Error codes returned by system calls.
Each syscall can return a specific subset of these error codes.
Check the syscalls.yaml documentation for which errors each syscall can return.
Sets the bytestring value at the specified storage key. Note that this will overwrite any existing value at that key, even if that value has a different type.
Changes the public key registration for the current contract address at the specified key index. If key_scheme is None, the key is removed. Otherwise, the key is set with the provided scheme, bytes, and weight.
Clears every storage flag the current transaction requests for the key, as visible in the current call frame. Does nothing if no write to the key is pending, since such a key has no flags. As with SetStorageFlags, a clear made in a frame that aborts is discarded with that frame.
Logs the input buffer to the console. This is a no-op on release builds or when deployed on-chain.
This will not cause an error if a contract inadvertently includes this syscall in a production contract deployment (if, for example, a contract built in debug mode is uploaded), but there is no reason to do so.
Deploys a contract with the specified nonce and contract hash to a computed address. The contract must be provided in the transaction’s contracts_to_deploy field.
Terminates execution of the current call frame immediately. The current call frame reverts, returning a deterministic error to the caller (with no return buffer available). Equivalent to a guest trap.
Returns the timepoint of the block currently executing. The value is fixed by the coordinator before execution begins and is carried in the block’s ProposalHeader, so it is part of the block identity and is identical for every invocation in the block.
Like a block height, this is consensus data rather than a trusted clock: it is chosen by the proposer within whatever bounds the network’s validators enforce. Contracts should treat it as coarse-grained wall-clock time – suitable for expiries, vesting schedules and deadlines – and must not rely on it for fine-grained ordering or as a source of randomness.
Returns the length of the calldata supplied to the invocation associated with the current call frame. Also returns the number N of auth tokens supplied to the invocation, which are the current frame’s auth token ids 0..N-1.
Computes the address that would be deployed for a contract with the given deployer address, nonce, and contract hash. This is a pure computation and does not actually deploy the contract. If caller_address is omitted, the current contract’s address is used, giving the address DeployContract would use.
Returns the hash of the network name, the identifier that separates this network’s blocks from those of every other network. It is fixed for the life of the network, so it is constant across every block and every invocation.
Transaction signatures already commit to this value (the signature preimage is cxs(DomainSeparator("Transaction")) || network_hash || xdr(tx)). Exposing it to contracts lets a contract bind its own off-chain signed messages to this network the same way, so a message signed for one network cannot be replayed against a contract at the same address on another.
Returns the hash of the transaction that initiated the current execution: sha256 of the XDR-encoded Transaction, the same TransactionHash that identifies it network-wide.
Returns the storage flags the current transaction requests for the key, as visible in the current call frame. A key with no pending write has no flags, so it reads as StorageDeltaFlags::None, the same as a pending write without flags.
Returns a transaction statistic value. Note that statistics may be disabled in release builds or production execution, and may return nondeterministic values in test configurations. Nondeterministic stats will be disabled in production settings.
Invokes the specified method of the contract at the specified
address, with the supplied parameters. Creates a new invocation
frame, which terminates upon conclusion of the Invoke() syscall.
Logs an event with up to 3 topics and additional data. Constructs a TxEmittedEvent where the serialized_event field contains the topics prepended to the data: topic0 || topic1 || topic2 || data. The num_topics field indicates how many leading 32-byte chunks are topics, enabling downstream indexers to efficiently filter events. Events are stored in the transaction’s event log and accumulated into a per-block merkle-patricia trie.
Retrieves the nonnegative integer value at the specified storage key.
current_set_opt reports whether current_set holds a value; when it is false, current_set carries no information and should be ignored.
If force_load_from_snapshot is true, then current_set_opt is always true on success. If the snapshot value is not an NNInt, or the previous write on that key was not an NNInt, then the syscall returns kSyscallErrorCodeInvalidSyscallInput. If the snapshot value does not exist, or has been deleted by the prior write, then it returns kSyscallErrorCodeStorageKeyNotExist.
If force_load_from_snapshot is false, then the prior state of the item is ignored unless the prior write on that key is an NNInt write (in which case the parameters of that write are returned). If the prior write is not an NNInt, or was a deletion, then current_set_opt is false and current_add is 0.
Sets or modifies a nonnegative integer at the specified storage key. The set_value (if provided) sets the base value, and add_value is added as a delta. The final value must remain nonnegative. Will overwrite any value of that key, even if that value has a different type.
