Solana Program Upgradeability Report — Q3 2026 — VaultLint

Who can replace the code running on Solana

Report<br>Q3 2026<br>29 July 2026<br>65,119 programs

An audit describes the code that existed on the day it was written. On Solana, the median<br>busy program is replaced about every two weeks — and<br>half the time the replacement needs a single signature.

What we found

On 29 July 2026 we asked Solana mainnet two questions about every upgradeable program it carries: who is allowed to replace this code , and how recently did they . The answers come from 65,119 program accounts and from the 348 programs we observed actually being invoked.

49%

of the 100 busiest programs are upgradeable by a single keypair rather than an on-chain multisig

13 days

median time since the last deploy, among those same 100

3%

have given up the ability to change at all — the authority is revoked

Immutability is not the norm on Solana; it is a rounding error. Whatever you are interacting with, someone almost certainly retains the power to replace it, and on current rates they exercise that power often.

Why anyone should care

Solana's upgradeable loader is a feature, not a flaw. Being able to ship a fix without migrating state is why protocols can respond to an incident in hours instead of weeks, and nobody sensible argues that every program should be frozen on day one.

But it has a consequence that is easy to state and rarely quantified: a security review describes a binary, and that binary has an expiry date nobody writes down. If you read a protocol's audit, integrated it, and moved on, the question of what is running at that address today is a separate question — and this report is an attempt to say how separate.

The second question, who holds the key, is the one that decides how quickly a mistake becomes irreversible. A program behind an on-chain multisig can only be replaced by a quorum whose members and threshold anyone can read from the chain. A program behind a single keypair can be replaced by whoever holds that key.

Two very different networks

The first thing the data says is that "programs on Solana" is not one population. Of a random 2,000 drawn from the 65,119 upgradeable program accounts, only 610 still have a ProgramData account at all — the other 70% have been closed or abandoned. Their median program was last deployed 353 days ago. That is a graveyard, and any statistic computed over it describes the dead.

So we measured a second population: every program that appeared in a real instruction, top-level or inner, across 25 sampled blocks. That gives 348 distinct programs across 132,563 invocations — the network as it is actually used, weighted by use. Eight of the 348 are native programs with no ProgramData (ComputeBudget, Vote, System, Associated Token, Memo, Ed25519, Secp256k1), which is a check on the method rather than a gap in it.

Both populations appear in every table below, because the gap between them is one of the findings.

Who can replace the code

An upgrade authority is either a plain public key, or a program-derived address (a PDA), or absent. The three are cleanly distinguishable without trusting any label: a PDA is by construction not a valid ed25519 curve point — that is exactly what makes it unsignable by a private key. So an on-curve authority is one a keypair can sign for, an off-curve authority is one only a program can authorise, and an absent authority means the program is immutable.

PopulationProgramsSingle keypairProgram-controlledImmutable

Top 25 by invocations2513 (52%)11 (44%)1<br>Top 50 by invocations5028 (56%)21 (42%)1<br>Top 100 by invocations10049 (49%)48 (48%)3<br>All invoked340215 (63%)114 (33%)11<br>Random sample of all 65,119610538 (88%)56 (9%)16

Solana mainnet, 29 July 2026, slot 435,941,295. Percentages are of the resolved programs in each row.

The gradient is the story. Abandoned programs are overwhelmingly single-key, which surprises nobody — they are hobby deploys and dead experiments. Custody discipline improves steeply with how much a program is actually used. And it improves to roughly a coin flip: among the hundred programs carrying the most traffic on Solana, 49 are not behind an on-chain multisig .

One number is flat across every population, and it is the one we did not expect: immutability sits at 3% everywhere. Almost nothing on Solana has ever given up its upgrade authority. Among the busiest hundred, the notable exception is SPL Token itself, whose authority is revoked.

How often the code changes

Recency first. Ages are computed against a measured slot time of 0.3976 seconds , calibrated over 50 million slots rather than assumed from the nominal 400 ms.

PopulationMedian age≤ 30 days≤ 90 days

Top 25 by invocations13 d19 (76%)24 (96%)<br>Top 50 by invocations12 d35 (70%)46 (92%)<br>Top 100 by invocations13 d60 (60%)81 (81%)<br>All invoked25 d178 (52%)254 (74%)<br>Random sample of all 65,119353 d62 (10%)144 (23%)

Days since the last deploy, and the share of each population...