Hopper docs
Start with your first program, then go as deep as you need: account layouts, CPIs and tokens, migrating existing programs, the CLI, and the self-audit.
These docs cover the published 0.5.0 release, except where a page says it describes main. Benchmarks carry their date and commit.
First five minutes
Counter, vault, dynamic multisig, token transfer, and raw escape hatch in one short path.
Why Hopper
Build programs that move funds, read state in place, and enforce application rules on chain.
Write lower-level programs
Use the native runtime directly and adopt typed accounts where they help your program.
Move a program to Hopper
From an Anchor-style program: constraints, account wrappers, initialization, and IDL expectations.
Client generation
Generate TS, Kotlin, Python, Go, C, and Rust readers from one Hopper manifest.
Release and audit status
Published packages, measured behavior, and the remaining scope of security review.
Start
Verify token payouts
Set a minimum receipt for escrow releases, claims, and treasury payouts, including transfer fees.
Delegated SOL treasury
Fund a treasury and enforce operator, budget, freeze, cooldown, and rent rules on withdrawals.
Funded token escrow
Classic SPL Token custody, atomic exchange, maker refunds, and explicit token policy.
Governance and DAOs
Member-approved SOL custody, expiring payouts, permissionless execution, and revocation.
Build your application
Trading, claims, and NFT markets: available examples, building blocks, and integrations you supply.
Named initialization
Create typed state with named values and application-defined inputs.
On-chain byte allowance
A four-cell application quota program with captured selectors, delegate checks, revisions, and strict byte policies.
Release and audit status
The published 0.5.0 registry release, verified package checksums, dated program evidence, and remaining audit work.
First five minutes
The shortest path through account declarations, typed contexts, handlers, dynamic tails, and raw escape hatches.
Getting started serious
Install Hopper, scaffold a program, and ship a complete first workflow.
Why Hopper
Build programs that move funds, read state in place, and enforce application rules on chain.
Writing programs
Layouts, contexts, policies, receipts, and the program structure Hopper expects.
Token-2022 guide
Validate Token-2022 ownership and extensions, and initialize exact-size mints with explicit extension plans.
Tail lab example
Bounded dynamic fields, TailStr, TailBytes, init helpers, and account wrappers.
Styx ferry messaging
Forward-secret messaging and VSL ferry proof control plane using Hopper crypto, precompile checks, and verifier CPI paths.
Program examples
Examples that combine policies, typed contexts, dynamic state, schemas, and operational tooling.
Model
Borrow bounded batches
Checked variable-length instruction views, reusable wire contracts, and generated clients.
The Hopper model
How Hopper loads, validates, mutates, records, migrates, and explains account state.
Architecture
The crate and runtime layers behind typed zero-copy state, schemas, receipts, and CLI inspection.
Hopper layers
A map of the framework, runtime, schema, SPL, CLI, and example layers.
Memory access
The safe, pod, raw, and cross-program access tiers and when each belongs in a handler.
Events over self-CPI
Anchor’s emit_cpi ergonomics on a 3-byte wire: authenticated event self-CPI, measured costs, and the runtime PDA trade-off, live on devnet.
Composite contexts
Nest one accounts context inside another with Anchor-style flattening, and write-sets, events, and touch maps that compose across the boundary.
Crypto capabilities
Hashing, precompile checks, secp recovery, and opt-in curve, Poseidon, BN254, and modular-exponentiation APIs.
Native backend
The native account-view substrate, syscall boundary, and no_std runtime shape.
Native enhancements
Native backend capabilities that make Hopper programs inspectable without changing the wire format.
Migration
Preparing for Hopper 0.6
Checked wire contracts, alias-preserving metadata, and explicit client compatibility.
Choosing a zero-copy boundary
Source-pinned comparisons with Pinocchio, Pina, Quasar, and Anchor v2.
Write lower-level programs
Use account views, checked CPI, and syscalls directly, with explicit validation and workload tests.
Moving to Hopper 0.4
Matching derive versions, corrected overlays, and stricter memory bounds.
Moving to Hopper 0.5
Two readers that close unsound borrows, the versions that follow from them, and what is new.
Lazy migration at bind
Declare the previous layout version on a field and every instruction becomes a migration crank, typed, in place, measured live on devnet.
Bounded account fields
Bounded strings and vectors with Hopper layout fingerprints and migration-aware capacities.
Collections and safe resizing
Bounded fields, growable Seq, stable-ID Slab, and rent-safe grow or fit migrations over account bytes.
Dynamic account tails
Final TailStr and TailBytes regions for deliberate remaining-byte account designs.
Program migration
How to map account constraints, IDL expectations, and program structure into Hopper.
Program capabilities
Account lifecycle, asset movement, governance, integration APIs, and their boundaries.
Bounded multisig
Real member signatures, bounded storage, and SOL deposits and withdrawals.
Operations
Current network baseline
October 7, 2026 feature observations, tested syscall limits and sysvar consistency findings.
Solana compatibility baseline
Finalized feature and rent observations with explicit transaction and deployment limits.
Solana network compatibility
September 30 local / October 1 UTC public-cluster observations, Alpenglow on devnet and testnet, and on-chain Clock semantics.
Self-describing transactions
Opt-in byte-range touch maps for Hopper-tracked acquisitions, with raw escapes and partial maps kept outside completeness claims.
Manifests and tx tooling
Manifest generation, versioned ELF interface binding, and the no-Node hopper tx send / tx explain loop.
Offline effect verification
How Grillo recomputes mutation containment, what its PASS proves, and why it has no on-chain deployment rent.
Schema architecture
Program manifests, layout IDs, Hopper IDL, Codama JSON, lossless Solana IDL projection, and compatibility diffs.
On-chain schema proposal
A clearly labeled design for future manifest pointers, separate from the shipped Program Metadata IDL path.
CLI reference
Schema export, account inspection, explain, manager, profiling, publish checks, and client generation.
Client generation
Generate TypeScript, Kotlin, Python, Go, C, and off-chain Rust clients from one Hopper manifest.
Hopper manager
Operator-facing manifest fetch, decode, identify, summary, invoke, receipt, and crank tools.
Profiling
Static SBF ELF analysis, folded-stack output, flamegraph export, and benchmark provenance.
CU costs
Compute-unit notes for validation, loading, receipts, events, and access tiers.
Benchmark policy
How Hopper reports same-provenance performance data without overclaiming.
Safety
Test functions on Solana
Executable probes, independent expected values, account invariants and explicit cluster limits.
Release readiness
Current execution receipts, dossier findings, and remaining release requirements.
Borrowed instruction arguments
Unreleased: validate nested zero-copy arguments and choose exact payloads or borrowed tails.
Inspect prior calls on chain
Read a prior call, its accounts, and its privileges with caller-owned buffers and explicit authorization.
Program design
Design executable account, authorization, asset, and CPI contracts.
Policy guarantees
Strict, sealed, and raw modes, plus what each access tier promises.
Self-audit
What Hopper checks at compile time, at bind, and between releases, and what those checks do not prove.
Proc macro policy
The public macro contract for account, context, program, instruction, and policy generation.
Unsafe invariants
The audit ledger for raw-pointer boundaries and safety contracts.