Inserts an entry into the retrocausal queue at the specified storage key. Like any storage write, this replaces a value of another type at the key. A queue with no live entries does not exist.
Returns the byte length of the next entry in the retrocausal queue at the specified storage key, without consuming it: the queue_entry buffer size RetrocausalQueueConsume needs to read that entry whole.
Returns data from the current call frame and optionally marks the frame for revert. The return buffer will be available to the caller via GetReturnedBuffer. Immediately terminates execution of the current invocation.
The syscall never returns an error. Instead, the frame faults with a deterministic error (equivalent to Exit) if the buffer is longer than kConfigParamMaxReturnBufferLen, if auth tokens are returned from a frame marked for revert, or if the returned auth token id list is longer than kConfigParamMaxAuthTokens, malformed, duplicated, or names tokens the current frame does not own.
Copies the in-progress SHA256 hash computation at src_index to dst_index, replacing any hash computation already at dst_index. Both computations can then be extended and finalized independently. Copying an index onto itself succeeds and changes nothing.
Updates the SHA256 hash computation at the specified index with the provided buffer. If reset is true, the hash input is reset before updating. The buffer must exist if reset is false. There is no cumulative byte limit.
Adds flags (a bitwise OR) to the storage flags the current transaction requests for the key. Writes never change a key’s flags: every change the transaction commits on the key carries the flags accumulated here, whichever write produced it. ClearStorageFlags removes them.
A write to the key must be pending in the current call frame’s view of the transaction: one made earlier in this frame, or inherited from a caller or from a successful callee. A pending deletion qualifies; a value that exists only in the block snapshot does not. Flags set in a frame that aborts are discarded along with that frame’s writes.
Verifies a cryptographic signature against a public key and message. Returns kSyscallErrorCodeNone if verification succeeds, otherwise returns an error.
Writes the required weight threshold for the current contract address. This is the minimum total weight of signing keys needed to authorize a transaction from this address.
Retrieves the bytestring stored at the specified key.
written_len is the full length of the bytestring, not the number of bytes copied: at most bytestring.len() bytes are written, and a written_len greater than bytestring.len() means the output was truncated.
Sets the bytestring value at the specified storage key. Note that this will overwrite any existing value at that key, even if that value has a different type.
Changes the public key registration for the current contract address at the specified key index. If key_scheme is None, the key is removed. Otherwise, the key is set with the provided scheme, bytes, and weight.
Clears every storage flag the current transaction requests for the key, as visible in the current call frame. Does nothing if no write to the key is pending, since such a key has no flags. As with SetStorageFlags, a clear made in a frame that aborts is discarded with that frame.
Logs the input buffer to the console. This is a no-op on release builds or when deployed on-chain.
This will not cause an error if a contract inadvertently includes this syscall in a production contract deployment (if, for example, a contract built in debug mode is uploaded), but there is no reason to do so.
Consumes an authentication token for the current contract address. Returns any nested tokens unwrapped by the token.
auth_payload_written_len is the full length of the token’s payload, not the number of bytes copied: at most auth_payload.len() bytes are written, and a larger value means the payload was truncated. The token is consumed either way, so a truncated payload cannot be read again.
Deploys a contract with the specified nonce and contract hash to a computed address. The contract must be provided in the transaction’s contracts_to_deploy field.
Terminates execution of the current call frame immediately. The current call frame reverts, returning a deterministic error to the caller (with no return buffer available). Equivalent to a guest trap.
Returns the timepoint of the block currently executing. The value is fixed by the coordinator before execution begins and is carried in the block’s ProposalHeader, so it is part of the block identity and is identical for every invocation in the block.
Like a block height, this is consensus data rather than a trusted clock: it is chosen by the proposer within whatever bounds the network’s validators enforce. Contracts should treat it as coarse-grained wall-clock time – suitable for expiries, vesting schedules and deadlines – and must not rely on it for fine-grained ordering or as a source of randomness.
Returns the calldata supplied to the invocation associated with the current call frame.
written_len is the full length of the calldata, not the number of bytes copied: at most buffer.len() bytes are written, and a written_len greater than buffer.len() means the output was truncated.
Also returns the number N of auth tokens supplied to the invocation. Auth token ids are local to each call frame, and the supplied tokens are the current frame’s ids 0..N-1, in the order the caller listed them.
Returns the length of the calldata supplied to the invocation associated with the current call frame. Also returns the number N of auth tokens supplied to the invocation, which are the current frame’s auth token ids 0..N-1.
