SoroSentinel
Protocol 30 Ready
ED25519 SNAPSHOT: VALID
SoroSentinel advises before transactions commit to the ledger. It simulates contract calls, exposes stealth signer additions, flags look-alike asset codes, and verifies counterparties against offline cryptographic snapshots — with zero telemetry.
Stellar transactions disguise lethal exploits inside standard operations that conventional wallets approve without warning.
An attacker slips a SetOptionsOp operation into an innocent-looking dApp envelope. Once approved, an external public key gains signing weight sufficient to satisfy account thresholds, granting permanent unauthorized control.
Anyone on Stellar can issue a coin named USDC, EURC, or AQUA. Wallets displaying only the ticker leave signers accepting unbacked tokens from unverified rogue issuers with zero reserve backing.
Transactions without a strict upper max_time remain valid on the ledger indefinitely until the sequence number increments. SoroSentinel flags unbounded validity before the signature leaves memory.
Three independent components communicating exclusively through versioned schemas. No internal imports, no shared state.
Sandboxed Rust library and CLI. Analyzes deployed Soroban WASM bytecode with --network none and seccomp memory caps. Flags self-upgrades, cross-calls, and contract creation indicators without code execution.
Threat-intelligence backbone in Go. Ingests Stellar RPC ledgers idempotently, checks SEP-1 home domains, evaluates a deterministic rule table, and publishes cryptographically signed Ed25519 snapshots.
Pre-signing TypeScript SDK running in wallets. Intercepts raw XDR, simulates Soroban calls via RPC, calculates worst-case net balance deltas, and validates against offline snapshots with zero telemetry.
Security tooling must never hallucinate certainty. SoroSentinel operates under strict mathematical and epistemological invariants.
Absence of data is never reassurance. SoroSentinel strictly outputs findings_present, no_issues_found, partial, or unanalyzable. Unrecognized operations fail loud by design.
Guard never touches private keys and never sends transactions or counterparty accounts to remote servers. All threat evaluations occur locally against cryptographically verified offline snapshots.
Token balances and fees are calculated as 7-decimal fixed-point integers (stroops). Floating-point arithmetic is strictly prohibited across the entire stack, eliminating precision drift exploits.
The same combination of (evidence, as_of, ruleset_version) will always produce the exact same verdict. Wall clocks are never read inside rule evaluation logic.
Integrate pre-signing safety into Stellar wallets, CI contract pipelines, or node indexing workflows.
// SoroSentinel Guard — Wallet Pre-Signing Middleware
import { analyze } from "@sorosentinel/guard-core";
// Intercept the raw transaction envelope before signing
const report = await analyze(envelopeXDR, {
networkPassphrase: "Public Global Stellar Network ; September 2015",
rpcUrl: "https://mainnet.stellar.rpc.endpoint",
snapshotPath: "./snapshots/latest.bin", // 100% offline lookup
});
if (report.status === "findings_present") {
// Never suppress findings: surface worst-case balance deltas
wallet.showPreSigningAlert({
findings: report.findings,
effects: report.effects,
notChecked: report.not_checked
});
} else if (report.status === "no_issues_found") {
wallet.showCleanPrompt(report.effects);
}