So our program is not the most complex (a few hundred lines of code), but looks like it wants us to do 600+ transactions.

Is there some way to "sign all" transaction with Ledger when deploying? If not, what's a good workaround?

Deploying via a software wallet, then switching update authority back seems error prone, especially when we need to do upgrades.

4 Answers 4



Instead of deploying directly to the program account, the program can be written to an intermediary buffer account.

  • init and write the buffer with new program contents with the software key
  • set buffer authority to the program upgrade authority
  • do a solana program deploy with the buffer from step 1 (sign with ledger)

This way, you only need to sign 1 ledger transaction, and the upgrade authority never changes.

  • Marking this as the answer since it's more general (and are steps 4-6 in Dhrumil's answer), but both are great, thanks :)
    – Richard
    Commented Sep 20, 2022 at 16:58

Why don't you use multisig for deploying programs to mainnet? We use Snowflake.so at Solvent Protocol and it works really well.

Steps 1-3 are just to be one time when setting things up. For every upgrade, you just gotta repeat Steps 4-6.

How to use multisig for Solana program upgrades:

Step 1: Create a Snowflake Safe (multisig vault)

Step 2: Add all the relevant owners and set the m/n signature settings.

Step 3: Set your mainnet program authority to the Snowflake safe vault address: solana program set-upgrade-authority {Program ID} --new-upgrade-authority {New Upgrade Authority -- Safe address}

Step 4: For every upgrade, write a new program on a different buffer account using: solana program write-buffer {Program File}

Step 5: Give the authority of this new buffer account to snowflake safe: solana program set-buffer-authority {Buffer address} --new-buffer-authority {Safe address}

Step 6: Now via the multisig UI, you just have to initiate a Program upgrade transaction, and enter the buffer address where the new program is deployed. This will basically replace the buffer account of the existing program ID from the old buffer address to the newer one. It will also close the old buffer account and send back the released lamports to the snowflake safe.

You can also play around with this on devnet btw.

  • does this work for squads as well? also when I run solana program set-upgrade-authority, I get error Dynamic program error: missing signature for supplied pubkey... which seems hard to fix since the supplied pub key is the multisig....
    – AceGravity
    Commented Feb 14 at 14:55

I usually transfer the authority temporarily to a file system wallet, deploy and it transfer it back. I have been doing this consistently and has been safe so far.

Not sure why it is error prone, would love to understand more.

  • What if you typo/mis-copy the new upgrade authority, or your wallet keypair is corrupted/mis-saved as you do these upgrades? I guess there's a small window where your program can become 100% bricked. That small window multiply by the # of times you may be doing this (probably manually) can magnify the risk of human error.
    – Richard
    Commented Sep 13, 2022 at 15:51

I have not done this, but I do notice https://github.com/solana-labs/wallet-adapter/tree/master/packages/wallets/ledger exists, and the adapters all are expected to have signAllTransactions method. So if nothing else, maybe you could look into generating all the transactions, then passing them to wallet adapter to sign?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.