Computes the address that would be deployed for a contract with the given deployer address, nonce, and contract hash. This is a pure computation and does not actually deploy the contract. If caller_address is omitted, the current contract’s address is used, giving the address DeployContract would use.
Returns the hash of the network name, the identifier that separates this network’s blocks from those of every other network. It is fixed for the life of the network, so it is constant across every block and every invocation.
Transaction signatures already commit to this value (the signature preimage is cxs(DomainSeparator("Transaction")) || network_hash || xdr(tx)). Exposing it to contracts lets a contract bind its own off-chain signed messages to this network the same way, so a message signed for one network cannot be replayed against a contract at the same address on another.
Returns the return buffer from the most recent subcall invocation that ended with Return, including a Return that marked the frame for revert.
written_len is the full length of the return buffer, not the number of bytes copied: at most buffer.len() bytes are written, and a written_len greater than buffer.len() means the output was truncated.
Also returns the auth tokens that subcall returned, as the current frame’s auth token ids start..start+count-1. The returned tokens join the frame under consecutive new ids, in the order the subcall listed them.
Returns the hash of the transaction that initiated the current execution: sha256 of the XDR-encoded Transaction, the same TransactionHash that identifies it network-wide.
Returns the storage flags the current transaction requests for the key, as visible in the current call frame. A key with no pending write has no flags, so it reads as StorageDeltaFlags::None, the same as a pending write without flags.
Returns a transaction statistic value. Note that statistics may be disabled in release builds or production execution, and may return nondeterministic values in test configurations. Nondeterministic stats will be disabled in production settings.
Invokes the specified method of the contract at the specified
address, with the supplied parameters. Creates a new invocation
frame, which terminates upon conclusion of the Invoke() syscall.
Logs an event with up to 3 topics and additional data. Constructs a TxEmittedEvent where the serialized_event field contains the topics prepended to the data: topic0 || topic1 || topic2 || data. The num_topics field indicates how many leading 32-byte chunks are topics, enabling downstream indexers to efficiently filter events. Events are stored in the transaction’s event log and accumulated into a per-block merkle-patricia trie.
Retrieves the nonnegative integer value at the specified storage key.
current_set_opt reports whether current_set holds a value; when it is false, current_set carries no information and should be ignored.
If force_load_from_snapshot is true, then current_set_opt is always true on success. If the snapshot value is not an NNInt, or the previous write on that key was not an NNInt, then the syscall returns kSyscallErrorCodeInvalidSyscallInput. If the snapshot value does not exist, or has been deleted by the prior write, then it returns kSyscallErrorCodeStorageKeyNotExist.
If force_load_from_snapshot is false, then the prior state of the item is ignored unless the prior write on that key is an NNInt write (in which case the parameters of that write are returned). If the prior write is not an NNInt, or was a deletion, then current_set_opt is false and current_add is 0.
Sets or modifies a nonnegative integer at the specified storage key. The set_value (if provided) sets the base value, and add_value is added as a delta. The final value must remain nonnegative. Will overwrite any value of that key, even if that value has a different type.
Consumes (or peeks at) the next entry from the retrocausal queue at the specified storage key. If peek is true, the entry is not removed from the queue. A read never changes the type of the key; a same-block conversion by another transaction is visible only from the next block.
written_len is the full length of the entry, not the number of bytes copied: at most queue_entry.len() bytes are written, and a written_len greater than queue_entry.len() means the output was truncated. A consumed entry is removed even if it was truncated, so size queue_entry with RetrocausalQueuePeekLen first.
Inserts an entry into the retrocausal queue at the specified storage key. Like any storage write, this replaces a value of another type at the key. A queue with no live entries does not exist.
Returns the byte length of the next entry in the retrocausal queue at the specified storage key, without consuming it: the queue_entry buffer size RetrocausalQueueConsume needs to read that entry whole.
Returns data from the current call frame and optionally marks the frame for revert. The return buffer will be available to the caller via GetReturnedBuffer. Immediately terminates execution of the current invocation.
The syscall never returns an error. Instead, the frame faults with a deterministic error (equivalent to Exit) if the buffer is longer than kConfigParamMaxReturnBufferLen, if auth tokens are returned from a frame marked for revert, or if the returned auth token id list is longer than kConfigParamMaxAuthTokens, malformed, duplicated, or names tokens the current frame does not own.
Copies the in-progress SHA256 hash computation at src_index to dst_index, replacing any hash computation already at dst_index. Both computations can then be extended and finalized independently. Copying an index onto itself succeeds and changes nothing.
