In practice, we often encounter this situation: a team spends weeks developing, but when deploying to mainnet, they discover that rent-exemption wasn't accounted for or upgrade authority is tied to a single key. One client came with a ready program of 150 KB — at deployment, solana rent showed 1.2 SOL, but the wallet only had 0.5 SOL. We had to urgently buy more tokens and rewrite scripts. Solana is not EVM: each transaction and account requires planning. We perform turnkey deployment, from Anchor setup to final verification, and know all the pitfalls.
Instrumentation: Anchor Framework vs Native Rust
| Criterion | Anchor Framework | Native Rust without Anchor |
|---|---|---|
| MVP development time | 2-3 weeks | 6-8 weeks (3x longer) |
| Security by default | Built-in signer checks, realloc | All manual, risk of errors |
| IDL (interface) | Automatically generated | None, must be written manually |
| Upgrade authority support | Built-in | Manual setup |
Anchor is the standard framework for Solana development. If you write in native Rust without Anchor, multiply development time by 3 and add manual instruction deserialization. Anchor handles most of the boilerplate and generates IDL (Interface Definition Language) — the analog of ABI for EVM.
# Build anchor build # Deploy to mainnet-beta anchor deploy --provider.cluster mainnet-beta \ --provider.wallet ~/.config/solana/deployer-keypair.json Deployment Cost: Rent-Exemption
In Solana, storing data in an account costs SOL in the form of rent. To prevent the account from being deleted, you need to maintain a minimum balance (rent-exemption). The size of the program account is proportional to the bytecode size. It's important to plan: the deployment budget must include not only transaction fees (~0.00025 SOL) but also the rent-exemption for storing the program account itself.
| Program Size | Rent-Exemption (SOL) | Additional Fees |
|---|---|---|
| 50 KB | ~0.3 SOL | 0.00078 SOL per upload |
| 200 KB | ~1.4 SOL | 0.0013 SOL per upload |
| 500 KB | ~3.8 SOL | 0.0025 SOL per upload |
# Estimate cost before deployment solana rent <bytes> # Example: program 200KB ≈ 1.4 SOL rent-exemption Buffer Account and Two-Stage Deployment
Solana limits the size of a single transaction. Programs larger than a few kilobytes are deployed in several stages via a buffer account:
- Create a buffer account.
- Load bytecode in parts via
solana program write-buffer. - Deploy the program atomically from the buffer.
Anchor does this automatically. For manual deployment via CLI:
solana program deploy \ --program-id target/deploy/my_program-keypair.json \ --buffer /path/to/buffer-keypair.json \ target/deploy/my_program.so Why Upgrade Authority Is the Biggest Risk?
By default, Anchor creates an upgradeable program with upgrade authority equal to the deployer keypair. This is fine for development but not for production. In production, we transfer authority to a multisig (Squads Protocol — the standard multisig on Solana). Any program update then requires M-of-N signatures. This is critical for mainnet — a single key as upgrade authority is a single point of failure. One of our clients lost $10k due to a leaked deployer keypair when an attacker updated the program to a malicious version. After that, we implemented multisig for all projects.
Immutable program — if the logic is final and no updates are planned. This is irreversible: after --final, the program cannot be updated or closed.
How We Find PDA Collisions?
Program Derived Addresses (PDA) are unique addresses derived from program ID and seeds. A collision occurs when two different data accounts generate the same PDA. We test for collisions using findProgramAddress in tests, and also use bump seeds (from 255 to 0) to eliminate conflicts. In one project, we discovered a collision in 3 of our seeds — this could have led to funds theft. A security audit firm (Neodyme) confirmed our finding.
Verification and IDL
After deployment, we upload the IDL on-chain — this allows other developers and tools (Explorer, Anchor clients) to automatically know the program interface.
anchor idl init --filepath target/idl/my_program.json <PROGRAM_ID> \ --provider.cluster mainnet-beta Source code verification is done via solana-verify (by OtterSec). It publishes proof that the on-chain bytecode corresponds to a specific Git commit.
Checklist Before Mainnet Deployment
- Full test coverage on localnet and devnet.
- Audit (OtterSec, Neodyme, Trail of Bits — specialize in Solana).
- Program derived addresses (PDA) checked for collisions.
- Integer overflow check (
overflow-checks = truein Cargo.toml). - Upgrade authority transferred to multisig.
- Sufficient SOL in deployer wallet including rent-exemption.
- Monitoring via Helius webhooks or Shyft for critical instructions.
What's Included in the Work
- Configuring Anchor for your project. Deploying the program to mainnet/devnet with buffer setup. Transferring upgrade authority to multisig or finalizing. Uploading IDL on-chain. Verifying code via solana-verify. Documentation of account structure and instructions. Support for 14 days after deployment.
We have performed deployment for 50+ projects and guarantee that your contract will work without surprises. Contact us to evaluate your project — our engineers with 5+ years of blockchain experience will respond within a day. Get a consultation for your project today.