Solana Program Deployment Checklist

0 of 48 completed (0%)

Final Code Review

Last checks before building for production.

All tests passing on localnet and devnet

critical

Run `anchor test` and integration tests. Verify all instructions work correctly.

Remove all msg! debug logging

critical

Debug logs consume compute units. Search for and remove all msg! statements.

Verify program ID in declare_id!

critical

Confirm the declared program ID matches your deployment keypair.

Check compute unit budget

critical

Ensure all instructions fit within 200K CU limit. Profile heavy operations.

Verify account size calculations

critical

Check all account space allocations include discriminator (8 bytes for Anchor).

Audit signer and authority checks

critical

Verify every instruction validates required signers and authorities.

Review PDA seeds for uniqueness

critical

Ensure PDA seeds create unique addresses. Avoid seed collisions.

Confirm all security audit findings fixed

critical

Review audit report. All critical and high issues must be resolved.

Build Configuration

Configure production build settings.

Set verifiable build in Anchor.toml

important

Enable `[programs.localnet]` with verifiable = true for reproducible builds.

Configure correct cluster in Anchor.toml

critical

Set cluster to mainnet-beta for production deployment.

Verify Rust and Solana CLI versions

important

Document exact versions used. Match audited build environment.

Build with --verifiable flag

important

Run `anchor build --verifiable` for reproducible bytecode.

Check program binary size

important

Verify.so file is under size limits. Optimize if needed.

Generate and verify IDL

critical

Build IDL with `anchor idl init`. Verify it matches program interface.

Document build hash

important

Record SHA256 of deployed.so file for verification.

Prepare deployment keypairs

critical

Have program keypair and upgrade authority keypair ready and backed up.

Devnet Final Testing

Complete testing on devnet before mainnet.

Deploy to devnet with production config

critical

Use identical build and configuration as planned mainnet deployment.

Run full integration test suite

critical

Execute all user flows against devnet deployment.

Test upgrade path

critical

If upgradeable, test full upgrade process including data migration.

Verify client SDK works correctly

critical

Test TypeScript/Rust client against devnet deployment.

Test error handling paths

important

Verify all error conditions return correct error codes.

Measure transaction costs

important

Profile SOL costs for all instructions. Document for users.

Test with production RPC

important

Use mainnet RPC provider against devnet to verify connection.

Verify event/log parsing

important

Confirm off-chain services correctly parse program logs.

Mainnet Deployment

Deploy to mainnet-beta.

Fund deployment wallet

critical

Ensure deployer has enough SOL for deployment and buffer account rent.

Deploy program to mainnet

critical

Run `anchor deploy` or `solana program deploy` with correct keypairs.

Upload IDL to chain

important

Run `anchor idl init` to store IDL on-chain for explorers.

Verify deployment on explorer

critical

Check Solscan/Solana Explorer. Confirm program data account.

Record deployment transaction

important

Document deployment signature, slot, and timestamp.

Verify upgrade authority

critical

Confirm upgrade authority is set to intended address (multisig).

Initialize required accounts

critical

Create any global state accounts or config PDAs.

Configure program parameters

critical

Set fees, limits, and other configurable parameters.

Authority Management

Secure program upgrade authority.

Transfer upgrade authority to multisig

critical

Use `solana program set-upgrade-authority` to move to Squads multisig.

Verify multisig configuration

critical

Confirm multisig threshold, signers, and timelock settings.

Document authority addresses

important

Public documentation of upgrade authority and any admin keys.

Test authority functions

important

Verify admin functions work with new authority.

Set up authority monitoring

important

Alert on any upgrade authority changes or program upgrades.

Plan upgrade process

important

Document exact steps for future program upgrades.

Consider making immutable

nice-to-have

For mature programs, consider removing upgrade authority entirely.

Back up all keypairs securely

critical

Store program keypair and authority keys in secure cold storage.

Post-Deployment

Verify deployment and set up monitoring.

Execute smoke tests on mainnet

critical

Run basic operations with small amounts to verify functionality.

Verify all PDAs are accessible

critical

Confirm all program-derived addresses resolve correctly.

Test frontend with mainnet

critical

Full end-to-end test of application with production deployment.

Set up transaction monitoring

important

Configure alerts for failed transactions and unusual patterns.

Monitor program logs

important

Set up log aggregation for debugging and analytics.

Configure error alerting

important

Alert on specific error codes indicating security issues.

Update documentation

important

Publish program address, IDL, and integration guides.

Schedule security monitoring

important

Set up ongoing security reviews and monitoring.

Key Recommendations

Always use verifiable builds: Verifiable builds let anyone confirm deployed bytecode matches source. Essential for trust.

Deploy program first, then transfer authority: Easier to fix deployment issues before authority is with multisig.

Keep your program keypair forever: Even after transferring upgrade authority, you need the keypair to prove program ownership.

Use priority fees during congestion: Deployment transactions can fail during high activity. Add priority fees for reliability.

Test IDL parsing with Anchor clients: An IDL mismatch between client and program is a common source of integration bugs.

Looking for Web3 Opportunities?

Explore curated, high-impact roles across top blockchain protocols and Web3 startups.

Solana Program Deployment Checklist

Final Code Review

Build Configuration

Devnet Final Testing

Mainnet Deployment

Authority Management

Post-Deployment

Key Recommendations

More Guides for Solana Developers

Looking for Web3 Opportunities?