Solana Squads Upgrade — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Solana Squads Upgrade (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automate Solana program upgrades through Squads v4 multisig using the squads-program-action GitHub Action. Covers configuration, transaction building, and the full upgrade lifecycle from CI to on-chain execution.
Creates a Squads vault transaction (multisig proposal), not a direct on-chain upgrade.
CI Pipeline
-> squads-program-action creates vault transaction
-> Transaction appears in Squads UI (https://v4.squads.so/)
-> Team members review + approve
-> Squads executes: program upgrade + optional IDL + optional PDA verificationKey constraint: the provided keypair only needs transaction creation permission (voter role). The actual upgrade authority comes from the Squads vault PDA.
| Input | Description |
|---|---|
rpc | Solana RPC URL |
program | Program ID to upgrade |
buffer | Buffer account containing the new program bytecode |
multisig | Squads v4 multisig address |
keypair | Byte array of keypair with voter permission. Format: [23,42,53...] |
| Input | Default | Description |
|---|---|---|
idl-buffer | — | Anchor IDL buffer address |
metadata-buffer | — | program-metadata IDL buffer (alternative to idl-buffer) |
pda-tx | — | Base64 encoded PDA verification transaction |
priority-fee | 100000 | Priority fee in lamports |
vault-index | 0 | Squads vault index |
Important: idl-buffer and metadata-buffer are mutually exclusive. Use idl-buffer for Anchor programs, metadata-buffer for non-Anchor programs or as a modern alternative.
The action builds a TransactionMessage with instructions in this order:
pda-tx provided) — prepended firstThe BPF upgrade targets BPFLoaderUpgradeab1e11111111111111111111111 with the vault PDA as upgrade authority. Anchor IDL uses idlAddress() for account derivation. Program-metadata supports both create (new account) and update (existing account) flows with 10KB chunked extends for large data.
For detailed account layouts, discriminator bytes, metadata flow steps, and the kitIxToWeb3 adapter, consult `references/transaction-flow.md`.
Uses simulation-based compute optimization: simulates with 1.4M unit cap, reads unitsConsumed, applies a 1.1x buffer multiplier by default. Transaction sending uses retry with progressive backoff (15 retries, 2s initial delay, +200ms per retry).
For simulation strategy details, retry configuration constants, and polling behavior, consult `references/transaction-flow.md`.
For complete workflow examples, see examples/ directory:
keypair, multisig, and RPC_URL in GitHub Secretspda-tx input verifies the program's build provenance on-chain@sqds/multisig (^2.1.3) — Squads v4 SDK for vault transaction creation@solana-program/program-metadata (^0.5.1) — Metadata account management@solana/web3.js (^1.98.0) — Solana transaction construction (dev dependency)@coral-xyz/anchor (^0.30.1) — Anchor IDL address derivation (dev dependency)| Error | Cause | Fix |
|---|---|---|
| "Cannot use both idl-buffer and metadata-buffer" | Both inputs provided | Pick one IDL method |
| "Could not fetch program or buffer account" | Buffer not deployed or wrong RPC | Verify buffer address and RPC |
| "Metadata buffer account not found" | Metadata buffer not uploaded | Run write-metadata-buffer action first |
| "Transaction simulation failed" | Insufficient compute or invalid accounts | Check priority-fee, verify all accounts exist |
| "Failed to get account info after 5 attempts" | RPC instability | Use a dedicated RPC endpoint |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.