Program Deployment

Deploying programs

Upgrading programs

To upgrade a program, an account must hold the upgrade authority (typically the account that originally deployed the program). During deployment or upgrade, new bytecode is uploaded to a temporary buffer account, then written to the program data account. Setting the upgrade authority to None makes the program immutable and permanently prevents further updates.

Upgrade mechanism

When UpgradeableLoaderInstruction::Upgrade is processed, the runtime:

1. Verifies the Program account is writable and owned by loader-v3.
2. Verifies the Buffer account contains a Buffer state with the correct authority.
3. Verifies the ProgramData account's upgrade_authority_address matches and is not None.
4. Verifies the program was not already deployed in the current slot (clock.slot != slot).
5. Loads and verifies the new ELF bytes from the buffer.
6. Copies the new bytecode from the buffer into the ProgramData account and zeros remaining bytes.
7. Funds the ProgramData account to rent-exemption.
8. Drains the buffer account (sets lamports to 0) and truncates its data.
9. The new version becomes effective in the next slot (deployment_slot + 1).

The Program account itself (its state and the programdata_address pointer) does not change during an upgrade. Only the ProgramData account's bytecode and slot metadata are updated.

Loader-v3 instruction reference

Loader-v3 (BPF Loader Upgradeable) is the current default loader for deploying programs on Solana.

Verifying programs

Solana supports verifiable builds, which let users confirm that a program's on-chain bytecode matches its public source code. The Anchor framework provides built-in support for verifiable builds.

To check verification status for a deployed program, search for its program ID on the Solana Explorer, or use the Ellipsis Labs Solana Verifiable Build CLI to independently verify on-chain programs.

Loader programs