Your Soroban token compiles, deploys, and moves balances on testnet. Whether it actually behaves like a SEP-41 token is a different question, and wallets and exchanges that assume the standard will find out the hard way.

Soroban Guard (sorobanguard.com) is an open-source conformance tester built for Stellar. It runs sixteen checks against a live contract and reports a verdict for each one, with the evidence that produced it. It is Apache-2.0 licensed and published on npm and GitHub.

What it actually does

A logged Soroban Guard run against the vulnerable fixture token: 9 pass, 2 fail and 5 unverifiable, with a verdict and evidence for each of the 16 checks

Source: https://sorobanguard.com/

The sixteen checks fall into three groups:

  • Reads (5) — decimals, balance, allowance, name, and symbol. Observed from the contract, not assumed.
  • Writes (5) — transfer, transfer_from, approve, burn, and burn_from. These are signed and submitted on-chain, then the resulting balances are checked.
  • Refusals (6) — what a contract must reject, such as an unauthorized transfer_from, a negative-amount transfer, or a transfer over the balance.

Each check ends in one of five verdicts: Pass, Fail, Unverifiable, Skipped, or Not implemented. "Unverifiable" is the interesting one. When a check cannot reach an answer, it says so and tells you what would fix that, instead of guessing.

Reports come as terminal output, a CHECKS.md file, or JSON, and the exit code (0 conformant, 1 a finding, 2 no verdict) lets CI gate on the result. Run against the project's deliberately flawed fixture token, it logged 9 passes, 2 failures, and 5 unverifiable checks. One failure was a self-transfer that changed the holder's balance, a flaw the authors say they did not plant.

Why it is worth using

It turns "I think my token follows the standard" into a report you can show someone. That helps whether you are shipping your own token, reviewing a teammate's contract, or deciding if a third-party token is safe to integrate.

The scope is stated honestly. This is a conformance test, not a security audit: it does not yet observe events, and it does not assess admin mint, upgradeability, or blacklists, which can all be SEP-41-conformant. It covers SEP-41 only, and it is an independent project, not affiliated with the Stellar Development Foundation.

Safety defaults are sensible too. Reads work on any network, while writes are signed on testnet only unless you explicitly pass a flag. The browser checker is testnet-only.

How to get started

The quickest route is the browser checker at sorobanguard.com/run: connect a Freighter wallet and it runs all sixteen checks against your own token, or a demo copy of the fixture, with no install.

For the terminal, use Node 24 and run npx soroban-guard <contract-id>. Read-only checks need no keys; a full run also needs an owner and a spender secret so the tool can sign the write calls. Add it to CI once you trust the results.

Test your token before your users do

Sixteen on-chain checks, evidence for every verdict, free and open source. Run it from your terminal or in your browser.

Try Soroban Guard