Definition
A reproducible build that lets anyone confirm the program deployed on-chain was compiled from a specific public commit of its source code.
Why it matters
Without a verifiable build, users and auditors cannot be sure the audited source is what is actually deployed. Explorers can show a verified badge when the build matches.
What to check
- Ask for a verifiable build of every mainnet deployment and the commit it maps to.
Related terms
- ProgramSolana’s term for a smart contract: executable code deployed to an account.
- Audit (smart contract audit)An independent security review of a program at a specific commit, usually by a specialised firm, that reports vulnerabilities and recommendations before launch.
- Upgrade authorityThe key allowed to replace a deployed program’s code.
Guides
- How to choose a Solana smart contract auditor: a practical checklistWhat actually matters when picking a Solana auditor: Anchor and native Rust experience, methodology, scope, timelines, red flags in quotes and what a good report looks like.
- Solana pre-launch security checklist: 15 checks before mainnetA practical checklist for launching a Solana program on mainnet: upgrade authority, multisig, verifiable builds, token authorities, monitoring, incident response and the audit.
Get an indicative price range and timeline for auditing your Solana programs, then compare verified auditors.
Estimate your audit cost →