users, audits, integrations, or vulnerability prevention outcomes that have not yet been independently verified.
See docs/GRANT_REQUIREMENTS.md for the current SCF eligibility check and docs/INSTAWARD_APPLICATION.md for the $5,000, 30-day request. The public grant landing page is available at /grant.