Programs Don't Store State

28 Aug 2026

A Solana program contains executable code. The mutable state it reads and changes lives in separate data accounts supplied to each instruction.

That separation changes how I read behavior. I look at the program ID, instruction data, account list, signer and writable flags, authorities, PDAs, CPI calls, and upgrade authority.

Three questions keep returning: Who can change the program? What accounts can it write to? Does an upgrade authority still exist?

Reading is not an audit. Start with the official program documentation and verify the accounts and instructions yourself.