A Rust framework for Solana
Your program.
Your rules.
Direct to state.
Borrow account state. Declare the checks around it. Build in Rust with typed handlers, or take direct control through Hopper’s native runtime. Your program runs on Solana.
cargo add hopper-lang@0.5.0 --rename hopper --features proc-macros#[derive(Clone, Copy)]
#[repr(C)]
#[account(discriminator = 1, version = 1)]
pub struct Counter {
pub authority: Address,
pub value: WireU64,
}Account bytes become a typed view. WireU64 gives the counter a fixed, alignment-safe representation.
Raw hello-world fixture
Framework counter update
Public signatures. Recorded program hashes.
Fixture measurements: 2026-09-30, commit f6333ae. Method and limits
Keep control as your program grows.
Describe your accounts and actions in Rust. Add the validation your application needs, then use lower-level APIs where measurement shows they help. The execution stays on Solana.
Work directly with account state.
Supported layouts borrow account bytes directly, so updating a field does not require deserializing the whole account. Application code and other data formats can still allocate or copy.
How accounts are readDeclare what an instruction accepts.
Typed accounts check their owner and layout. Declare signer, writable, authority, and PDA constraints alongside them. Checked borrows and CPI reject incompatible live references. Your handler defines the application rules.
The Hopper modelStart high. Drop low where it counts.
Use #[program] and #[derive(Accounts)] for application handlers. Reach for runtime account views, CPI, and syscalls when you need direct control. The facade exposes both layers; lower-level code takes on the validation it bypasses.
The layersConstrain writes. Inspect the result.
Optional write policies constrain tracked mutations and CPI delegation. Manifests describe declared layouts and effects; self-audit tooling checks APIs, unsafe-code coverage, and dated validation evidence. Independent review remains open.
The self-auditStart with a program you can read.
These excerpts come from the linked Rust sources. Declare state, list accounts, and write a handler. Hopper generates the checks and the dispatch around your Rust code, and lower-level APIs are available when an instruction needs explicit control.
#[derive(Clone, Copy)]#[repr(C)]#[account(discriminator = 1, version = 1)]pub struct Counter { pub authority: Address, pub value: WireU64,}What will you build?
Start with a working program or a focused building block, then add the rules your application needs.
Token escrow
A working classic-token example: fund a vault, exchange the agreed tokens, cancel an offer, and refund surplus deposits.
Working exampleToken claims and rewards
Token CPI, receipt checks, and vesting and distribution math. Add funded custody, eligibility, and replay protection to build your claim program.
Claim building blocksAsset integrations
Token Metadata creation and update helpers. Marketplace settlement, programmable-NFT transfers, and Bubblegum integration require additional application code.
Plan an integrationSOL treasuries
Working multisig and delegated-spending examples with real SOL transfers, member approvals, budgets, and cooldowns.
Working examplesMeasure the programs your users run.
Start with the whole action: token movement, account checks, refunds, and failure behavior. These dated fixtures show what was measured; your program needs its own budget and tests.
Token escrow | Devnet, September 30, 2026
A real program, run on a real cluster.
Deposit, trade, refund, and cancel against the real SPL Token program: 33 finalized transactions, the refusals the program is supposed to make among them. Every one left exactly the account state it should have, and the deployed program matched the tested one byte for byte.
| On-chain action | Compute units |
|---|---|
| Create and fund an offer | 6,868 / 6,213 |
| Take the offer, refund the surplus, close the accounts | 7,836 |
| Cancel, refund the tokens, close the accounts | 3,586 |
The escrow example at commit 847a0b0, with real classic SPL Token transfers. The transactions and checks · The program
| Program | Hopper raw | Hopper framework |
|---|---|---|
| Hello world, compute units | 111 | 127 |
| Hello world, program size | 1,456 B | 1,824 B |
| PDA counter, create | 1,514 | 1,471 |
| PDA counter, update | 1,722 | 325 |
| PDA counter, program size | 6,608 B | 8,744 B |
The raw counter uses a 10-byte account and full PDA derivation on every update. The framework counter checks the signer, the owner, the layout, and the PDA before the handler runs; it checks the PDA with one hash from the bump stored in the account, and its account carries a 16-byte header (25 bytes).
Hopper hello-world and counter fixtures,2026-09-30, commit f6333ae. Different account layouts and PDA validation paths affect these costs. Reproduce it
Deployed fresh to devnet the same day, the Hopper programs were charged exactly these compute units, every account checked byte for byte. The transactions
Build at the level your program needs.
Start with typed accounts.
Describe account layouts, declare validation, and write the action your users need. Token and System Program builders carry out transfers; your code defines who may request them.
Control the hot path.
Use account views, explicit borrow checks, CPI, and syscalls directly. Review existing layouts and authority rules when porting a program, then measure its complete workload.
Coming from Pinocchio, Pina, Quasar, or Anchor? Compare account layouts, validation boundaries, and integration work in the source comparison. Performance depends on the complete instruction and its checks.
Hopper 0.6 · in development
Borrow the payload.
Keep the checks.
Declare one wire layout. Accept &MyArgs in an ordinary Rust handler, or parse it at a manual entrypoint. Both paths borrow the input and check nested option and enum values.
These excerpts share the same update function in the Solana fixture. Select an entry path, then explore valid and refused inputs in the browser illustration. Account authorization and business rules remain explicit.
#[instruction(2)]
pub fn exact(ctx: &mut Context<'_>, args: &Update) -> ProgramResult {
apply_update(
ctx.program_id,
ctx.accounts(),
ctx.instruction_data(),
args,
&[],
)
}The dispatcher borrows and validates &Update before entering the handler. apply_update checks accounts and applies the state transition.
Explore the wire contract and fixtureOne buffer. Typed access.
Change the input. See where validation stops it.
A typed reference reads amount = 42 from the same bytes. The absent second option ignores its ff payload.
Checked borrowed arguments
Next release · unreleased
Inside the function lab
Test what actually executes.
Small Solana programs put Hopper’s runtime boundaries under test. Open a check to see what counts as evidence.
The bytes must agree.
Hash results and integer operations are compared with known vectors and independent arithmetic. A successful transaction alone is not a passing test.
A refusal must hold.
Invalid lengths, missing authority, held borrows and out-of-bounds lenses must return the expected error. State tests also compare the whole account afterward.
The cluster decides.
Compiled VM tests, live devnet execution and feature-account observations are distinct evidence. Each test names its build and scope; unsupported calls stay visible.
Next release · checked borrowed batches
More elements.
One borrowed buffer.
Give a batch a capacity and a wire type. Hopper checks every element before your handler runs, without copying the batch into a capacity-sized array.
orders: BoundedSlice<'_, Order, 4>Validation visits the present elements. Borrowing saves the owned container; application checks and Solana transaction limits still apply.
The same capacity and element width reach your clients, even through Rust type aliases. Checked batch encoders are available for Rust, TypeScript, and Python.
Explore the batch contractAll 2 elements pass representation checks. The handler borrows the original bytes and applies its application rules.
Interactive wire-format illustration · not a transaction simulator
Build with Hopper 0.5.0.
Install the CLI, create a project, and build your first program. You will need Rust and the Solana SBF build tools; the getting-started guide covers setup. Version 0.5.0 was verified on crates.io on 2026-10-01.
Clone a reviewed revision, use a path dependency for `hopper-lang`, and install the CLI with `cargo install --path tools/hopper-cli`. Pin the exact Git revision in team and CI environments.