Fireblocks Solana Program Management CLI

A command-line interface tool for managing Solana program authorities and upgrades through Fireblocks. This tool provides a secure way to handle program upgrades and authority transfers using Fireblocks' vault infrastructure.

⚠️ Important Disclaimers

• Reference Implementation Only: This tool is provided as a reference implementation and is not production-ready
• Hardcoded Values: Contains hardcoded values for vaultId ("1") and assetId ("SOL_TEST") that need to be configured for your specific use case
• Not Audited: This code has not been audited for security vulnerabilities
• Use at Your Own Risk: Please review and modify the code according to your security requirements before using in production

Prerequisites

• Node.js (v16 or higher)
• Fireblocks API credentials
• Solana keypair file (for authority operations)
• Access to a Solana RPC endpoint

Installation

npm install

Configuration

Before using the CLI, ensure you have:

1. Fireblocks API Credentials:

   • API Key
   • API Secret file

2. Solana Keypair: A JSON file containing your authority keypair

3. Network Configuration: Choose from supported networks or provide a custom RPC URL

Supported Networks

• mainnet-beta
• testnet
• devnet
• localnet

Program Deployment Workflow

For deploying a new Solana program, follow these steps in order:

1. Create Buffer Account: fireblocks create-buffer - Creates a buffer account to hold program data
2. Write Program Data: fireblocks write-buffer - Writes compiled program (.so file) to buffer in chunks
3. Deploy Program: fireblocks deploy - Deploys the program from buffer account for the first time

For upgrading an existing program:

1. Write New Program Data: fireblocks write-buffer - Write new program version to buffer
2. Upgrade Program: fireblocks upgrade - Deploy new version from buffer to existing program

Commands

1. Set Upgrade Authority (Checked)

Sets the upgrade authority for a program, requiring the new authority to sign the transaction. This is the safer option as it prevents accidental authority transfers.

fireblocks set-upgrade-authority-checked <programAddress> <newAuthority> <nonceAccount> [options]

Arguments:

• programAddress: The Solana program address
• newAuthority: The public key of the new authority
• nonceAccount: The nonce account address for transaction signing

Options:

• -a, --apiKey <key>: Fireblocks API key
• -s, --secretKey <secret>: Path to Fireblocks API secret file
• -k, --key <path>: Path to current authority keypair JSON file (default: ~/.config/solana/id.json)
• -n, --network <network>: Solana network (mainnet-beta, testnet, devnet, localnet)
• -u, --url <url>: Custom RPC endpoint URL

Example:

fireblocks set-upgrade-authority-checked \
  --apiKey your-api-key \
  --secretKey /path/to/secret.key \
  --key /path/to/authority.json \
  --network devnet \
  <program-address> \
  <new-authority-public-key> \
  <nonce-account-address>

2. Set Upgrade Authority (Unchecked)

Sets the upgrade authority without requiring the new authority to sign. Warning: This can lead to permanent loss of program authority if used incorrectly.

fireblocks set-upgrade-authority <programAddress> <currentAuthority> <newAuthority> [options]

Arguments:

• programAddress: The Solana program address
• currentAuthority: The public key of the current authority
• newAuthority: The public key of the new authority

Options:

• -a, --apiKey <key>: Fireblocks API key
• -s, --secretKey <secret>: Path to Fireblocks API secret file
• -n, --network <network>: Solana network
• -u, --url <url>: Custom RPC endpoint URL
• --nonce <nonce>: Nonce account address

Example:

fireblocks set-upgrade-authority \
  --apiKey your-api-key \
  --secretKey /path/to/secret.key \
  --network devnet \
  <program-address> \
  <current-authority-public-key> \
  <new-authority-public-key>

3. Create Buffer Account

Creates a buffer account for program deployment. This is the first step in deploying a new program.

fireblocks create-buffer <authority> [options]

Arguments:

• authority: The authority public key that will own the buffer

Options:

• -a, --apiKey <key>: Fireblocks API key
• -s, --secretKey <secret>: Path to Fireblocks API secret file
• -k, --key <path>: Path to authority keypair JSON file (default: ~/.config/solana/id.json)
• -n, --network <network>: Solana network (mainnet-beta, testnet, devnet, localnet)
• -u, --url <url>: Custom RPC endpoint URL
• --size <size>: Buffer size in bytes (default: 1MB)

