CrashLab throws thousands of mutated inputs at your Stellar smart contracts and watches what breaks. Catches the panics, resource overflows, and auth bypasses that manual testing misses.
How it works
Drop in a WASM file or paste a Stellar contract ID. CrashLab reads the exported functions and figures out what to break. No config needed to get started.
Pick which functions to stress, set mutation depth, resource limits, and how long to run. Or just hit start and let it figure things out on its own.
The fuzzer generates thousands of mutated inputs, sends them to your contract on a local or testnet Stellar node, and watches for panics, out of bounds reads, and resource overflows.
Crashes cluster by signature. The board groups identical failures together, shows the exact call sequence that triggered each one, and links to the ledger changes.
Export a reproduction snippet, open a GitHub issue straight from the dashboard, or feed the failure into CI. Every crash comes with a replayable proof.
Live sandbox
Features
No manual test writing. The fuzzer generates thousands of broken inputs on its own and finds the edge cases you never thought to test.
Identical crashes group by signature. Instead of staring at five hundred failures, you see twelve distinct bugs. Triage in minutes, not days.
Every crash ships with a deterministic call sequence. Replay it on your machine, feed it into CI, and prove the fix actually works.
Performance heatmaps, crash trend timelines, and anomaly detection give you the full picture at a glance. Spot patterns before they become incidents.
GitHub Actions, webhooks, and API tokens let you wire CrashLab into your deployment pipeline. Break the build before the bug ships to production.
Not a generic fuzzer with Soroban bolted on. Built from the ground up for Stellar's Soroban VM. Understands resource fees, auth trees, and contract storage.
Why this matters
Unit tests cover the paths you thought of. Fuzzing covers the ones you did not. That is where the exploits live.
Bots scan new contracts within minutes of deployment. If your contract has a resource overflow or auth bypass, they will find it before you do.
CrashLab is free and open source. There is no reason to ship a contract without running it through automated mutation testing first.
CrashLab is free and open source. Point it at a contract and see what the fuzzer finds. Takes about five minutes to get your first results.
Open App