Tidemark documentation
Tidemark reviews Solana program upgrades from bytecode: what changed, how risky it is, and a public record of who checked it.
Quickstart
Review the demo backdoor in two minutes.
Command line
diff, fetch, watch, census and the ledger commands.
VS Code extension
Compare your build with what is deployed before you ship.
npm package
The engine as WebAssembly for wallets and dashboards.
Risk rules
Every finding, what it means and how severe it is.
Attestation ledger
How reviews are bound to deployed bytes and co-signed.
Why it exists
Most Solana programs are upgradeable. Whoever holds the upgrade authority can replace the code users trust, and the people approving that upgrade usually see only a hash. Verified builds prove which source built a binary; they do not say what changed between two versions.
Tidemark compares the deployed program with the new build and answers the questions that matter before you sign:
- Did a new hardcoded key appear that could receive funds?
- Was an account check removed, or patched so it can never fail?
- Is there a new instruction handler, cross-program call or indirect call?
- Is the reviewed build exactly what is deployed now?
The pieces
- Engine (
tidemark-core): decodes SBPF v0 to v3, diffs, runs thetm-rulesand hashes the verdict. - Clients: the
tidemarkCLI, a VS Code extension, an npm package and this web app. All produce the same report and verdict hash. - Ledger: an Anchor program where reviewers publish verdicts, bound to the deployed bytes, and co-sign each other's reviews.
Heuristic review, not proof of safety
The rules catch real backdoor patterns, but a determined attacker can shape code to avoid them. Treat a clean report as "nothing obvious changed". The security model lists the known limits.