Document stellar-cli's RPC trust boundary #2781

Activity

1. github-project-automation

   added this to DevXon Oct 1, 2026
2. duongynhi000005-oss commented on Oct 26, 2026

   

   duongynhi000005-oss

   on Oct 26, 2026

   More actions

   Analysis & Proposed Documentation

   Currently, stellar-cli relies on the configured RPC endpoint (--rpc-url / STELLAR_RPC_URL or --network) for security-critical transaction construction steps without documenting the trust assumptions in user-facing documentation:

   1. Simulation-driven authorization & footprint construction: Contract invocation/deployment commands construct transaction footprints, resource fees, and SorobanAuthorizedEntry payloads from simulateTransaction responses.
   2. Ledger-derived signature expiration: Args::sign_soroban_authorizations (cmd/soroban-cli/src/config/mod.rs) queries client.get_latest_ledger().await?.sequence and sets signature_expiration_ledger = latest_ledger + 60.
   3. Sequence number resolution: Args::next_sequence_number queries client.get_account(...) from the RPC endpoint.

   Proposed Changes (README.md)

   • Add a dedicated Security & RPC Trust Boundary section (linked in the Table of Contents) detailing:
     • Which transaction and signing parameters are derived from the RPC endpoint (simulateTransaction, getLatestLedger, getAccount).
     • Concrete risks of using untrusted or plain-HTTP (http://) endpoints (manipulated SorobanAuthorizedEntry sub-invocations, skewed signature_expiration_ledger windows via inflated getLatestLedger responses, and MITM tampering over unencrypted transport).
     • Actionable operational guidance: prefer self-hosted or trusted RPC providers over TLS (https://), restrict http:// to local loopback development (localhost / 127.0.0.1), and inspect authorization details rather than using --auto-sign on non-local networks.

   I have prepared this documentation update on my fork branch duongynhi000005-oss/stellar-cli:docs/issue-2781-rpc-trust-boundary (commit b002ac8) and would be happy to open a PR if you'd like to assign this issue to me.