Example:

fireblocks create-buffer \
  --apiKey your-api-key \
  --secretKey /path/to/secret.key \
  --key /path/to/authority.json \
  --network devnet \
  --size 2097152 \
  <authority-public-key>

4. Write Program to Buffer

Writes compiled program data to a buffer account in chunks. This is the second step in program deployment.

fireblocks write-buffer <bufferAccount> <authority> <programFile> [options]

Arguments:

• bufferAccount: The buffer account address (from create-buffer)
• authority: The authority public key
• programFile: Path to the compiled program file (.so)

Options:

• -a, --apiKey <key>: Fireblocks API key
• -s, --secretKey <secret>: Path to Fireblocks API secret file
• -k, --key <path>: Path to authority keypair JSON file (default: ~/.config/solana/id.json)
• -n, --network <network>: Solana network
• -u, --url <url>: Custom RPC endpoint URL
• -c, --chunkSize <size>: Chunk size in bytes (default: 900)

Example:

fireblocks write-buffer \
  --apiKey your-api-key \
  --secretKey /path/to/secret.key \
  --key /path/to/authority.json \
  --network devnet \
  --chunkSize 900 \
  <buffer-account-address> \
  <authority-public-key> \
  /path/to/program.so

5. Deploy Program

Deploys a program from a buffer account for the first time. This is the final step in program deployment.

fireblocks deploy <programAddress> <bufferAccount> <authority> [options]

Arguments:

• programAddress: The program address (will be created)
• bufferAccount: The buffer account address (from create-buffer)
• authority: The authority public key

Options:

• -a, --apiKey <key>: Fireblocks API key
• -s, --secretKey <secret>: Path to Fireblocks API secret file
• -k, --key <path>: Path to authority keypair JSON file (default: ~/.config/solana/id.json)
• -n, --network <network>: Solana network
• -u, --url <url>: Custom RPC endpoint URL

Example:

fireblocks deploy \
  --apiKey your-api-key \
  --secretKey /path/to/secret.key \
  --key /path/to/authority.json \
  --network devnet \
  <program-address> \
  <buffer-account-address> \
  <authority-public-key>

6. Upgrade Program

Finalizes a program upgrade by deploying the program from a buffer account.

fireblocks upgrade <programAddress> <bufferAccount> <authority> [options]

Arguments:

• programAddress: The Solana program address
• bufferAccount: The buffer account address containing the program data
• authority: The authority address that can perform the upgrade

Options:

• -a, --apiKey <key>: Fireblocks API key
• -s, --secretKey <secret>: Path to Fireblocks API secret file
• -n, --network <network>: Solana network
• -u, --url <url>: Custom RPC endpoint URL
• --nonce <nonce>: Nonce account address

Example:

fireblocks upgrade \
  --apiKey your-api-key \
  --secretKey /path/to/secret.key \
  --network devnet \
  <program-address> \
  <buffer-account-address> \
  <authority-public-key>

Environment Variables

You can also set Fireblocks credentials using environment variables:

export FIREBLOCKS_API_KEY="your-api-key"
export FIREBLOCKS_SECRET_KEY_PATH="/path/to/secret.json"

Security Considerations

1. Key Management: Store your Solana keypairs securely and never commit them to version control
2. API Credentials: Keep your Fireblocks API credentials secure and use appropriate access controls
3. Network Selection: Double-check the network parameter to avoid accidentally operating on the wrong network
4. Authority Transfers: Use the "checked" version of set-upgrade-authority when possible to prevent accidental transfers

Troubleshooting

Common Issues

1. Invalid Address Error: Ensure all Solana addresses are valid base58-encoded public keys
2. Program Not Found: Verify the program address exists on the specified network
3. Insufficient Permissions: Ensure your Fireblocks vault has the necessary permissions for the operations
4. Network Connectivity: Check your RPC endpoint connectivity and rate limits

Debug Mode

For debugging, you can add console.log statements or use Node.js debugging tools:

node --inspect-brk dist/index.js <command> [options]

Development

Building

npm run build

Code Structure

• src/index.ts: Main CLI entry point and command definitions
• src/types.ts: TypeScript type definitions
• src/utils.ts: Utility functions for connection and validation
• src/loader-v3.ts: Solana program loader instructions

Remember: This is a reference implementation. Always review and customize the code for your specific security and operational requirements before using in production.