Release and audit status

Framework and CLI remain 0.4.0. Published patches: native 0.4.4, runtime 0.4.5, and Solana integration 0.4.1. Support packages keep independent versions.

The 0.4 release adds named fixed-field initialization while retaining ordinary Rust handlers and explicit account APIs. It corrects typed DSL header offsets, safe projection size checks, segment geometry, and the SOL vault's System CPI account list. See migration for compatibility details.

Native 0.4.4 and runtime 0.4.5 — instruction inspection

Published on crates.io: hopper-native 0.4.4 and hopper-runtime 0.4.5. Framework and CLI remain 0.4.0; Solana integration remains 0.4.1. Registry downloads match the publication source and checksums. A registry-only consumer compiles the new inspection API alongside token payouts and framework 0.4.0.

Programs can inspect prior sibling calls directly on chain using caller-owned data and account buffers. get_processed_instruction_into queries exact sizes, copies only when both buffers fit, exposes account identities and privileges, and distinguishes absence from insufficient capacity. It needs no heap or off-chain trace service. Instruction inspection guide.

This fixes the old wrappers' reversed syscall result handling and incorrect length assumptions. Published native 0.4.2/runtime 0.4.3 reproduce four failures in compiled SBF. The fix passes all 11 scenarios on both SBF v0 and v3, including empty and missing instructions, sibling order, child exclusion, a 1,300-byte CPI payload and two capacity refusals. Host tests, Miri, framework/core tests, Clippy, local API docs and the 29-package unsafe-contract scan passed.

The September 27 devnet run finalized 11 transactions with matching complete payer/program snapshots, including two expected capacity refusals. The deployed v0 ELF matched before and after the run. The implementation shipped in native 0.4.3/runtime 0.4.4; the final patch corrects packaged README wording. Its Rust implementation is unchanged and rebuilt v0/v3 ELFs are byte-identical to those tested. Source and binary lineage is recorded in the evidence.

Sibling inspection is scoped to the same depth and caller. It is not a complete transaction trace, transfer-outcome proof, or signature-payload validator. Applications retain explicit authorization and outcome checks. These targeted results do not establish a whole-framework security audit or universal speed lead.

Signatures, snapshots, source pins and publication evidence.

cargo update -p hopper-native -p hopper-runtime

Runtime 0.4.3 and Solana integration 0.4.1 — token receipts

Published on crates.io: hopper-runtime 0.4.3 and hopper-solana 0.4.1. At that release, native was 0.4.2; framework and CLI were 0.4.0. Downloaded package sources and checksums match the release commit, and a registry-only payout consumer compiles with framework 0.4.0.

TokenTransferSnapshot binds a source and destination to an exact debit and an explicit minimum receipt. It re-reads their program owner, base account shape, initialized state, mint, and token authorities after CPI. No data borrow remains held during the transfer. Applications keep control of authorization, extension policy, and their choice of transfer builder. Payout guide.

The devnet fixture finalized 34 transactions using real classic SPL Token and Token-2022 accounts with a 1% transfer fee. All complete account snapshots matched, including withheld fees, lamports and transaction fees. Thirteen transactions were expected refusals; seven proved rollback after a successful nested token CPI. The deployed v0 ELF matched the tested binary before and after the run.

The runtime patch also fixes two host regressions. Deduplicated System-transfer infos now resolve by address instead of list position. Host mutable borrow guards retain a release lease without moving a parent mutable reference after deriving a pointer. The baseline transfer debited an unrelated extra account; Miri caught the borrow-wrapper provenance error. Both fixes pass their regressions and Miri. The existing on-chain representations did not have these two host defects.

Compiled v0/v3 token scenarios, changed-crate tests, framework/core tests, Clippy, local API docs, and the 29-package unsafe-contract scan passed. Host token CPI no-ops are not used as evidence of token movement. This is targeted validation, not an independent security audit or a whole-framework speed comparison.

Signatures, snapshots, builds and registry evidence.

cargo update -p hopper-runtime -p hopper-solana

Native/runtime 0.4.2 — account lifecycle and borrow safety

Published on crates.io: hopper-native and hopper-runtime 0.4.2. Registry downloads match the release source and checksums.

The 0.4.2 patch keeps an account's native borrow alive for the full lifetime of an SBF segment guard. Conflicting whole-account access, another registry, closure, resizing, and writable checked CPI are refused while that guard lives. Use split_segments_mut to edit several disjoint fields together; it validates all ranges and holds one exclusive account borrow. Its hidden unchecked constructor is now crate-private.

