Argus CLI

Official command-line tool for verifying Soroban smart contracts on Argus.

Installation

Global Installation (Recommended)

npm install -g @argus/cli

After installation, you can use the argus command anywhere:

argus verify X7K9M2

One-time Use with npx

No installation required:

npx @argus/cli verify X7K9M2

Perfect for CI/CD pipelines and occasional use.

Quick Start

1. Deploy Your Contract

First, deploy your Soroban contract to Stellar network:

soroban contract deploy \
  --wasm target/wasm32-unknown-unknown/release/my_contract.wasm \
  --source my-account \
  --network testnet

2. Get Verification Code

1. Visit https://argus.security/developer
2. Enter your contract ID and network
3. Click "Generate Verification Code"
4. Copy the 6-character code (e.g., X7K9M2)

3. Run Verification

Navigate to your contract directory and run:

cd my-contract
argus verify X7K9M2

The CLI will:

• Collect contract information (WASM hash, source code, Git info)
• Submit data to Argus API
• Run verification checks
• Display results

4. Get Verified Badge

If verification passes, your contract receives a verified badge on Argus!

Commands

verify <code>

Verify a contract using a verification code.

argus verify X7K9M2

Options:

• -d, --directory <path> - Contract directory path (default: current directory)
• -a, --api-url <url> - Custom API URL (default: https://argus.security)

Examples:

# Basic verification
argus verify X7K9M2

# Specify contract directory
argus verify X7K9M2 --directory ./my-contract

# Use local development API
argus verify X7K9M2 --api-url http://localhost:3000

status <code>

Check the status of a verification request.

argus status X7K9M2

Options:

• -a, --api-url <url> - Custom API URL

help

Display help information and usage examples.

argus help

What Gets Collected

The CLI collects the following information from your project:

| Data | Description | |------|-------------| | Contract Name | From Cargo.toml package name | | WASM Hash | SHA-256 hash of compiled WASM binary | | WASM Size | Size of the WASM file in bytes | | Source Hash | Combined hash of all .rs files in src/ | | Source Files | List of source file paths | | Git Commit | Current commit SHA (if Git repository) | | Git Branch | Current branch name | | Git Remote | Remote repository URL | | Rust Version | Output of rustc --version | | Soroban Version | Output of soroban --version |

Verification Checks

The API runs these verification checks:

| Check | Description | |-------|-------------| | WASM_MATCH | Compares local WASM hash with on-chain contract | | PUBLIC_SOURCE | Verifies Git repository is publicly accessible | | SOURCE_FILES | Checks reasonable number of source files | | BUILD_ENV | Validates Rust and Soroban CLI versions | | WASM_SIZE | Ensures WASM size is within reasonable limits | | BUILD_RECENCY | Checks if contract was recently built |

Project Requirements

Your project should have this structure:

my-contract/
  Cargo.toml              # Required
  src/
    lib.rs                # Required
    ...
  target/
    wasm32-unknown-unknown/
      release/
        my_contract.wasm  # Required (run `soroban contract build` first)
  .git/                   # Optional but recommended

CI/CD Integration

GitHub Actions

name: Verify Contract

on:
  push:
    branches: [main]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          target: wasm32-unknown-unknown
          
      - name: Build Contract
        run: soroban contract build
        
      - name: Verify on Argus
        run: npx @argus/cli verify ${{ secrets.VERIFICATION_CODE }}

GitLab CI

verify:
  image: rust:latest
  script:
    - rustup target add wasm32-unknown-unknown
    - cargo install soroban-cli
    - soroban contract build
    - npx @argus/cli verify $VERIFICATION_CODE

Troubleshooting

"WASM binary not found"

Build your contract first:

soroban contract build

"Cargo.toml not found"

Make sure you're in the contract directory:

cd my-contract
argus verify X7K9M2

"Invalid verification code"

• Codes are 6 characters (e.g., X7K9M2)
• Codes expire after 30 minutes
• Generate a new code at argus.security/developer

"WASM hash mismatch"

Your local WASM doesn't match the deployed contract:

1. Rebuild: soroban contract build
2. Redeploy if needed
3. Generate new verification code
4. Run verification again

"Git repository not accessible"

Make sure your repository is:

• Public on GitHub/GitLab
• Pushed to remote: git push origin main

Environment Variables

| Variable | Description | Default | |----------|-------------|---------| | ARGUS_API_URL | API endpoint | https://argus.security | | ARGUS_TIMEOUT | Request timeout (seconds) | 30 |

Support

• Website: https://argus.security
• Documentation: https://argus.security/docs
• GitHub: https://github.com/argus-security/argus
• Email: [email protected]

License

MIT License - see LICENSE for details.