Program upgrades

How upgrades work#

Programs deployed with the default tooling use the upgradeable loader (BPFLoaderUpgradeab1e11111111111111111111111). The program account points at a program-data account holding the code, and a single upgrade authority address can replace that code. Whoever holds the authority key can change what the program does — including draining every account the program controls.

• Authority set: the program can be upgraded, and only by that authority.
• Authority renounced (None): the program is immutable and can never change again.
• The genesis-preloaded SPL programs are immutable under a different loader — see preloaded programs.

Checking an authority#

Paste any program ID into the explorer(opens in a new tab): program address pages show the upgrade-authority details transparently.

The same information is available from the CLI:

solana program show <PROGRAM_ID> --url https://rpc-testnet.kyvro.si

Managing your authority#

Anchor's anchor deploy sets the upgrade authority to your wallet keypair. With the Solana CLI you can transfer it or renounce it permanently:

solana program set-upgrade-authority <PROGRAM_ID> \
  --new-upgrade-authority <NEW_AUTHORITY_KEYPAIR> \
  --url https://rpc-testnet.kyvro.si --keypair ~/test-authority.json

Run solana program set-upgrade-authority --help for the full options, including making a program immutable. There is no undo for renouncing.

Guidance#

• Before trusting a program, check its upgrade authority on the explorer. An authority held by one anonymous key is one compromised laptop away from a rug.
• For programs other people rely on, put the authority behind a multisig and say so publicly.
• Use a dedicated authority keypair — never your main wallet — and keep it offline when you are not upgrading.
• When a program is finished, renounce the authority and link to the explorer page showing immutable: true as proof.