/solana-development

name: solana-development
description: Build, test, deploy, and audit Solana programs with Anchor or native Rust, and build with ZK Compression (Light Protocol). Use when developing Solana smart contracts, implementing token operations, optimizing compute, deploying to networks, auditing programs for vulnerabilities, or creating compressed tokens/PDAs.
metadata:
  version: "0.7.1"
  openclaw:
    homepage: https://github.com/tenequm/skills/tree/main/skills/solana-development
    emoji: "☀️"
    envVars:
      - name: SURFPOOL_DATASOURCE_RPC_URL
        required: false
        description: Dedicated mainnet RPC endpoint for surfpool's datasource (avoids public RPC rate limits when forking mainnet locally).

Solana

Everything for building on Solana: developing programs (Anchor or native Rust), auditing them for security, and building with ZK Compression. All three share the same core model - accounts, PDAs, CPIs, tokens - and differ only in abstraction level and goal.

What this skill covers

| Area | Use when | Jump to | |------|----------|---------| | **Development** | Writing programs, tokens, tests, deployments | [Development](#development) | | **Security & Auditing** | Reviewing for vulnerabilities, writing exploits, audit reports | [Security and Auditing](#security-and-auditing) | | **ZK Compression** | Rent-free tokens/PDAs at scale via Light Protocol | [ZK Compression](#zk-compression) |

---

Development

Build Solana programs with Anchor (recommended) or native Rust. Both share accounts, PDAs, CPIs, and tokens; they differ in syntax and abstraction.

Quick Start

Recommended: Anchor Framework

Macros and tooling that cut boilerplate and generate TypeScript clients:

use anchor_lang::prelude::*;

declare_id!("YourProgramID");

#[program]
pub mod my_program {
    use super::*;

    pub fn initialize(ctx: Context<Initialize>, data: u64) -> Result<()> {
        ctx.accounts.account.data = data;
        Ok(())
    }
}

#[derive(Accounts)]
pub struct Initialize<'info> {
    #[account(init, payer = user, space = 8 + 8)]
    pub account: Account<'info, MyAccount>,
    #[account(mut)]
    pub user: Signer<'info>,
    pub system_program: Program<'info, System>,
}

#[account]
pub struct MyAccount {
    pub data: u64,
}

cargo install --git https://github.com/coral-xyz/anchor avm --locked --force
avm install latest && avm use latest
anchor init my_project && cd my_project && anchor build && anchor test

**→ See [references/anchor.md](references/anchor.md) for the complete Anchor guide**

Advanced: Native Rust

Maximum control, optimization potential, and deeper runtime understanding:

use solana_program::{
    account_info::AccountInfo, entrypoint, entrypoint::ProgramResult,
    pubkey::Pubkey, msg,
};

entrypoint!(process_instruction);

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    msg!("Processing instruction");
    // Manual account parsing, validation, and instruction routing
    Ok(())
}

cargo new my_program --lib
cd my_program   # configure Cargo.toml (see native-rust.md)
cargo build-sbf

**→ See [references/native-rust.md](references/native-rust.md) for the complete native Rust guide**

When to use which

| Your need | Approach | Reason | |-----------|----------|--------| | Standard DeFi/NFT program | Anchor | Faster, proven patterns | | TypeScript client needed | Anchor | Auto-generates IDL + types | | New to Solana | Anchor | Gentler learning curve | | Compute optimization critical | Native Rust | Direct control, no overhead | | Smallest program size | Native Rust | No abstraction layer | | Learning fundamentals | Native Rust | Understand the platform deeply |

You can also start with Anchor for speed, then optimize hot paths with native patterns. Both can coexist in one workspace.

Reference map

**Foundations**

• [accounts.md](references/accounts.md) - Account model, ownership, rent, validation
• [pda.md](references/pda.md) - Program Derived Addresses: derivation, canonical bumps, signing
• [cpi.md](references/cpi.md) - Cross-Program Invocations safely

**Tokens**

• [tokens-overview.md](references/tokens-overview.md) - Token accounts and ATAs
• [tokens-operations.md](references/tokens-operations.md) - Create, mint, transfer, burn, close
• [tokens-validation.md](references/tokens-validation.md) - Account validation patterns
• [tokens-2022.md](references/tokens-2022.md) - Token Extensions Program
• [tokens-patterns.md](references/tokens-patterns.md) - Common patterns and security

**Testing**

• [testing-overview.md](references/testing-overview.md) - Test pyramid and strategy
• [testing-frameworks.md](references/testing-frameworks.md) - Mollusk, Anchor test, native Rust
• [testing-practices.md](references/testing-practices.md) - Best practices and patterns
• [surfpool.md](references/surfpool.md) - Local dev with mainnet forking, cheatcodes, IaC

**Deployment**

• [deployment.md](references/deployment.md) - Deploy, upgrade, verify, manage programs
• [production-deployment.md](references/production-deployment.md) - Verified builds (Anchor 0.32.1)

**Client**

• [client-development.md](references/client-development.md) - dApp client: wallet connections, React hooks, SOL/SPL transfers, transaction management (framework-kit and @solana/kit 6.x)

**Implementation details**

• [serialization.md](references/serialization.md) - Data layout, Borsh, zero-copy
• [error-handling.md](references/error-handling.md) - Custom errors, propagation, client handling
• [security.md](references/security.md) - Defensive programming patterns during development

**Advanced**

• [compute-optimization.md](references/compute-optimization.md) - CU optimization and benchmarking
• [versioned-transactions.md](references/versioned-transactions.md) - Address Lookup Tables for 256+ accounts
• [durable-nonces.md](references/durable-nonces.md) - Offline sig