See what a program upgrade really changes
Any upgradeable Solana program can be replaced by whoever holds its key. Tidemark reads the new bytecode, shows what changed and how risky it is, and records the review on a public ledger.
- 16 / 16
- SBPF version pairs where the demo backdoor scores HIGH
- 0
- bytes uploaded: review runs locally
- k-of-n
- independent reviewers before an entry is final
Signers approve a hash they cannot read
Verified builds prove which source produced a binary. Monitors tell you an upgrade happened. Neither tells a multisig signer, an integrator or a user what the new code does differently, and source can differ from what is deployed.
- Did a new key appear that could receive funds?
- Was a signer, owner or has_one check removed, or patched so it can't fail?
- Is there a new instruction, CPI or indirect call?
- Is what was reviewed exactly what is deployed now?
Everything an upgrade review needs
Deterministic rules do the detection. An optional AI judge explains the findings in plain English and can only ever raise the risk.
Bytecode diff
Disassembles both sBPF builds, v0 to v3, and aligns them so moved code doesn't hide the real change.
Learn more →Risk rules
New hardcoded keys, neutralized account checks, new handlers, retargeted branches and new CPIs, ranked by severity.
Learn more →Quorum ledger
Reviews are hash-linked on Solana, bound to the deployed bytes and co-signed by independent reviewers.
Learn more →Authority census
See who can upgrade a program today: a single key, a multisig, governance, a program or nobody.
Learn more →Upgrade watcher
Snapshots a program and reviews every upgrade as it lands, with optional on-chain attestation.
Learn more →Runs where you work
One engine in the CLI, CI, VS Code, an npm package and this site. Files never leave your machine.
Learn more →Pick your entry point
The same engine and the same verdict hash, wherever you start.
VS Code
Program developers before anchor deployTidemark: Review a build against the deployed programExtension guide →From one signature to a co-signed review
Four steps, the same on every machine, so anyone can check the result.
An upgrade is signed
One signature from the upgrade authority swaps the bytes in ProgramData. No source code is involved, and nothing forces a review.
A real upgrade, reviewed and co-signed
A demo vault was upgraded on devnet to a build with a hidden sweep. Reviewer one attested HIGH and the ledger checked on chain that the deployed bytes match the reviewed build. Reviewer two re-ran the review independently and co-signed. The ledger's own upgrade key sits behind a Squads multisig with a timelock.
Verify it in your browserCheck your next upgrade before you sign
Open source, MIT licensed, and running entirely on your machine.