2

Are there any known security issues around using a version of solana cli that is not on the mainnet, e.g. 1.14.x CLI to compile a program using 1.13.x solana-sdk/program crates? A related issue is that newer versions of solana-cli allow you to use newer versions of rust, e.g. rust v1.64 in 1.14.x vs. rust v1.59 in 1.13.x . Does using the newer version of rust (say v1.64) have any potential or known issues when you're using the older version of the solana crates (which at least when it comes to the CLI only support v1.59).

While I have been specific with the version numbers here for the sake of example, I would like to understand what the current opinion is on this in a more general / ongoing sense.

Improve this question

2 Answers 2

Reset to default
1

If I'm reading this correctly, there's two questions hidden in here:

  • Is it safe to use later versions of the CLI?

Absolutely. For example, the solana-program-library repo is almost always one minor version ahead from mainnet, to start using all the newest SDK and compiler right away.

For the most part, I recommend matching up the crate version with the CLI version, since those are shipped together. Most likely though, a mismatch could only cause issues at compile time, but even then, it's very rare. The main repo's CLI job builds programs using the newest CLI and older SDK crates all the time, without issue.

On the flipside, you can run into compatibility issues with commands / instructions not supported on mainnet. For example, version 1.14 supports the stake redelegate instruction, but 1.13 doesn't. So if you try to run it against mainnet, the transaction will fail. There are no safety concerns, however.

  • Is it safe to use a different version of Rust to compile the Solana crates / binaries?

You can do it, but it's "undefined behavior". People accidentally do it all the time, and it rarely causes issues, unless a crate is using a new or deprecated language feature. It could be a safety concern if the mismatch in Rust / crate version exposes a bug in the crate or compiler. For that reason, I'd recommend always building with the appropriate version using the ./cargo script in the repo.

Improve this answer
-1

I'm using solana 1.13.4 and cargo 1.63.0 working fine for me !

Improve this answer
1
  • Sorry for the downvote but this isn't the kind of answer I was trying to elicit. I know that you can use different combinations of versions. I'm trying to get details on what fundamental security issues there might be.
    – Henry E
    Commented Nov 29, 2022 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.