Updates the SHA256 hash computation at the specified index with the provided buffer. If reset is true, the hash input is reset before updating. The buffer must exist if reset is false. There is no cumulative byte limit.
Adds flags (a bitwise OR) to the storage flags the current transaction requests for the key. Writes never change a key’s flags: every change the transaction commits on the key carries the flags accumulated here, whichever write produced it. ClearStorageFlags removes them.
A write to the key must be pending in the current call frame’s view of the transaction: one made earlier in this frame, or inherited from a caller or from a successful callee. A pending deletion qualifies; a value that exists only in the block snapshot does not. Flags set in a frame that aborts are discarded along with that frame’s writes.
Verifies a cryptographic signature against a public key and message. Returns kSyscallErrorCodeNone if verification succeeds, otherwise returns an error.
Writes the required weight threshold for the current contract address. This is the minimum total weight of signing keys needed to authorize a transaction from this address.
Retrieves the bytestring stored at the specified key.
written_len is the full length of the bytestring, not the number of bytes copied: at most bytestring.len() bytes are written, and a written_len greater than bytestring.len() means the output was truncated.
Sets the bytestring value at the specified storage key. Note that this will overwrite any existing value at that key, even if that value has a different type.
Changes the public key registration for the current contract address at the specified key index. If key_scheme is None, the key is removed. Otherwise, the key is set with the provided scheme, bytes, and weight.
Clears every storage flag the current transaction requests for the key, as visible in the current call frame. Does nothing if no write to the key is pending, since such a key has no flags. As with SetStorageFlags, a clear made in a frame that aborts is discarded with that frame.
Logs the input buffer to the console. This is a no-op on release builds or when deployed on-chain.
This will not cause an error if a contract inadvertently includes this syscall in a production contract deployment (if, for example, a contract built in debug mode is uploaded), but there is no reason to do so.
Consumes an authentication token for the current contract address. Returns any nested tokens unwrapped by the token.
auth_payload_written_len is the full length of the token’s payload, not the number of bytes copied: at most auth_payload.len() bytes are written, and a larger value means the payload was truncated. The token is consumed either way, so a truncated payload cannot be read again.
Deploys a contract with the specified nonce and contract hash to a computed address. The contract must be provided in the transaction’s contracts_to_deploy field.
Terminates execution of the current call frame immediately. The current call frame reverts, returning a deterministic error to the caller (with no return buffer available). Equivalent to a guest trap.
Returns the timepoint of the block currently executing. The value is fixed by the coordinator before execution begins and is carried in the block’s ProposalHeader, so it is part of the block identity and is identical for every invocation in the block.
Like a block height, this is consensus data rather than a trusted clock: it is chosen by the proposer within whatever bounds the network’s validators enforce. Contracts should treat it as coarse-grained wall-clock time – suitable for expiries, vesting schedules and deadlines – and must not rely on it for fine-grained ordering or as a source of randomness.
Returns the calldata supplied to the invocation associated with the current call frame.
written_len is the full length of the calldata, not the number of bytes copied: at most buffer.len() bytes are written, and a written_len greater than buffer.len() means the output was truncated.
Also returns the number N of auth tokens supplied to the invocation. Auth token ids are local to each call frame, and the supplied tokens are the current frame’s ids 0..N-1, in the order the caller listed them.
Returns the length of the calldata supplied to the invocation associated with the current call frame. Also returns the number N of auth tokens supplied to the invocation, which are the current frame’s auth token ids 0..N-1.
Computes the address that would be deployed for a contract with the given deployer address, nonce, and contract hash. This is a pure computation and does not actually deploy the contract. If caller_address is omitted, the current contract’s address is used, giving the address DeployContract would use.
Returns the hash of the network name, the identifier that separates this network’s blocks from those of every other network. It is fixed for the life of the network, so it is constant across every block and every invocation.
Transaction signatures already commit to this value (the signature preimage is cxs(DomainSeparator("Transaction")) || network_hash || xdr(tx)). Exposing it to contracts lets a contract bind its own off-chain signed messages to this network the same way, so a message signed for one network cannot be replayed against a contract at the same address on another.
Returns the return buffer from the most recent subcall invocation that ended with Return, including a Return that marked the frame for revert.
written_len is the full length of the return buffer, not the number of bytes copied: at most buffer.len() bytes are written, and a written_len greater than buffer.len() means the output was truncated.
