4

I'm struggling to find an answer to how to verify solana programs code on Solana (for a SPL token).

On Ethereum there's a function in the IDE to verify the contract, but I can't seem to find out how to do so on Solana.

If someone could point me in the right direction it would be much appreciated.

Thanks!

1
  • I am having the same issue, I created a token on Sol and it shows in sol explorer but it says in my wallet it is an unverified token which makes no sense, I hace tried to create a custom id for it and it keeps failing, presumably because of this, so frustrated
    – Cape Fegor
    Mar 26 at 20:27

3 Answers 3

2

If by verifying, you mean you need to deploy a contract to deploy a token, then you dont need to do that on solana. You can just use the already deployed SPL token program and create a new token like so:

spl-token create-token
spl-token create-account yourTokenAddress 
spl-token mint yourTokenAddress 100

Full docs here: https://spl.solana.com/token

If by verifying, you mean building a verifiable anchor Build in a docker container than you can do this like this:

anchor build --verifiable
anchor verify -p <lib-name> <program-id>

See Anchor docs: https://www.anchor-lang.com/docs/verifiable-builds

If by verifying, you mean verifying a program on chain against an open source repository:

solana-verify verify-from-repo -um --program-id PhoeNiXZ8ByJGLkxNfZRnkUfjvmuYqLR89jjFHGqdXY https://github.com/Ellipsis-Labs/phoenix-v1

using elipsis labs verifieable build solution: https://github.com/Ellipsis-Labs/solana-verifiable-build

You can also use the osec api to check the status on verified programs. https://verify.osec.io/status/PhoeNiXZ8ByJGLkxNfZRnkUfjvmuYqLR89jjFHGqdXY Just then you are trusting osec to a certain extend of course.

2

On Solana, this is not needed.

There are currently 2 official token programs maintained by Solana Labs that are used for all the SPL tokens:

These programs have been audited by external companies, see for example the list of Security Audits on Token Extensions Program.

If someone mints a new token using one of those programs, they won't have to write any custom code so there is no risk that a bad actor writes malicious code in it, as they don't have the authority to update the existing programs.

For custom programs, the answers in this thread are useful.

0

If by verifying, you mean making the IDL available, then you can do that with anchor cli.

The anchor idl init would deploy your IDL which would make explorers be able to show your data nicely, I do not know if it's supported by all explorers.

To get started you could run anchor idl init -h or you can check out https://docs.solscan.io/transaction-details/anchor-verified-programs or https://www.anchor-lang.com/docs/cli#idl-init

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.