A tool and standard for verifying that deployed on-chain program bytecode matches public source code. `solana-verify build` produces a deterministic build using Docker, and `solana-verify verify-from-repo` checks the deployed binary against a Git repo. Verified programs are listed on the Solana Explorer and OtterSec's verify registry, increasing user trust.
Start with the shortest useful explanation before going deeper.
A tool and standard for verifying that deployed on-chain program bytecode matches public source code. `solana-verify build` produces a deterministic build using Docker, and `solana-verify verify-from-repo` checks the deployed binary against a Git repo. Verified programs are listed on the Solana Explorer and OtterSec's verify registry, increasing user trust.
Use the quick analogy first so the term is easier to reason about when you meet it in code, docs, or prompts.
Think of it as a tool or abstraction that removes friction from shipping on Solana.
Place the term inside its Solana layer so the definition is easier to reason about.
Anchor, local validators, explorers, SDKs, and testing workflows.
Turn the term from vocabulary into something operational for product and engineering work.
This term unlocks adjacent concepts quickly, so it works best when you treat it as a junction instead of an isolated definition.
Use this compact block when you want to give an agent or assistant grounded context without dumping the entire page.
Solana Verify (solana-verifiable-build) (solana-verify) Category: Developer Tools Definition: A tool and standard for verifying that deployed on-chain program bytecode matches public source code. `solana-verify build` produces a deterministic build using Docker, and `solana-verify verify-from-repo` checks the deployed binary against a Git repo. Verified programs are listed on the Solana Explorer and OtterSec's verify registry, increasing user trust. Related: Program, Security Audit
Use glossary context, relationships, mental models, and builder paths to get structured answers instead of generic chat output.
Optional: paste Anchor, Solana, or Rust code so the Copilot can map primitives back to glossary terms.
The Copilot will answer using the current term, related concepts, mental models, and the surrounding glossary graph.
These branches show which concepts this term touches directly and what sits one layer beyond them.
Executable code deployed on-chain, equivalent to a smart contract on other blockchains. Programs are stateless—they store no data themselves but read/write data in separate accounts they own. Programs are compiled to SBF bytecode and loaded via the BPF Loader. Every program has a unique Program ID (its account's public key).
A formal, structured review of a Solana program's source code, architecture, and deployment configuration by experienced security researchers, aimed at identifying vulnerabilities — including but not limited to the OWASP-equivalent Solana Top 10 (missing signer checks, owner checks, arithmetic errors, etc.) — before mainnet deployment. Reputable Solana-focused audit firms include OtterSec, Ackee Blockchain, sec3 (formerly Soteria), Neodyme, Trail of Bits, and Halborn; most audits produce a severity-rated finding report (critical, high, medium, low, informational) that programs are expected to remediate and publish. A single audit is considered minimum due diligence for programs holding significant user funds; continuous auditing and bug bounties on platforms like Immunefi are considered best practice.
These are the next concepts worth opening if you want this term to make more sense inside a real Solana workflow.
These entries are easy to mix up when you are reading quickly, prompting an LLM, or onboarding into a new layer of Solana.
The Rust crate (solana-sdk) providing types and utilities for building Solana clients and programs. For on-chain programs, use `solana-program` (no-std compatible subset). For off-chain clients, use `solana-sdk` (full features including keypair generation, transaction signing). The SDK includes types like Pubkey, Instruction, Transaction, and Account.
The official command-line tool for interacting with Solana clusters. Key commands: `solana balance`, `solana transfer`, `solana program deploy`, `solana config set --url`, `solana airdrop` (devnet). Configuration in `~/.config/solana/cli/config.yml` sets the default cluster URL and keypair path.
A comprehensive mobile development toolkit for building Solana-native Android dApps, including an SDK for wallet integration, a Seed Vault for secure key management, and the Solana dApp Store for distribution outside traditional app stores. SMS enables mobile-first interaction with Solana programs, token management, and transaction signing from Android devices.
Glossary entries become useful when they are connected. These links are the shortest path to adjacent ideas.
Executable code deployed on-chain, equivalent to a smart contract on other blockchains. Programs are stateless—they store no data themselves but read/write data in separate accounts they own. Programs are compiled to SBF bytecode and loaded via the BPF Loader. Every program has a unique Program ID (its account's public key).
A formal, structured review of a Solana program's source code, architecture, and deployment configuration by experienced security researchers, aimed at identifying vulnerabilities — including but not limited to the OWASP-equivalent Solana Top 10 (missing signer checks, owner checks, arithmetic errors, etc.) — before mainnet deployment. Reputable Solana-focused audit firms include OtterSec, Ackee Blockchain, sec3 (formerly Soteria), Neodyme, Trail of Bits, and Halborn; most audits produce a severity-rated finding report (critical, high, medium, low, informational) that programs are expected to remediate and publish. A single audit is considered minimum due diligence for programs holding significant user funds; continuous auditing and bug bounties on platforms like Immunefi are considered best practice.
These entries live beside the current term and help the page feel like part of a larger knowledge graph instead of a dead end.
The most popular framework for building Solana programs in Rust. Anchor provides macros (#[program], #[account], #[derive(Accounts)]) that auto-generate boilerplate for account validation, serialization, discriminators, and error handling. It includes a CLI (anchor init/build/test/deploy), IDL generation, and TypeScript client generation. Reduces program code by ~80% compared to native development.
The Anchor macro applied to structs to define on-chain account data layouts. `#[account]` auto-derives Borsh serialization, adds an 8-byte discriminator prefix (SHA-256 of 'account:<Name>'), and implements space calculation. Optional attributes: `#[account(zero_copy)]` for zero-copy deserialization of large accounts.
The Anchor macro that defines the accounts struct for an instruction. Each field specifies an account with validation constraints. Account types include: `Account<'info, T>` (deserialized), `Signer<'info>` (must sign), `Program<'info, T>` (program reference), `SystemAccount<'info>`, and `UncheckedAccount<'info>` (no validation, use carefully).
Declarative validation rules on Anchor account fields. Key constraints: `#[account(mut)]` (writable), `#[account(init, payer=x, space=n)]` (create), `#[account(seeds=[...], bump)]` (PDA validation), `#[account(has_one=field)]` (field equality), `#[account(constraint = expr)]` (custom boolean), `#[account(close=target)]` (close and reclaim rent).