Deployed bytecode reproducibility

Evidence summary #

Aggregator and perps programs: not reproducible by third parties — closed-source binary. Jupiter Lend (open-source): Code4rena repo specifies rustc 1.81.0 + Solana CLI 2.3.0, making reproducible build theoretically possible from published source. However no independent build verification is documented. Mixed: open-source Lend is yellow (spec provided but not verified); closed-source aggregator/perps are non-reproducible.

Sources #

Methodology #

Determine whether anyone can independently reproduce the deployed bytecode from the repo and declared build toolchain.

See the full factor methodology and distribution across all protocols →