Break your Soroban contracts
before someone else does.
CrashLab throws thousands of mutated inputs at your Stellar smart contracts and watches what breaks. Catches the panics, resource overflows, and auth bypasses that manual testing misses.
How it works
From WASM to triaged crash
in five steps.
Point it at your contract
Drop in a WASM file or paste a Stellar contract ID. CrashLab reads the exported functions and figures out what to break. No config needed to get started.
Set up the fuzz campaign
Pick which functions to stress, set mutation depth, resource limits, and how long to run. Or just hit start and let it figure things out on its own.
It mutates, executes, watches
The fuzzer generates thousands of mutated inputs, sends them to your contract on a local or testnet Stellar node, and watches for panics, out of bounds reads, and resource overflows.
Triage what broke
Crashes cluster by signature. The board groups identical failures together, shows the exact call sequence that triggered each one, and links to the ledger changes.
Ship the fix with proof
Export a reproduction snippet, open a GitHub issue straight from the dashboard, or feed the failure into CI. Every crash comes with a replayable proof.
Features
Everything you need to find
the bugs your tests miss.
Mutation fuzzing
No manual test writing. The fuzzer generates thousands of broken inputs on its own and finds the edge cases you never thought to test.
Failure clustering
Identical crashes group by signature. Instead of staring at five hundred failures, you see twelve distinct bugs. Triage in minutes, not days.
Replay and reproduce
Every crash ships with a deterministic call sequence. Replay it on your machine, feed it into CI, and prove the fix actually works.
Analytics and heatmaps
Performance heatmaps, crash trend timelines, and anomaly detection give you the full picture at a glance. Spot patterns before they become incidents.
CI and CD integration
GitHub Actions, webhooks, and API tokens let you wire CrashLab into your deployment pipeline. Break the build before the bug ships to production.
Built for Soroban
Not a generic fuzzer with Soroban bolted on. Built from the ground up for Stellar's Soroban VM. Understands resource fees, auth trees, and contract storage.
Why this matters
Smart contracts hold real money.
One bug can drain everything.
Manual testing misses edge cases
Unit tests cover the paths you thought of. Fuzzing covers the ones you did not. That is where the exploits live.
Attacks are automated now
Bots scan new contracts within minutes of deployment. If your contract has a resource overflow or auth bypass, they will find it before you do.
The tools exist, use them
CrashLab is free and open source. There is no reason to ship a contract without running it through automated mutation testing first.
Ready to break your contracts?
CrashLab is free and open source. Point it at a contract and see what the fuzzer finds. Takes about five minutes to get your first results.
Open App