Security audit of stealth-announcer Soroban contract

[gloskull]

Motivation

• Provide a focused security review of the Soroban stealth-announcer crate and produce concrete, machine-verifiable reproducer tests for each finding.
• Surface Soroban-specific event semantics (caller attribution), metadata sizing, ephemeral key validity, and CPI behavior so implementers and indexers can harden or document expected behavior.

Description

• Add a Markdown audit report at stellar/stealth-announcer/audits/2026-05-gpt-5-3-codex.md documenting scope, findings (WA-ANN-01..04), reproductions, and recommendations.
• Add integration reproducer tests at stellar/stealth-announcer/tests/audit.rs that verify caller attribution, oversized metadata acceptance, zero ephemeral key acceptance, and permissionless CPI emission.
• Adjust stellar/stealth-announcer/Cargo.toml to build rlib in addition to cdylib so the contract client can be imported into tests.
• Add an ## Unreleased changelog entry at CHANGELOG.md and disable test snapshot emission in the new tests via a test Env config to avoid writing snapshot artifacts during normal runs.

Testing

• Ran cargo fmt -p stealth-announcer -- --check which completed successfully.
• Ran cargo test -p stealth-announcer which passed all tests (the crate's 2 existing unit tests plus the 4 new audit tests; total 6 tests passed).

---

Closes #1

[drips-wave]

@gloskull Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[gloskull]

@truthixify please review and merge

[truthixify]

WA-ANN-01 is the kind of finding that's easy to miss and has real downstream impact — the EVM/Stellar parity gap on caller semantics would have silently corrupted indexer attribution at scale. The recommendation also gives us two viable resolution paths, which is exactly what an audit report should do.

The Low/Informational items (unbounded metadata, zero ephemeral pub key, indistinguishable CPI calls) are documented with the right severity rating and reproductions; none of these are blocking, but they're each worth a follow-up issue for hardening.

Findings table format matches the template, the reproducers in tests/audit.rs are concrete, and the CHANGELOG entry is wired. Thanks @gloskull.