Deployment Audits
Deployment audits for Solana, EVM and Move protocols. We verify the release build, the launch sequence and the multisig transactions before your code goes live.
REQUEST A DEPLOYMENT AUDITTHE CHALLENGE
An audit reviews code at a commit. Launch day runs a binary.
The deployed program is built by a specific toolchain, initialized by scripts, configured with parameters and upgraded through a multisig. Each of those steps can break audited code: a compiler version that pushes an instruction past its stack limit, an initialization anyone can front-run, a release flag that changes more than it should, an upload that does not match the reviewed source.
A deployment audit checks the release itself, so the code on-chain is the code that was audited.
HOW IT WORKS
How a deployment audit runs
Ten steps, from the release commit to on-chain verification. They catch bugs that only appear in the release build, the deploy order or the multisig transaction, before launch day.
Phase 1: Scope the release
After the audit, before launch
Release scope
Adevar Labs and clientRelease commit, feature flags, deploy scripts, init parameters, multisig transactions and the exact toolchain you build with.
Diff against the audit
Adevar LabsEvery change since the audited commit reviewed. A flag-only release is checked to be flag-only.
Phase 2: Build and rehearse
Days before launch
Reproducible build
Adevar LabsThe release rebuilt with your toolchain in a verifiable build, so the hash you deploy can be reproduced.
Fresh deploy rehearsal
Adevar LabsDeployed from scratch on a fork or devnet, then initialized and run through every instruction, upgrade and migration path.
Launch sequence review
Adevar LabsDeploy, initialize, seed and upgrade order checked for front-running, griefing and empty-pool attacks.
Phase 3: Fix and sign off
Before launch day
Repeats · Until the release is clean
Release fixes
ClientIssues fixed on the release branch, with a new build hash.
Re-check
Adevar LabsThe new build reproduced and the rehearsal run again.
Repeats until the rebuilt release passes the rehearsal.
Transaction review
Adevar LabsMultisig payloads decoded before signing: program, buffer, authorities and parameters match the plan.
Phase 4: Launch and verify
Launch day
Deploy
ClientYour team runs the agreed sequence through its multisig.
On-chain verification
Adevar LabsDeployed bytecode matched to the verified build; authorities, configuration and initial state read back.
Applies to new deployments, upgrades and migrations of audited code.
FAQ
Frequently Asked Questions
Ready to get started?
Tell us about your project and we'll scope the right engagement for your team.
REQUEST A DEPLOYMENT AUDIT