Deployed bytecode matches signed release tag

Evidence summary #

Orca uses GitHub release tags with semver. Bytecode-to-release-tag matching requires anchor verify comparison between the on-chain deployed program hash and the compiled artifact from the tagged commit. Not performed in this session. Pipeline-unimplemented for Solana BPF programs.

Sources #

Methodology #

Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.

See the full factor methodology and distribution across all protocols →