0

There is a lot of risk in publishing to mainnet. Some of the things that I'm having difficulty with, as someone without resources to assist, is that I don't have people with a better understanding of Solana than I do to look over my projects and evaluate if the design makes sense or to make sure there aren't obvious exploits that I've overlooked. How do you go from creating something, getting it audited, then tested, and finally published to mainnet?

There's also the complication of having to restructure onchain data in the case where the schema needs to change. Bonus points if you want comment on that as well :)

2 Answers 2

5

Interesting question! Basically, the recommendations are the same as for releasing any high-quality software: test coverage, hand/auto tests on devnet and extensive code reviews.

But also there are blockchain-specific (and Solana-specific especially):

  1. Make sure to create new fixed private keys for Solana programs and save them in a private place, don't loose them, they are needed for program upgrades. It's necessary because during development some keys might have been leaked. I recommend using https://docs.solana.com/running-validator/validator-start#vanity-keypair to generate BEATY123...S213 like public keys (5 symbols prefix takes about 6 hours to generate on my machine)

  2. Double check the DApp when deployed on mainnet. There might be differences in how devnet and mainnet behave from the user point of view. For example, some wallets (like Phantom) have a limited transaction simulation functionality on devnet.

  3. You maybe will need to set up/buy an RPC node to handle your requests (like Alchemy or Quicknode). I faced a problem with https://api.mainnet-beta.solana.com in that websocket subscriptions don't work well.

  4. Forecast the program size after upgrades. Sometimes it's necessary to allocate more space for the program at the first deployment. Read https://docs.solana.com/cli/deploy-a-program#redeploy-a-program

When I deployed my DApp (https://solana-place.com/) for the first time I had a lot of concerns. Actually, I had to redeploy it at least 3 times after that to fix some discovered issues. Great part of Solana is that program upgrades are very cheap too (~= 200 txs cost). And you can always close the program and all associated accounts and withdraw rents from them.

Good luck!

2
  • Great answers! Thank you. I wasn't planning to generate a vanity key, but I think I will now ;). I do notice that Phantom isn't able to simulate transactions on devnet and that's a concern to users, because they don't know how much is being transferred. Thanks for the info about setting up an RPC server. I do use the websocket subscriptions and they're working well on devnet and testnet. I'll see how they hold up on mainnet-beta. Sep 12, 2022 at 20:53
  • 1
    No worries, Phantom will simulate on mainnet just fine! The only wallet I've seen to properly simulate on devnet was Solflare. Sep 13, 2022 at 8:46
1

I answered this in another question, but thought I should link it here as well:

What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?

1
  • Thanks. I already do all those things, but it's great to see a checklist. Sep 13, 2022 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.