Deployed bytecode matches signed release tag

Evidence summary #

Solana programs use solana-verify for bytecode-to-source matching. StakeNet documentation confirms: 'can be verified from repository with solana-verify verify-from-repo.' OtterSec audits cite specific commit SHAs. However, comprehensive verification of all deployed programs vs. latest commits is not confirmed from available public evidence. Programmatic verification path exists but completeness is unconfirmed.

Sources #

Methodology #

Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.

See the full factor methodology and distribution across all protocols →