[metapileks]

Every program in this repo is built with Anchor 0.29.0 on Solana 1.17 and ships as SBPFv0 bytecode, the format every one of the 16 committed verifiable builds and every mainnet deployment still uses. SIMD-0500 ends deploys and upgrades of that format, and it is expected on mainnet with Agave 4.4.

This branch moves the whole toolchain: the test runtime, the programs, the TypeScript, and CI. After it, every program compiles with Anchor 0.32.2 on Agave 4.3.0 as SBPFv3, the SDK and scripts run on @anchor-lang/core 0.32.2 and web3.js 1.99.0, and CI builds, tests, verifies and stages deploys with the same pinned versions a developer gets from the README.

What changed

• Programs:
  • Every program manifest is on Anchor 0.32.2, the workspace pins platform-tools v1.57, and the build emits SBPFv3.
  • Source edits are the ones 0.32 forces: nested known-account modules import the plain Solana declare_id! so they no longer overwrite the program address in the IDL, realloc becomes resize, discriminator checks compare slices against the constant, the launchpads' bump allocator is gated to the SBF target so the IDL build can run the crate as a host test, and two futarchy handlers box accounts or split an event emission to stay under the 4 KiB stack frame.
  • Squads account types in futarchy's account structs are wrapped in a local Foreign<T> that keeps them out of futarchy's IDL. The Squads program dependency is patched to a fork commit whose only change is adding the idl-build cargo feature for IDL generation support; the program code is unmodified.
• Test runtime:
  • The suite runs in-process on LiteSVM through a bankrun-shaped facade instead of solana-bankrun, with no validator or RPC.
  • Existing tests keep their shape; the facade rotates the blockhash after every transaction, so identical instructions no longer collide.
• SDK:
  • The eleven generated modules carry the 0.30-spec IDL JSON and type file that Anchor now produces, synced by sdk/sync-types.sh; the frozen legacy modules carry their old IDLs converted with anchor idl convert.
  • Clients construct from the IDL's own address, all 251 .accounts() builder calls across the SDK, tests and scripts are .accountsPartial(), which is what .accounts() delegated to at runtime, account decode names follow the pipeline that produced each IDL, and scripts read account discriminators from the IDL instead of the removed coder helper.
  • Consumers of @metadaoproject/programs get the new IDL constants and @anchor-lang/core as a dependency; the publish itself is not in this PR. Indexers reading the on-chain IDL accounts will see the 0.30 spec after each program's first upgrade from this branch.
• CI:
  • The two org actions are inlined: a local setup action installs Node 20.18, the Rust version pinned in rust-toolchain.toml, Agave 4.3.0, Anchor 0.32.2 and the standalone cargo-build-sbf 4.4.0, with caches for the slow installs, and the verifiable-build steps call solana-verify build --arch v3 directly on solana-verify 0.5.2. The test workflow builds and runs the suite on that action.
  • The reusable deploy workflow now generates only the IDL on the runner with anchor idl build and takes the deployed binary from the verified Docker build, so an unverified host build can no longer sit in target/deploy. repo-guard pins and the deploy-buffer and verify-build workflows carry the new versions.
• Developer setup:
  • rust-toolchain.toml pins host Rust 1.95.0, the rustc inside platform-tools v1.57, for local builds, CI and the devcontainer. ./rebuild.sh checks for cargo-build-sbf 4.4.0 and runs one anchor build; the README's setup steps match.

Confidence Score: 5/5

The PR appears safe to merge; both earlier findings are fixed and no new blocking issue was found.

Summary

Moves the programs, SDK, tests, and build workflows to Anchor 0.32.2 and SBPFv3.

• All programs now build for SBPFv3 with Anchor 0.32.2.
• CI builds verified SBPFv3 binaries and generates their IDLs separately.
• Tests run in an in-process LiteSVM runtime instead of a bankrun validator.
• SDK clients now build instructions from the new Anchor IDLs.

Both earlier findings are fixed. No new actionable issues were found.

_{Reviews (2) · Last reviewed commit: "Merge remote-tracking branch 'origin/dev..." · Reviewed by Greptile}

[github-actions]

Repository Guard

• Cargo.lock: pass
• yarn.lock (sdk): pass
• yarn.lock (root): pass
• Repo guard: pass

Repository Guard

Cargo dependency pinning

• Status: pass
• Every programs/*/Cargo.toml dep uses =x.y.z, a path = .. workspace ref, or a git dep with a 40-char rev.

