stellar/stellar-docs/smart-contracts
Claude Code and agent skill by stellar/stellar-docs
- community
Checking that the SKILL.md file is still in the repository.
Stellar smart contract development (Rust, soroban-sdk). Entry point with project setup, contract anatomy, and build/deploy workflow, routing to three companion files in this directory — development.md (storage, auth, cross-contract calls, events, errors, upgrades, factories, troubleshooting), testing.md (unit, fuzz, property, fork, mutation, integration), and security.md (vulnerability classes, checklists, tooling, audits). Use when writing, testing, securing, or shipping Stellar smart contract…
Install
npx vskill@latest install stellar/stellar-docs/smart-contractsSKILL.md
Stellar Smart Contracts
Guide for building Stellar smart contracts in Rust. Smart contracts on Stellar were formerly branded "Soroban" — the platform name is retired, but the Rust SDK (soroban-sdk) and several tool names keep the prefix.
This file covers setup and the core workflow. The deep dives are included below — jump to the section that matches the task:
| Task | Section | |
|---|---|---|
| Storage, auth, cross-contract calls, events, errors, upgrades, factories, troubleshooting | Development Patterns | |
| Unit, integration, fuzz, property, fork, and mutation testing | Testing | |
| Security review, vulnerability classes, checklists, audit prep, tooling | Security |
When to use this skill
- Writing a Stellar smart contract in Rust
- Setting up contract tests (any layer)
- Reviewing a contract for security issues
- Architecting upgradeable contracts, factories, governance, or DeFi primitives
- Debugging a contract-specific error (auth, storage, archival, resource limits)
Related skills
- Assets, trustlines, and SAC bridge →
/.well-known/agent-skills/assets/skill.md - Frontend/wallets that call your contract →
/.well-known/agent-skills/dapp/skill.md - Chain data queries (RPC/Horizon) →
/.well-known/agent-skills/data/skill.md - ZK verification (BLS12-381, Groth16, Circom/Noir/RISC Zero) →
/.well-known/agent-skills/zk-proofs/skill.md - SEP/CAP standards and ecosystem links →
/.well-known/agent-skills/standards/skill.md
Platform constraints
Contracts are Rust compiled to WebAssembly, run in a sandboxed host:
#![no_std]required — usesoroban_sdktypes (String,Vec,Map,Symbol), not the Rust standard library- 64KB compiled contract size limit — use the release profile below
Symbolis limited to 32 characters;symbol_short!()covers up to 9- Storage is rented: every entry has a TTL and can be archived — see development.md
- No
delegatecall, no classical cross-contract reentrancy — see security.md
Project setup
Cargo.toml essentials:
Contract anatomy
One compact example showing state, constructor, auth, TTL, and a typed error:
Full patterns (three storage types, auth variants, cross-contract calls, events, custom types): development.md.
Build, deploy, invoke
To upload WASM without instantiating (e.g. for factories or upgrades), use stellar contract upload (the older stellar contract install is a deprecated alias).
Minimal test
Auth mocking, fuzzing, fork tests, and CI setup: testing.md.
Before mainnet
Work through the checklists in security.md — authorization, reinitialization, arithmetic, storage TTLs, and cross-contract validation are the recurring failure modes.
Documentation
Development Patterns
Core and advanced patterns for Stellar smart contracts. For setup and the basic workflow, start at SKILL.md; for tests see testing.md; for security review see security.md.
Architecture
Contracts run as WebAssembly guests in a sandboxed host. The host provides storage, crypto, and cross-contract calls; guest code references host objects via handles, not direct memory. Practical consequences:
#![no_std]— usesoroban_sdkcollections and strings- 64KB compiled size limit (see Contract size below)
- Rust is the supported language. Community alternatives (AssemblyScript, Solidity via Solang) exist but are not production-ready — see migration docs.
Storage
Three storage types with different costs and lifetimes. Choosing wrong is a top source of bugs and fee waste:
| Type | Lifetime | Use for | |
|---|---|---|---|
instance() | Tied to the contract instance, shared TTL | Admin address, global config, small global state | |
persistent() | Per-key TTL, archived when expired but restorable | User balances, anything that must survive | |
temporary() | Per-key TTL, deleted when expired, not restorable | Caches, session data, short-lived flags |
TTL management
Every entry has a TTL (in ledgers, ~5s each) and is archived when it expires. Extend proactively in functions that touch the data:
Archived persistent entries can be restored with a RestoreFootprint operation, but that costs an extra transaction — design TTL extension into hot paths instead. Details: state archival docs.
Typed storage keys
Always use a #[contracttype] enum for keys — ad-hoc symbols invite collisions:
Data types
Custom types derive #[contracttype]:
Authorization
Authorization is opt-in and explicit. Call require_auth() on every address whose consent the operation needs:
Admin pattern:
Authorization semantics (sub-invocations, custom accounts): auth docs.
Constructors
__constructor runs once, atomically, at deploy time (Protocol 22+). Prefer it over a separate initialize function — it removes the front-running window between deploy and init:
Rules: exact name __constructor, returns (), runs only at creation (not on upgrade), failure aborts the deployment atomically. Pass args at deploy time after the -- separator (see SKILL.md).
If you must support a guarded initialize instead (pre-Protocol-22 targets), check-and-set an Initialized flag — see security.md.
Cross-contract calls
Import another contract's WASM to get a typed client:
For Stellar assets, use the built-in SAC client — every asset has a Stellar Asset Contract:
SAC details and asset interop: /.well-known/agent-skills/assets/skill.md. Validate addresses you call — see security.md.
Events
Emit events for every state change you'll want to index or audit — events are much cheaper than storing queryable state.
This is the start of the file. Read the full SKILL.md on GitHub.
Security
- Security scanPassed, 100 of 100Pattern checks on the skill's files.
- Model reviewNot runA model review is scheduled for the next rescan.
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryChecking.mintlify/skills/smart-contracts/SKILL.md
Popularity
- Repository stars
- 146
- Repository forks
- 325
- 7-day trend score
- 0
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/stellar/stellar-docs/smart-contracts)