Reject native asset as a clawback target.

Author: fnando

FULL_HELP_DOCS.md

@@ -2209,7 +2209,7 @@ Claw back tokens from an account or contract (SAC admin)
 
 ###### **Options:**
 
-- `--id <ID>` — The token to claw back: a contract id or alias, `native`, or a classic asset as `CODE:ISSUER`
+- `--id <ID>` — The token to claw back: a contract id or alias, or a classic asset as `CODE:ISSUER`. The native asset has no administrator and cannot be clawed back
 - `--admin <ADMIN>` — The token's administrator. Signs and authorizes the clawback, so it must be an identity or secret key you control (the asset issuer for a Stellar Asset Contract)
 - `--from <FROM>` — Account or contract to claw the tokens back from. Accepts a `G…`/`M…` account, a `C…` contract address, or an alias
 - `--amount <AMOUNT>` — Amount to claw back, in the token's smallest unit (stroops for a Stellar Asset Contract)

cmd/crates/soroban-test/tests/it/integration/token/clawback.rs

@@ -62,6 +62,30 @@ async fn clawback_removes_balance_and_returns_receipt() {
     );
 }
 
+#[tokio::test]
+async fn clawback_rejects_native_target() {
+    let sandbox = &TestEnv::new();
+    let test = test_address(sandbox);
+
+    // The native asset's SAC is deployed without an administrator, so `clawback`
+    // can never apply to it — reject it up front with a typed error instead of
+    // reaching an opaque failing invocation.
+    let stdout = sandbox
+        .new_assert_cmd("token")
+        .args([
+            "clawback", "--id", "native", "--admin", "test", "--from", &test, "--amount", "1",
+            "--output", "json",
+        ])
+        .assert()
+        .failure()
+        .stdout_as_str();
+    let value: Value = serde_json::from_str(&stdout).unwrap();
+    assert_eq!(
+        value["error"]["type"], "native_not_administered",
+        "expected a typed error, got: {stdout}"
+    );
+}
+
 #[tokio::test]
 async fn clawback_fails_when_sac_not_deployed() {
     let sandbox = &TestEnv::new();

cmd/soroban-cli/src/commands/token/clawback.rs

@@ -16,8 +16,9 @@ use crate::{
 #[derive(Debug, Parser, Clone)]
 #[group(skip)]
 pub struct Cmd {
-    /// The token to claw back: a contract id or alias, `native`, or a classic
-    /// asset as `CODE:ISSUER`.
+    /// The token to claw back: a contract id or alias, or a classic asset as
+    /// `CODE:ISSUER`. The native asset has no administrator and cannot be clawed
+    /// back.
     #[arg(long = "id")]
     pub id: UnresolvedToken,
 
@@ -143,6 +144,10 @@ impl Cmd {
         let token = self
             .id
             .resolve(&config.locator, &network.network_passphrase)?;
+        // The native asset's SAC has no administrator, so a clawback against it
+        // can never succeed; reject it up front instead of failing deep in the
+        // call.
+        args::reject_native_admin(&token, "clawback")?;
 
         // The admin only authorizes the clawback; it is not itself a `clawback`
         // argument. The invoke pipeline can't source a transaction from a muxed