scout-audit fails with soroban-sdk 25.3.1: wasm32v1-none target required

[yripper]

Description

cargo scout-audit v0.3.16 fails to compile contracts that use soroban-sdk 25.3.1 because scout hardcodes the wasm32-unknown-unknown target. Since Rust 1.82+, soroban-sdk rejects wasm32-unknown-unknown and requires wasm32v1-none.

Error

error: failed to run custom build command for `soroban-sdk v25.3.1`

Caused by:
  process didn't exit successfully: `.../build-script-build` (exit status: 101)
  --- stderr
  thread 'main' panicked at soroban-sdk-25.3.1/build.rs:14:17:
  Rust compiler 1.82+ with target 'wasm32-unknown-unknown' is unsupported by the Soroban Environment,
  use 'wasm32v1-none' available with Rust 1.84+. The 'wasm32-unknown-unknown' target in Rust 1.82+
  has features enabled that are not yet supported and not easily disabled: reference-types, multi-value.
  If you must build for the 'wasm32-unknown-unknown' use Rust 1.81 or earlier.

The summary shows Compilation errors / N/A for all categories:

+---------------------+--------------------+----------+--------+-------+-------------+
| Crate               | Status             | Critical | Medium | Minor | Enhancement |
+---------------------+--------------------+----------+--------+-------+-------------+
| vault_roles_manager | Compilation errors | N/A      | N/A    | N/A   | N/A         |
+---------------------+--------------------+----------+--------+-------+-------------+

Root Cause

1. Target selection: Scout hardcodes wasm32-unknown-unknown in prepare_args() at apps/cargo-scout-audit/crates/cargo-scout-audit/src/cli_args/mod.rs. For Soroban projects this needs to be wasm32v1-none.

2. Nightly toolchain: Even after patching the target selection to wasm32v1-none, the internal dylint build uses nightly-2025-08-07 with -Zbuild-std=std,core,alloc, which doesn't work cleanly with wasm32v1-none (panic_unwind compilation failures). The nightly toolchain likely needs updating to one that fully supports -Zbuild-std with wasm32v1-none.

What I Tried

• Passing --target=wasm32v1-none as a CLI arg — scout's internal dylint build still uses wasm32-unknown-unknown
• Patching prepare_args() to use wasm32v1-none for Soroban blockchain type — target selection works, but then -Zbuild-std fails with the current nightly

Expected Behavior

cargo scout-audit should work out of the box with soroban-sdk 25.3.1 contracts.

Environment

• cargo-scout-audit: 0.3.16
• soroban-sdk: 25.3.1
• Rust: 1.94.1 (stable)
• Stellar CLI: 26.0.0
• OS: macOS aarch64 (Apple Silicon)
• rustup: 1.29.0

Suggested Fix

• Update target selection to use wasm32v1-none when blockchain type is Soroban
• Update the nightly toolchain to one that supports -Zbuild-std with wasm32v1-none
• Consider using stellar contract build for the WASM compilation step instead of raw cargo + -Zbuild-std, as the Stellar CLI handles target selection correctly

[XianPaz]

This is caused by an incompatibility between Soroban SDK 25.3.1 and rustc. We raised a bug report with the Soroban SDK maintainers here.

[tupui]

@XianPaz any updates there? I can't seem to be able to use the tooling.