Lightweight Frameworks Best Practices
Pinocchio and Steel remove Anchor guardrails - these practices put security and observability back intentionally.
How to Use This List
- Treat as native program security plus profiling discipline.
- Never merge CU wins that remove account validation.
- Publish IDL via Codama on every release.
A - Safety (non-negotiable)
- Keep the full manual account validation checklist - frameworks do not replace it. Prevents regressions vs Anchor defaults.
- Maintain SEEDS.md and error code tables alongside code. Client and audit alignment.
- Run reentrancy and duplicate-account tests on CPI paths. Same risks as native.
- Do not strip checks solely for CU - profile first, optimize second. Security > microseconds.
- Verifiable builds on every mainnet deploy. User trust.
B - Performance
- Snapshot CU p99 in LiteSVM CI for hot instructions. Catch regressions.
- Minimize logging in release feature flags. CU discipline.
- Audit dependency tree size after every new crate. Binary and CU blowups.
- Prefer zero-copy layouts when profiling proves deserialize cost. Measured wins only.
- Cap loops and CPI depth explicitly. Agave limits.
C - Ecosystem
- Generate clients with Codama for @solana/kit 7.0.0. Replace Anchor IDL workflow.
- Document framework version pins in README. Repro builds.
- CPI to Anchor programs with explicit account spec. Interop safety.
- Plan migration with byte-compatible layouts. User continuity.
- Re-benchmark after Agave upgrades. CU shifts.
FAQs
Skip Anchor entirely?
Many teams still start Anchor.
Pinocchio for beginners?
After native/Anchor fundamentals.
Steel default?
If between ergonomics and CU.
IDL without Anchor?
Codama.
Audit harder?
Often yes - budget time.
Immutable Pinocchio?
Same upgrade story.
Surfpool?
Default local.
Fuzz?
Instruction parsers.
Open source?
Recommended.
CU CI threshold?
Fail build if p99 exceeds budget.
Logs in prod?
Minimal.
Community?
Share benchmarks honestly.
Related
- Pinocchio Basics - Start
- CU & Binary-Size Wins - Measure
- Rust for Solana Best Practices - Rust habits
Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.