How To View/Interact with a Contract's Code

Question

I'm a solidity developer trying to expand into the Solana ecosystem. On Etherscan, it is very easy to inspect and interact with a smart contact (program). However, I see this basic functionality missing from Solscan.

https://solscan.io/token/DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263

Check out this token above. I see no way of even viewing the contract's code. How would end users even inspect the smart contract for malicious code? What's stopping a developer from coding a 99% transfer/sell tax for example? You would easily be able to spot this on Etherscan.

Am I missing something here?

Answer 1

no you are not missing anything, currently, it is not possible to see program's source code (except if they are open source, of course, and even if they are, you can't verify that the deployed program is the one showed in the github / or whatever tool they use to show source code).

Answer 2

I am the same as you, although I have already managed to decipher a couple of things, the Solana network works completely differently than the EVMs, suddenly and until we can share information about it

Answer 3

As mentioned it is impossible to view the contract code.

But you can look at the IDL using Solscan. For example, here is the Anchor IDL for the Tensor Bid program: https://solscan.io/account/TB1Dqt8JeKQh7RLDzfYDJsq8KS4fS2yt87avRjyRxMv#anchorProgramIDL

Answer 4

Since all tokens are minted using the same Token program, there is no way to insert malicious code into the program (contract) itself. All tokens minted with the token program implement the same transfer/burn/etc instructions.

With the new Token22 program, things like a transfer fee or a transfer hook (can execute programs upon transfer) are now possible. But again these are implemented in a standard way and are transparent to users. Take for example this token that implements transfer fees using the token22 program. Since this was added at mint by the token22 program, there is no way to "hide" fees.

Answer 5

The functionality for verifiable builds is not currently provided by default. Most people compile their program with cargo build-sbf or anchor build, and then upload their program without any other info.

Currently, there is a tool for verifiable builds at https://github.com/Ellipsis-Labs/solana-verifiable-build/tree/master, and anchor provides the ability to run builds in a Docker container with anchor build --verifiable.

Unfortunately, none of these are linked with a source code explorer, so you still have to find the repo, checkout the build tag, and then verify the build.

There used to be a registry of programs which would run the verifiable build, verify that it matches the on-chain program, and then upload the source code. It would be amazing if someone recreated that!

Answer 6

Is it possible to build a staking and reward program if a token was launched already? Cause I can’t find the source code