Cross-program Anchor/Solana version consistency

• Status: pass
• anchor-lang and anchor-spl are pinned to the version declared in repo-guard.toml across every program.

Anchor.toml solana_version

• Status: pass
• Anchor.toml declares solana_version = "4.3.0" (local-dev install for anchor test).

Crate minimum age

• Status: pass
• All Cargo deps changed by this PR are at least 14 days old on crates.io.

Yarn package.json pinning

• Status: pass
• All package.json deps use exact versions (no ^, ~, ranges).

npm minimum age

• Status: pass
• All npm deps changed by this PR are at least 14 days old.

Workflow toolchain consistency

• Status: pass
• Every workflow declares anchor-version: 0.32.2.
• Per-file solana-cli-version values match [toolchain.workflow_solana_cli] in repo-guard.toml.

GitHub Action SHA pinning

• Status: pass
• Every third-party action is pinned to a SHA in [actions.sha_allowlist].

Sensitive program / config changes

• Status: warn
• Review hint only (CODEOWNERS is the merge gate). Lines below match heuristics for security-sensitive changes:
• High-sensitivity files touched: Anchor.toml, Cargo.toml, Cargo.lock, .github/repo-guard.toml, .github/workflows/repo-guard.yml, scripts/repo-guard.ts
• .github/workflows/verify-build.yaml:72 Program ID constant or variable change -> + solana-verify verify-from-repo --remote -um --arch v3 --program-id ${{ inputs.program_id }} https://github.com/${{ github.repository }} --library-name ${{ inputs.program_name }}
• .github/workflows/verify-build.yaml:74 Program ID constant or variable change -> + solana-verify verify-from-repo --remote -um --arch v3 --program-id ${{ inputs.program_id }} https://github.com/${{ github.repository }} --library-name ${{ inputs.program_name }} -- --features ${{ inputs.features }}
• Cargo.toml:27 Hardcoded Solana address literal -> +squads-multisig-program = { git = "https://github.com/metapileks/squads-v4", rev = "d7fbfab3b2b218bf71bab8d7127574a88b468c17" }
• programs/futarchy/Cargo.toml:34 Hardcoded Solana address literal -> +squads-multisig-program = { git = "https://github.com/Squads-Protocol/v4", package = "squads-multisig-program", rev = "af94153ff77a28b6effe46b9c94baaa93742b48c", features = ["cpi"] }
• programs/v06_launchpad/Cargo.toml:35 Hardcoded Solana address literal -> +squads-multisig-program = { git = "https://github.com/Squads-Protocol/v4", package = "squads-multisig-program", rev = "af94153ff77a28b6effe46b9c94baaa93742b48c", features = ["cpi"] }
• programs/v07_launchpad/Cargo.toml:36 Hardcoded Solana address literal -> +squads-multisig-program = { git = "https://github.com/Squads-Protocol/v4", package = "squads-multisig-program", rev = "af94153ff77a28b6effe46b9c94baaa93742b48c", features = ["cpi"] }
• programs/v08_launchpad/Cargo.toml:39 Hardcoded Solana address literal -> +squads-multisig-program = { git = "https://github.com/Squads-Protocol/v4", package = "squads-multisig-program", rev = "af94153ff77a28b6effe46b9c94baaa93742b48c", features = ["cpi"] }
• run.sh:68 Program ID constant or variable change -> + solana-verify verify-from-repo --remote -u "$CLUSTER" --program-id $PROGRAM_ID https://github.com/metaDAOproject/programs --library-name $PROGRAM_NAME --arch v3 -y -- --features $FEATURES
• run.sh:76 Program ID constant or variable change -> + solana-verify verify-from-repo --remote -u "$CLUSTER" --program-id $PROGRAM_ID https://github.com/metaDAOproject/programs --library-name $PROGRAM_NAME --arch v3 -y -- --features $FEATURES
• run.sh:95 Program ID constant or variable change -> + solana-verify export-pda-tx -um https://github.com/metaDAOproject/futarchy --program-id "$PROGRAM_ID" --uploader 6awyHMshBGVjJ3ozdSJdyyDE1CTAXUwrpNMaRGMsb4sf --arch v3 --library-name "$PROGRAM_NAME" -- --features $FEATURES
