2

I'm a solidity developer trying to expand into the Solana ecosystem. On Etherscan, it is very easy to inspect and interact with a smart contact (program). However, I see this basic functionality missing from Solscan.

https://solscan.io/token/DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263

Check out this token above. I see no way of even viewing the contract's code. How would end users even inspect the smart contract for malicious code? What's stopping a developer from coding a 99% transfer/sell tax for example? You would easily be able to spot this on Etherscan.

Am I missing something here?

5 Answers 5

1

no you are not missing anything, currently, it is not possible to see program's source code (except if they are open source, of course, and even if they are, you can't verify that the deployed program is the one showed in the github / or whatever tool they use to show source code).

0

I am the same as you, although I have already managed to decipher a couple of things, the Solana network works completely differently than the EVMs, suddenly and until we can share information about it

0

As mentioned it is impossible to view the contract code.

But you can look at the IDL using Solscan. For example, here is the Anchor IDL for the Tensor Bid program: https://solscan.io/account/TB1Dqt8JeKQh7RLDzfYDJsq8KS4fS2yt87avRjyRxMv#anchorProgramIDL

0

Since all tokens are minted using the same Token program, there is no way to insert malicious code into the program (contract) itself. All tokens minted with the token program implement the same transfer/burn/etc instructions.

With the new Token22 program, things like a transfer fee or a transfer hook (can execute programs upon transfer) are now possible. But again these are implemented in a standard way and are transparent to users. Take for example this token that implements transfer fees using the token22 program. Since this was added at mint by the token22 program, there is no way to "hide" fees.

2
  • Is the Token2022 same as everybody talk in the NFT space called Token22 ?
    – Jrb
    Commented Nov 24, 2023 at 23:58
  • There is a lot of new terminology going around. Token22 refers to the next version of the Solana Program Library's token program. All tokens on solana use either token or token22. There is a new type of "token" called spl20, that are neither token or token22. It is a new standard that makes use of brc20 style inscriptions that use nfts. So my answer is, they might be talking about two separate things. But it is difficult to tell because there is alot of interest overlap in both spaces.
    – tonton
    Commented Nov 25, 2023 at 3:23
0

The functionality for verifiable builds is not currently provided by default. Most people compile their program with cargo build-sbf or anchor build, and then upload their program without any other info.

Currently, there is a tool for verifiable builds at https://github.com/Ellipsis-Labs/solana-verifiable-build/tree/master, and anchor provides the ability to run builds in a Docker container with anchor build --verifiable.

Unfortunately, none of these are linked with a source code explorer, so you still have to find the repo, checkout the build tag, and then verify the build.

There used to be a registry of programs which would run the verifiable build, verify that it matches the on-chain program, and then upload the source code. It would be amazing if someone recreated that!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.