Soroban/Stellar CVE Vulnerability Database Reference

sanctifier cve search --keyword reentrancy

sanctifier cve search --keyword reentrancy --format json

sanctifier cve list --category access-control --severity high

# All critical findings in the arithmetic category
sanctifier cve list --category arithmetic --severity critical

sanctifier cve show SOL-2024-001

sanctifier cve show SOB-2024-015

# Export to a local JSON file
sanctifier cve export --format json -o vulndb.json

# Print an RSS feed to stdout (pipe to a file, curl endpoint, etc.)
sanctifier cve export --format rss

sanctifier cve serve --port 7654

id: SOL-2024-001
title: Unprotected Initialization
severity: critical
cvss: 9.8
category: access-control
affected_versions: "soroban-sdk <=20.5.0"
description: >
  Contract initialize/init function lacks access control, allowing anyone to
  re-initialize and take ownership. A second caller can overwrite the admin
  address and permanently hijack the contract.
recommendation: >
  Add require_auth() check or verify the contract has not been initialized
  before accepting parameters.
tags: [initialization, ownership, access-control]

// Guard against re-initialization and require admin auth
if env.storage().instance().has(&DataKey::Admin) {
    panic!("already initialized");
}
admin.require_auth();
env.storage().instance().set(&DataKey::Admin, &admin);

id: SOL-2024-005
title: Hardcoded Admin Key
severity: high
cvss: 7.5
category: access-control
affected_versions: "soroban-sdk <=20.5.0"
description: >
  Admin addresses embedded directly in contract source code cannot be rotated,
  and if compromised represent a permanent and irrecoverable security failure.
recommendation: >
  Store admin addresses in contract storage and set them during initialization.
tags: [hardcoded, admin, key-management]

fn get_admin(env: &Env) -> Address {
    env.storage().instance().get(&DataKey::Admin).unwrap()
}

id: SOB-2024-013
title: Stale Price Oracle Data
severity: high
cvss: 8.2
category: oracle
affected_versions: "soroban-sdk <=20.5.0"
description: >
  Using oracle prices without validating their freshness allows attackers to
  exploit price latency: stale prices let liquidations be triggered at outdated
  rates or allow undercollateralized borrows to proceed.
recommendation: >
  Validate oracle price timestamps and reject prices older than an acceptable
  threshold.
tags: [oracle, price, defi, staleness]

const MAX_PRICE_AGE_SECS: u64 = 60;
let price_age = env.ledger().timestamp() - oracle_update_time;
if price_age > MAX_PRICE_AGE_SECS {
    panic!("stale oracle price");
}

id: SOB-2024-015
title: Cross-Contract Reentrancy
severity: high
cvss: 8.8
category: reentrancy
affected_versions: "soroban-sdk <=20.5.0"
description: >
  A Soroban contract that calls an external contract before finalizing its own
  state updates can be re-entered if the callee calls back into the original
  contract, corrupting intermediate state.
recommendation: >
  Apply the Checks-Effects-Interactions pattern: finalize all state changes
  before invoking external contracts.
tags: [reentrancy, cross-contract, checks-effects-interactions]

// 1. Check
if balance < amount { panic!("insufficient"); }
// 2. Effect – update state FIRST
set_balance(&env, &user, balance - amount);
// 3. Interaction – call external last
token_client.transfer(&env, env.current_contract_address(), user, amount);

{
  "version": "2.0.0",
  "last_updated": "2026-06-25",
  "description": "Community-sourced vulnerability database of known Soroban and Stellar CVEs",
  "vulnerabilities": [
    {
      "id": "SOL-2024-001",
      "title": "Unprotected Initialization",
      "name": "Unprotected Initialization",
      "description": "...",
      "cvss": 9.8,
      "severity": "critical",
      "category": "access-control",
      "affected_versions": "soroban-sdk <=20.5.0",
      "pattern": "fn\\s+(initialize|init)\\s*\\([^)]*\\)(?![\\s\\S]*?require_auth)",
      "poc_exploit": "contract.initialize(attacker_address, &env);",
      "patch": "admin.require_auth();",
      "recommendation": "Add require_auth() or verify not-yet-initialized.",
      "references": ["https://soroban.stellar.org/docs/fundamentals/authorization"],
      "tags": ["initialization", "ownership", "access-control"],
      "related_cves": []
    }
  ]
}

sanctifier analyze ./contracts --vuln-db path/to/custom.json

sanctifier cve export --format json -o custom.json

# Quick overview of all entries sorted by severity
sanctifier cve list --severity critical
sanctifier cve list --severity high
sanctifier cve list --severity medium
sanctifier cve list --severity low