Close helpers preflight borrows, writable requirements, aliases, arithmetic, and applicable runtime policies before changing balances. A caught refusal leaves both accounts intact. Direct self-transfers are balance-checked net zero; an underfunded account cannot serve as its own resize payer.

The native batch::ResizeWithPayer builder funds missing rent through a checked System Program CPI, checks the current program owner and entry-time growth limit before charging, and zeroes newly exposed bytes. Shrinking retains excess lamports. Applications still authorize the resize and propagate CPI errors. Ref and RefMut now provide map, try_map, and filter_map for field access that retains the original account borrow.

The old published runtime fails the compiled segment regression; the patched runtime passes. Native/runtime fixtures and the treasury, multisig, token escrow, byte allowance, and ambient write-gate suites pass on sBPF v0 and v3. The new lifecycle run finalized 24 devnet transactions, including two expected transaction refusals and successful instructions that catch and inspect local refusals. Complete lifecycle snapshots include fees, data, balances, owners, and the closed-account result. Both deployed v0 ELFs matched before and after. The native lifecycle and mapped-borrow tests also pass Miri. The final projection correction produces byte-identical lifecycle ELFs; source lineage records that relationship instead of treating a host-only result as on-chain evidence.

Source, test logs, signatures, snapshots, and hashes.

Update existing lockfiles with cargo update -p hopper-native -p hopper-runtime. The framework and CLI remain 0.4.0. These are targeted correctness and developer experience improvements; they do not establish universal performance leadership.

Native/runtime 0.4.1 patch — September 26, 2026

hopper-native and hopper-runtime 0.4.1 are published. The framework and CLI remain 0.4.0; support packages keep their independent versions. Existing lockfiles must update the native/runtime dependencies to pick up the patch:

cargo update -p hopper-native -p hopper-runtime

The patch rejects missing signers in specialized checked CPI, uses immediate SVM aborts for no-allocation failures and panics, and validates the producer and typed prefix of CPI return data. A nested callee's unforwarded return data is rejected. Application-level value and outcome checks are still required.

The repository also adds member-authorized SOL custody and expiring, revocable single-use payouts, and corrects treasury funding, segment validation, and cooldown enforcement. These examples are not published crates.

81 devnet transactions finalized, including 30 expected refusals across governance/treasury/native probes (44), funded classic-token escrow (33), and direct/nested CPI return data (4). Local compiled tests cover v0 and v3; deployed v0 ELFs matched before and after each run. Registry downloads match their published checksums and source files, and a registry-only consumer builds.

Exact source pins, signatures, snapshots, hashes, and tests.

Original 0.4.0 scope and source

The complete local gate run and devnet run used clean source 8ca9f5c984b81a18a87edbd1ed19c5ac3106d2cb. Publication documentation may be a later commit; the archived source-lineage receipt enumerates every difference and requires executable source, manifests, and lockfiles to remain identical.

Host tests, clippy, unsafe-boundary checks, actual build-time forged-size rejections, SBF v0/v3 named vault, byte allowance, runtime gate, mint plan, and canonical-PDA suites passed. The orderbook compiled fixture, 23 Cicada compiled lifecycle cases, and 698 Cicada host semantic cases passed. Host semantic execution is distinct from compiled SBF and finalized devnet execution.

Finalized devnet vault

Program: 3KQueyP2phWfwdnju1o98zNVU4vRrr3yerUgvkwjBzK5. Public devnet genesis: EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG. The v0 ELF is 12,464 bytes, SHA-256 15a3fdfc21cecc094e5e7fd88c1edd7457c7f6999b7dbd11a22e7a1556039832. Dumps before and after testing match it exactly.

All 19 transactions finalized. Complete snapshots include the fee payer, authority, both vaults, outsider, and System Program, with expected fees, lamports, ownership, and data checked after every operation. This includes fresh/prefunded initialization and refusal cases. Overflow after a successful transfer CPI is covered in compiled SBF; that synthetic state is not created by this devnet runner. The standalone legacy DSL handlers are host-tested and are not dispatched by this vault ELF.

These figures describe this artifact and account set. They do not replace the dated peer benchmark table or establish universal performance leadership.

Architecture and evidence limits

The placement compiler and broad account-wrapper extension model remain proposals. Named inputs implement an open, safe value-writing trait; they do not grant ownership, authorization, rollback, or arbitrary wrapper support. Cicada remains an integration workload and Grillo an optional evidence consumer. Hopper's runtime checks execute in the program.

Hosted CI and registry results are captured separately in the final evidence archive and publication receipts. This local validation is not an independent security audit.