Definition
Solana’s term for a smart contract: executable code deployed to an account. Programs are stateless; they read and write data stored in separate accounts.
Why it matters
Because Solana programs are stateless, a program’s security depends on how it validates the accounts passed to it. That is the main thing auditors check.
What to check
- Ask who holds the upgrade authority.
- Ask whether a verifiable build is published for the mainnet deployment.
Related terms
- AccountThe unit of storage on Solana.
- Upgrade authorityThe key allowed to replace a deployed program’s code.
- Verifiable buildA reproducible build that lets anyone confirm the program deployed on-chain was compiled from a specific public commit of its source code.
- AnchorThe most widely used framework for writing Solana programs in Rust.
Guides
- Solana pre-launch security checklist: 15 checks before mainnetA practical checklist for launching a Solana program on mainnet: upgrade authority, multisig, verifiable builds, token authorities, monitoring, incident response and the audit.
- Anchor vs native Rust for Solana programs: how to chooseAnchor or native Rust for your Solana program? The real trade-offs in safety, speed of development, compute usage, tooling and hiring, and when each choice makes sense.
Get an indicative price range and timeline for auditing your Solana programs, then compare verified auditors.
Estimate your audit cost →