Also returns the auth tokens that subcall returned, as the current frame’s auth token ids start..start+count-1. The returned tokens join the frame under consecutive new ids, in the order the subcall listed them.
Returns the hash of the transaction that initiated the current execution: sha256 of the XDR-encoded Transaction, the same TransactionHash that identifies it network-wide.
Returns the storage flags the current transaction requests for the key, as visible in the current call frame. A key with no pending write has no flags, so it reads as StorageDeltaFlags::None, the same as a pending write without flags.
Returns a transaction statistic value. Note that statistics may be disabled in release builds or production execution, and may return nondeterministic values in test configurations. Nondeterministic stats will be disabled in production settings.
Invokes the specified method of the contract at the specified
address, with the supplied parameters. Creates a new invocation
frame, which terminates upon conclusion of the Invoke() syscall.
Logs an event with up to 3 topics and additional data. Constructs a TxEmittedEvent where the serialized_event field contains the topics prepended to the data: topic0 || topic1 || topic2 || data. The num_topics field indicates how many leading 32-byte chunks are topics, enabling downstream indexers to efficiently filter events. Events are stored in the transaction’s event log and accumulated into a per-block merkle-patricia trie.
Retrieves the nonnegative integer value at the specified storage key.
current_set_opt reports whether current_set holds a value; when it is false, current_set carries no information and should be ignored.
If force_load_from_snapshot is true, then current_set_opt is always true on success. If the snapshot value is not an NNInt, or the previous write on that key was not an NNInt, then the syscall returns kSyscallErrorCodeInvalidSyscallInput. If the snapshot value does not exist, or has been deleted by the prior write, then it returns kSyscallErrorCodeStorageKeyNotExist.
If force_load_from_snapshot is false, then the prior state of the item is ignored unless the prior write on that key is an NNInt write (in which case the parameters of that write are returned). If the prior write is not an NNInt, or was a deletion, then current_set_opt is false and current_add is 0.
Sets or modifies a nonnegative integer at the specified storage key. The set_value (if provided) sets the base value, and add_value is added as a delta. The final value must remain nonnegative. Will overwrite any value of that key, even if that value has a different type.
Consumes (or peeks at) the next entry from the retrocausal queue at the specified storage key. If peek is true, the entry is not removed from the queue. A read never changes the type of the key; a same-block conversion by another transaction is visible only from the next block.
written_len is the full length of the entry, not the number of bytes copied: at most queue_entry.len() bytes are written, and a written_len greater than queue_entry.len() means the output was truncated. A consumed entry is removed even if it was truncated, so size queue_entry with RetrocausalQueuePeekLen first.
Inserts an entry into the retrocausal queue at the specified storage key. Like any storage write, this replaces a value of another type at the key. A queue with no live entries does not exist.
Returns the byte length of the next entry in the retrocausal queue at the specified storage key, without consuming it: the queue_entry buffer size RetrocausalQueueConsume needs to read that entry whole.
Returns data from the current call frame and optionally marks the frame for revert. The return buffer will be available to the caller via GetReturnedBuffer. Immediately terminates execution of the current invocation.
The syscall never returns an error. Instead, the frame faults with a deterministic error (equivalent to Exit) if the buffer is longer than kConfigParamMaxReturnBufferLen, if auth tokens are returned from a frame marked for revert, or if the returned auth token id list is longer than kConfigParamMaxAuthTokens, malformed, duplicated, or names tokens the current frame does not own.
Copies the in-progress SHA256 hash computation at src_index to dst_index, replacing any hash computation already at dst_index. Both computations can then be extended and finalized independently. Copying an index onto itself succeeds and changes nothing.
Updates the SHA256 hash computation at the specified index with the provided buffer. If reset is true, the hash input is reset before updating. The buffer must exist if reset is false. There is no cumulative byte limit.
Adds flags (a bitwise OR) to the storage flags the current transaction requests for the key. Writes never change a key’s flags: every change the transaction commits on the key carries the flags accumulated here, whichever write produced it. ClearStorageFlags removes them.
A write to the key must be pending in the current call frame’s view of the transaction: one made earlier in this frame, or inherited from a caller or from a successful callee. A pending deletion qualifies; a value that exists only in the block snapshot does not. Flags set in a frame that aborts are discarded along with that frame’s writes.
Verifies a cryptographic signature against a public key and message. Returns kSyscallErrorCodeNone if verification succeeds, otherwise returns an error.
Writes the required weight threshold for the current contract address. This is the minimum total weight of signing keys needed to authorize a transaction from this address.