Lightweight Frameworks Best Practices

Pinocchio and Steel remove Anchor guardrails - these practices put security and observability back intentionally.

How to Use This List

• Treat as native program security plus profiling discipline.
• Never merge CU wins that remove account validation.
• Publish IDL via Codama on every release.

A - Safety (non-negotiable)

• Keep the full manual account validation checklist - frameworks do not replace it. Prevents regressions vs Anchor defaults.
• Maintain SEEDS.md and error code tables alongside code. Client and audit alignment.
• Run reentrancy and duplicate-account tests on CPI paths. Same risks as native.
• Do not strip checks solely for CU - profile first, optimize second. Security > microseconds.
• Verifiable builds on every mainnet deploy. User trust.

B - Performance

• Snapshot CU p99 in LiteSVM CI for hot instructions. Catch regressions.
• Minimize logging in release feature flags. CU discipline.
• Audit dependency tree size after every new crate. Binary and CU blowups.
• Prefer zero-copy layouts when profiling proves deserialize cost. Measured wins only.
• Cap loops and CPI depth explicitly. Agave limits.

C - Ecosystem

• Generate clients with Codama for @solana/kit 7.0.0. Replace Anchor IDL workflow.
• Document framework version pins in README. Repro builds.
• CPI to Anchor programs with explicit account spec. Interop safety.
• Plan migration with byte-compatible layouts. User continuity.
• Re-benchmark after Agave upgrades. CU shifts.

FAQs

Related

• Pinocchio Basics - Start
• CU & Binary-Size Wins - Measure
• Rust for Solana Best Practices - Rust habits

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.