Soroban Call Policy rules control who can call smart contracts on Stellar, which vault accounts they use, and which contracts they can call.
Soroban is the smart contract platform on the Stellar network. A Soroban contract call runs a function in a smart contract, which is a program deployed on the blockchain. Fireblocks evaluates every Soroban contract call against your policy before signing it.
When do you need a Soroban Call rule?
Soroban contract calls have their own operation type in the policy editor: Soroban Call. Fireblocks evaluates Soroban contract calls only against Soroban Call rules. Rules for other operation types, including Contract Call, Mint, Burn, and Transfer, do not apply to them.
If no Soroban Call rule matches a call, Fireblocks blocks it. You must add at least one Soroban Call rule before anyone in your workspace can make a Soroban contract call.
Rule parameters
Use the following parameters to govern Soroban contract calls:
| Parameter | What it controls |
|---|---|
| Rule name | A name that identifies the rule in your policy. |
| Initiator | The users, groups, or API users who can create the call. |
| Source | The vault accounts the call can be made from. |
| Destination | The contracts the call can target. See Destination options. |
| Designated signer | The user who signs calls that match the rule. |
| Action | What happens when a call matches the rule: Allow or Block. |
Soroban Call rules do not support conditions on asset or amount, and they cannot send a call for approval. To control which calls go through, combine the initiator, source, and destination conditions with the Allow and Block actions.
Destination options
The destination of a Soroban contract call is the contract being called. Select one of these options:
- Any: Allows calls to any Soroban contract. If one-time addresses are enabled for your workspace, use this option to allow calls to contracts that are not whitelisted.
- Whitelisted only: Restricts calls to contracts you have added to your workspace whitelist. See Whitelist a Soroban contract.
Important: Fireblocks recommends Whitelisted only, so that your vault accounts can call only contracts your team has reviewed and approved.
Whitelist a Soroban contract
To allow calls to a specific contract under a Whitelisted only rule, add the contract to your whitelist as a contract wallet:
- Add a contract wallet and give it a name that identifies the contract.
- Select XLM as the asset for mainnet (live network) contracts, or XLM_TEST for testnet (test network) contracts.
- Enter the contract address. Soroban contract addresses start with the letter C.
The new contract has the status Pending Approval until your workspace approves it. When the contract is approved, Soroban Call rules with the Whitelisted only destination option apply to calls to it.
Add a Soroban Call rule
- In the Fireblocks Console, go to Policies.
- Select the Policy you want to edit, then select Edit policy.
- Select + Add rule and Soroban Call as the operation type.
- Set the Initiator, Source, and Destination for the rule.
- Optionally, select a Designated signer.
- Select the Action: Allow or Block.
- Save the rule and publish the Policy.
Your workspace's approval group must approve policy changes before they take effect.
Rule order
The Policy Engine applies the first rule that matches a call, scanning your policy from top to bottom. Place more specific rules above broader ones. For example, a rule that blocks calls from a particular vault account must sit above a rule that allows calls from all vault accounts. Otherwise, the broader rule matches first.
Example: Allow one team to call a lending contract
Your treasury team needs to call a lending contract from the Treasury vault account, and no one else should make Soroban contract calls.
- Add the lending contract to your whitelist as a contract wallet with XLM as the asset, and wait for approval.
- Add one Soroban Call rule with these values:
| Parameter | Value |
|---|---|
| Initiator | Treasury team group |
| Source | Treasury vault account |
| Destination | Whitelisted only |
| Action | Allow |
Fireblocks blocks any Soroban contract call that does not match this rule, because no other Soroban Call rule matches it.
Because the destination is set to Whitelisted only, the rule allows calls to every Stellar contract on your whitelist. To limit the treasury team to the lending contract, keep it as the only Stellar contract on your whitelist.