Solana proposal would add hash validation to program migrations and upgrades

Serguey Asael Shinder26 October 2026, 15:061 min read

SIMD-0690, "Hash validation in program upgrades," is under review in the Solana improvement-documents repository, authored by Joe Caulfield and febo of Anza. It adds a hash-validation step to native and Loader v2-to-v3 program migrations and to Core BPF program upgrades. The motivation is a gap the authors describe plainly: migrations and upgrades can only be activated through a feature gate, but there is currently no check that the contents of the buffer account actually match the expected program data. The proposal extends three earlier accepted SIMDs — 0088, which defined migrating native programs to Core BPF, 0418 on Loader v2-to-v3 migrations, and 0495.

What it means

The risk here is specific and worth stating precisely. A feature gate controls when a migration activates, but it does not verify what gets installed, so the integrity of a system program swap rests on the buffer account holding exactly the bytes the network agreed to. Adding a hash check closes the window between "the network voted to migrate program X" and "the bytes that became program X are the ones that were reviewed." For the programs this covers — native and Core BPF programs are the ones the whole chain depends on — that is not a theoretical nicety; it is the difference between an auditable upgrade and a trusted one. The status is review, so this is a proposal, not shipped behaviour, and the detail that matters next is exactly which hash is committed to and when it is checked relative to activation.