Solana Program Deployment Checklist | Hashtag Web3

0 of 48 complete

Final Code Review

Last checks before building for production.

All tests passing on localnet and devnetcritical

Run `anchor test` and integration tests. Verify all instructions work correctly.

Remove all msg! debug loggingcritical

Debug logs consume compute units. Search for and remove all msg! statements.

Verify program ID in declare_id!critical

Confirm the declared program ID matches your deployment keypair.

Check compute unit budgetcritical

Ensure all instructions fit within 200K CU limit. Profile heavy operations.

Verify account size calculationscritical

Check all account space allocations include discriminator (8 bytes for Anchor).

Audit signer and authority checkscritical

Verify every instruction validates required signers and authorities.

Review PDA seeds for uniquenesscritical

Ensure PDA seeds create unique addresses. Avoid seed collisions.

Confirm all security audit findings fixedcritical

Review audit report. All critical and high issues must be resolved.

Build Configuration

Configure production build settings.

Set verifiable build in Anchor.tomlimportant

Enable `[programs.localnet]` with verifiable = true for reproducible builds.

Configure correct cluster in Anchor.tomlcritical

Set cluster to mainnet-beta for production deployment.

Verify Rust and Solana CLI versionsimportant

Document exact versions used. Match audited build environment.

Build with --verifiable flagimportant

Run `anchor build --verifiable` for reproducible bytecode.

Check program binary sizeimportant

Verify .so file is under size limits. Optimize if needed.

Generate and verify IDLcritical

Build IDL with `anchor idl init`. Verify it matches program interface.

Document build hashimportant

Record SHA256 of deployed .so file for verification.

Prepare deployment keypairscritical

Have program keypair and upgrade authority keypair ready and backed up.

Devnet Final Testing

Complete testing on devnet before mainnet.

Deploy to devnet with production configcritical

Use identical build and configuration as planned mainnet deployment.

Run full integration test suitecritical

Execute all user flows against devnet deployment.

Test upgrade pathcritical

If upgradeable, test full upgrade process including data migration.

Verify client SDK works correctlycritical

Test TypeScript/Rust client against devnet deployment.

Test error handling pathsimportant

Verify all error conditions return correct error codes.

Measure transaction costsimportant

Profile SOL costs for all instructions. Document for users.

Test with production RPCimportant

Use mainnet RPC provider against devnet to verify connection.

Verify event/log parsingimportant

Confirm off-chain services correctly parse program logs.

Mainnet Deployment

Deploy to mainnet-beta.

Fund deployment walletcritical

Ensure deployer has enough SOL for deployment and buffer account rent.

Deploy program to mainnetcritical

Run `anchor deploy` or `solana program deploy` with correct keypairs.

Upload IDL to chainimportant

Run `anchor idl init` to store IDL on-chain for explorers.

Verify deployment on explorercritical

Check Solscan/Solana Explorer. Confirm program data account.

Record deployment transactionimportant

Document deployment signature, slot, and timestamp.

Verify upgrade authoritycritical

Confirm upgrade authority is set to intended address (multisig).

Initialize required accountscritical

Create any global state accounts or config PDAs.

Configure program parameterscritical

Set fees, limits, and other configurable parameters.

Authority Management

Secure program upgrade authority.

Transfer upgrade authority to multisigcritical

Use `solana program set-upgrade-authority` to move to Squads multisig.

Verify multisig configurationcritical

Confirm multisig threshold, signers, and timelock settings.

Document authority addressesimportant

Public documentation of upgrade authority and any admin keys.

Test authority functionsimportant

Verify admin functions work with new authority.

Set up authority monitoringimportant

Alert on any upgrade authority changes or program upgrades.

Plan upgrade processimportant

Document exact steps for future program upgrades.

Consider making immutablenice-to-have

For mature programs, consider removing upgrade authority entirely.

Back up all keypairs securelycritical

Store program keypair and authority keys in secure cold storage.

Post-Deployment

Verify deployment and set up monitoring.

Execute smoke tests on mainnetcritical

Run basic operations with small amounts to verify functionality.

Verify all PDAs are accessiblecritical

Confirm all program-derived addresses resolve correctly.

Test frontend with mainnetcritical

Full end-to-end test of application with production deployment.

Set up transaction monitoringimportant

Configure alerts for failed transactions and unusual patterns.

Monitor program logsimportant

Set up log aggregation for debugging and analytics.

Configure error alertingimportant

Alert on specific error codes indicating security issues.

Update documentationimportant

Publish program address, IDL, and integration guides.

Schedule security monitoringimportant

Set up ongoing security reviews and monitoring.

Tips from the field

1.
Always use verifiable builds: Verifiable builds let anyone confirm deployed bytecode matches source. Essential for trust.
2.
Deploy program first, then transfer authority: Easier to fix deployment issues before authority is with multisig.
3.
Keep your program keypair forever: Even after transferring upgrade authority, you need the keypair to prove program ownership.
4.
Use priority fees during congestion: Deployment transactions can fail during high activity. Add priority fees for reliability.
5.
Test IDL parsing with Anchor clients: An IDL mismatch between client and program is a common source of integration bugs.

Join the fastest-growing blockchain ecosystem and build high-performance dapps.