1

I am looking for help wrapping my head around how upgrades to the SPL Token Program affect SPL Tokens that have already been deployed, and what the implications are for auditing.

For context, I am coming from the Ethereum ecosystem so auditing token functionality is straightforward - one contract at one address corresponds to one token, and the code for how that token will behave is all right there. SPL tokens, to the best of my understanding, are just chunks of data that can be interacted with based on Token Program logic. But because SPL Token Program logic itself is not immutable, it seems impossible to get the same assurances about token behavior as you would get with an Ethereum-based token. To illustrate:

Let's say I deployed SPL Token X on Jan 1. On Jan 2, the SPL Token Program gets updated so include a new function (I know that this wouldn't happen in practice, but bear with me for illustration purposes). Does Token X have access to that new function, or is its functionality "pinned" to the Jan 1 version of the code? If the former, how can I confirm on-chain what version of the SPL Token Program is currently being used without purely relying on the GitHub repo? If the latter, how can I check which version a given token is pinned to?

Like I said, I am coming from the Ethereum ecosystem so may be thinking about things the totally wrong way; thanks for bearing with me.

Improve this question

1 Answer 1

Reset to default
1

Since there's only one token program that handles the processing for all SPL tokens, all token mints are automatically "upgraded" whenever there's a new release of the SPL token program.

You can find information about verifying the source code against what's on-chain using the GitHub repo and performing a verifiable build using Anchor's build tools: https://github.com/solana-labs/solana-program-library/releases/tag/token-v3.4.0

Behind the scenes, this simply spins up a Docker container with the Solana build tools, builds the program, and then copies out the resulting shared object.

On top of that, the Anchor program registry hosts the source code of deployed programs, but it seems to be in transition from the "Project Serum" version to the "Coral" version. You can find more info at https://www.anchor-lang.com/docs/publishing-source

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.