Skip to content

getting-started.md

Latest commit

 

History

History
86 lines (61 loc) · 3.1 KB

getting-started.md

File metadata and controls

86 lines (61 loc) · 3.1 KB
Raw

getting-started

Getting Started

This guide takes you from zero to your first sdkt commands. Everything here runs offline — no RPC node, no network — so you can follow along in under five minutes.

1. Install

See installation.md. The fastest path:

# From source
git clone https://github.com/SaboLabs/soroban-devkit
cd soroban-devkit
cargo install --path crates/sdkt-cli

# Verify
sdkt --version

The sdkt binary is built by the sdkt-cli crate. After cargo install the command is named sdkt on your PATH.

2. Your first command — offline ABI/WASM diff

sdkt diff compares two contract WASM files and reports added/removed functions, changed signatures, events, and custom types. It needs no network.

sdkt diff \
  --old-wasm crates/sdkt-cli/tests/fixtures/us_old.wasm \
  --new-wasm crates/sdkt-cli/tests/fixtures/us_new.wasm

Sample output:

Contract WASM Diff
  OLD: 05befa136e7f0829a5051d97b032f355a5e65976397df90b224d141942dce46c (198 bytes)
  NEW: 5ae0c8b47b5723898bf9313abe1643f89eb23f19b9bd0cd82769db522767d97e (238 bytes)

Added functions (1):
  + balance (balance(who: address) -> void)
Changed signatures (1):
  ~ mint :
      old: mint(amt: u32) -> void
      new: mint(amt: u64) -> void
...

Add --upgrade-safety to get a breaking-change verdict (used by CI on releases):

sdkt diff \
  --old-wasm a.wasm --new-wasm b.wasm \
  --upgrade-safety --format json

3. Your second command — static security audit

sdkt audit scans a Soroban contract's Rust source for common auth bugs:

sdkt audit path/to/contract/src/lib.rs

It flags AUTH-001/002/003/004 (missing require_auth on privileged functions, unauthenticated invoke_contract, unguarded initialize, unguarded token transfers) and MOVE-001 (suspicious move-after-use, warning only). To skip a rule:

sdkt audit contract/src/lib.rs --disable MOVE-001

When to use sdkt?

sdkt is built to consolidate disjointed Soroban scripts into one professional interface. You should use sdkt if:

  1. You are actively building and deploying multi-contract Soroban workspaces and need topological dependency sorting (sdkt project deploy).
  2. You need to decode base64 XDR payloads, inspect deployed contract ABI, or fetch raw event streams without hunting for RPC JSON payloads (sdkt decode, sdkt inspect).
  3. You want offline, pre-flight security checks integrated into your workflow (sdkt audit, sdkt diff --upgrade-safety).
  4. You need to calculate exact storage extension fees and TTL horizons before your deployed instances expire (sdkt storage analyze).

For comprehensive examples across all capabilities, view the recipes inside examples.md.