I'm struggling to find an answer to how to verify solana programs code on Solana (for a SPL token).
On Ethereum there's a function in the IDE to verify the contract, but I can't seem to find out how to do so on Solana.
If someone could point me in the right direction it would be much appreciated.
Thanks!
If by verifying, you mean you need to deploy a contract to deploy a token, then you dont need to do that on solana. You can just use the already deployed SPL token program and create a new token like so:
spl-token create-token
spl-token create-account yourTokenAddress
spl-token mint yourTokenAddress 100
Full docs here: https://spl.solana.com/token
If by verifying, you mean building a verifiable anchor Build in a docker container than you can do this like this:
anchor build --verifiable
anchor verify -p <lib-name> <program-id>
See Anchor docs: https://www.anchor-lang.com/docs/verifiable-builds
If by verifying, you mean verifying a program on chain against an open source repository:
solana-verify verify-from-repo -um --program-id PhoeNiXZ8ByJGLkxNfZRnkUfjvmuYqLR89jjFHGqdXY https://github.com/Ellipsis-Labs/phoenix-v1
using elipsis labs verifieable build solution: https://github.com/Ellipsis-Labs/solana-verifiable-build
You can also use the osec api to check the status on verified programs. https://verify.osec.io/status/PhoeNiXZ8ByJGLkxNfZRnkUfjvmuYqLR89jjFHGqdXY Just then you are trusting osec to a certain extend of course.
On Solana, this is not needed.
There are currently 2 official token programs maintained by Solana Labs that are used for all the SPL tokens:
These programs have been audited by external companies, see for example the list of Security Audits on Token Extensions Program.
If someone mints a new token using one of those programs, they won't have to write any custom code so there is no risk that a bad actor writes malicious code in it, as they don't have the authority to update the existing programs.
For custom programs, the answers in this thread are useful.
If by verifying, you mean making the IDL available, then you can do that with anchor cli.
The anchor idl init would deploy your IDL which would make explorers be able to show your data nicely, I do not know if it's supported by all explorers.
To get started you could run anchor idl init -h or you can check out https://docs.solscan.io/transaction-details/anchor-verified-programs or https://www.anchor-lang.com/docs/cli#idl-init