• run.sh:102 Program ID constant or variable change -> + solana-verify verify-from-repo --remote -um --program-id $PROGRAM_ID https://github.com/metaDAOproject/futarchy --library-name $PROGRAM_NAME --arch v3 -- --features $FEATURES
• sdk/src/amm/v0.3/types/amm.json:2 Hardcoded Solana address literal -> + "address": "AMM5G2nxuKUwCLRYTW7qqEwuoqCtNSjtbipwEmm2g8bH",
• sdk/src/amm/v0.3/types/amm.json:51 Hardcoded Solana address literal -> + "address": "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL"
• sdk/src/amm/v0.3/types/amm.json:55 Hardcoded Solana address literal -> + "address": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
• sdk/src/amm/v0.3/types/amm.json:59 Hardcoded Solana address literal -> + "address": "11111111111111111111111111111111"
• sdk/src/amm/v0.3/types/amm.json:121 Hardcoded Solana address literal -> + "address": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
• sdk/src/amm/v0.3/types/amm.json:183 Hardcoded Solana address literal -> + "address": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
• sdk/src/amm/v0.3/types/amm.json:237 Hardcoded Solana address literal -> + "address": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
• sdk/src/amm/v0.3/types/amm.ts:9 Hardcoded Solana address literal -> + address: "AMM5G2nxuKUwCLRYTW7qqEwuoqCtNSjtbipwEmm2g8bH";
• sdk/src/amm/v0.3/types/amm.ts:49 Hardcoded Solana address literal -> + address: "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
• sdk/src/amm/v0.3/types/amm.ts:53 Hardcoded Solana address literal -> + address: "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
• sdk/src/amm/v0.3/types/amm.ts:57 Hardcoded Solana address literal -> + address: "11111111111111111111111111111111";
• sdk/src/amm/v0.3/types/amm.ts:110 Hardcoded Solana address literal -> + address: "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
• sdk/src/amm/v0.3/types/amm.ts:163 Hardcoded Solana address literal -> + address: "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
• sdk/src/amm/v0.3/types/amm.ts:208 Hardcoded Solana address literal -> + address: "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
• sdk/src/amm/v0.4/types/amm.json:2 Hardcoded Solana address literal -> + "address": "AMMyu265tkBpRW21iGQxKGLaves3gKm2JcMUqfXNSpqD",
• sdk/src/amm/v0.4/types/amm.json:51 Hardcoded Solana address literal -> + "address": "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL"
• sdk/src/amm/v0.4/types/amm.json:55 Hardcoded Solana address literal -> + "address": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"
• sdk/src/amm/v0.4/types/amm.json:59 Hardcoded Solana address literal -> + "address": "11111111111111111111111111111111"
• sdk/src/amm/v0.4/types/amm.json:127 Hardcoded Solana address literal -> + "address": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"

Overall status: pass

Lockfile freshness (Cargo.lock + yarn.lock) is checked by the workflow directly and cannot be bypassed. The sensitive-diff section is a review hint - CODEOWNERS handles the actual merge gate.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​anchor-lang/​core@​0.32.2
	npm/​litesvm@​0.2.0 ⏵ 1.4.1	+2		+8	+5
	npm/​@​solana/​web3.js@​1.76.0 ⏵ 1.99.0	+6	+16		+5
	cargo/​anchor-lang@​0.29.0 ⏵ 0.32.2
	cargo/​anchor-spl@​0.29.0 ⏵ 0.32.2
	npm/​@​solana/​kit@​8.3.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm litesvm-linux-arm64-gnu Location: Package overview From: yarn.lock → npm/litesvm@1.4.1 → npm/litesvm-linux-arm64-gnu@1.4.1 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/litesvm-linux-arm64-gnu@1.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm litesvm-linux-arm64-musl Location: Package overview From: yarn.lock → npm/litesvm@1.4.1 → npm/litesvm-linux-arm64-musl@1.4.1 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/litesvm-linux-arm64-musl@1.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report