docs: Clarify audit status of all programs, no S word (#4046)

Author: joncinque

README.md

@@ -1,21 +1,52 @@
-[![Build status][travis-image]][travis-url]
-
-[travis-image]:
-https://travis-ci.org/solana-labs/solana-program-library.svg?branch=master
-[travis-url]: https://travis-ci.org/solana-labs/solana-program-library
-
 # Solana Program Library
 
 The Solana Program Library (SPL) is a collection of on-chain programs targeting
 the [Sealevel parallel
 runtime](https://medium.com/solana-labs/sealevel-parallel-processing-thousands-of-smart-contracts-d814b378192).
 These programs are tested against Solana's implementation of Sealevel,
-solana-runtime, and deployed to its mainnet.  As others implement Sealevel, we
-will graciously accept patches to ensure the programs here are portable across
-all implementations.
+solana-runtime, and some are deployed to Mainnet Beta.  As others implement
+Sealevel, we will graciously accept patches to ensure the programs here are
+portable across all implementations.
 
 For more information see the [SPL documentation](https://spl.solana.com) and the [Token TypeDocs](https://solana-labs.github.io/solana-program-library/token/js/).
 
+## Audits
+
+Only a subset of programs within the Solana Program Library repo are deployed to
+the Solana Mainnet Beta. Currently, this includes:
+
+| Program | Last Audit Date | Version |
+| --- | --- | --- |
+| [token](https://github.com/solana-labs/solana-program-library/tree/master/token/program) | 2022-08-04 (Peer review) | [3.4.0](https://github.com/solana-labs/solana-program-library/releases/tag/token-v3.4.0) |
+| [associated-token-account](https://github.com/solana-labs/solana-program-library/tree/master/associated-token-account/program) | 2022-08-04 (Peer review) | [1.1.0](https://github.com/solana-labs/solana-program-library/releases/tag/associated-token-account-v1.1.0) |
+| [token-2022](https://github.com/solana-labs/solana-program-library/tree/master/token/program-2022) | [2022-12-05](https://github.com/solana-labs/security-audits/blob/master/spl/ZellicToken2022Audit-2022-12-05.pdf) | [0.5.0](https://github.com/solana-labs/solana-program-library/releases/tag/token-2022-v0.5.0) |
+| [governance](https://github.com/solana-labs/solana-program-library/tree/master/governance/program) | N/A | [3.1.0](https://github.com/solana-labs/solana-program-library/releases/tag/governance-v3.1.0) |
+| [stake-pool](https://github.com/solana-labs/solana-program-library/tree/master/stake-pool/program) | [2023-01-31](https://github.com/solana-labs/security-audits/blob/master/spl/NeodymeStakePoolAudit-2023-01-31.pdf) | [1.0.0]() |
+| [account-compression](https://github.com/solana-labs/solana-program-library/tree/master/account-compression/programs/account-compression) | [2022-12-05](https://github.com/solana-labs/security-audits/blob/master/spl/OtterSecAccountCompressionAudit-2022-12-03.pdf) | [0.1.3](https://github.com/solana-labs/solana-program-library/releases/tag/account-compression-v0.1.3) |
+| [shared-memory](https://github.com/solana-labs/solana-program-library/tree/master/shared-memory/program) | [2021-02-25](https://github.com/solana-labs/security-audits/blob/master/spl/KudelskiTokenSwapSharedMemAudit-2021-02-25.pdf) | [1.0.0](https://github.com/solana-labs/solana-program-library/commit/b40e0dd3fd6c0e509dc1e8dd3da0a6d609035bbd) |
+| [feature-proposal](https://github.com/solana-labs/solana-program-library/tree/master/feature-proposal/program) | Not audited | [1.0.0](https://github.com/solana-labs/solana-program-library/releases/tag/feature-proposal-v1.0.0) |
+| [name-service](https://github.com/solana-labs/solana-program-library/tree/master/name-service/program) | Not audited | [0.3.0](https://github.com/solana-labs/solana-program-library/releases/tag/name-service-v0.3.0) |
+| [memo](https://github.com/solana-labs/solana-program-library/tree/master/memo/program) | Not audited | [3.0.0](https://github.com/solana-labs/solana-program-library/releases/tag/memo-v3.0.0) |
+
+All other programs may be updated from time to time. These programs are not
+audited, so fork and deploy them at your own risk. Here is the full list of
+unaudited programs:
+
+* [binary-option](https://github.com/solana-labs/solana-program-library/tree/master/binary-option/program)
+* [binary-oracle-pair](https://github.com/solana-labs/solana-program-library/tree/master/binary-oracle-pair/program)
+* [instruction-padding](https://github.com/solana-labs/solana-program-library/tree/master/instruction-padding/program)
+* [managed-token](https://github.com/solana-labs/solana-program-library/tree/master/managed-token/program)
+* [record](https://github.com/solana-labs/solana-program-library/tree/master/record/program)
+* [stateless-asks](https://github.com/solana-labs/solana-program-library/tree/master/stateless-asks/program)
+* [token-lending](https://github.com/solana-labs/solana-program-library/tree/master/token-lending/program)
+* [token-swap](https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program)
+* [token-upgrade](https://github.com/solana-labs/solana-program-library/tree/master/token-upgrade/program)
+
+More information about the repository's security policy at
+[SECURITY.md](https://github.com/solana-labs/solana-program-library/tree/master/SECURITY.md).
+
+The [security-audits repo](https://github.com/solana-labs/security-audits) contains
+all past and present program audits.
 
 ## Development
 
@@ -68,16 +99,17 @@ Integration testing may be performed via the per-project .js bindings.  See the
 [token program's js project](token/js) for an example.
 
 ### Common Issues
+
 Solutions to a few issues you might run into are mentioned here.
 
 1. `Failed to open: ../../deploy/spl_<program-name>.so`
 
     Update your Rust and Cargo to the latest versions and re-run `cargo build-sbf` in the relevant `<program-name>` directory,
     or run it at the repository root to rebuild all on-chain programs.
 
-2. [Error while loading shared libraries. (libssl.so.1.1)](https://github.com/project-serum/anchor/issues/1831)
+2. [Error while loading shared libraries. (libssl.so.1.1)](https://solana.stackexchange.com/q/3029/36)
 
-    A working solution was mentioned [here](https://github.com/project-serum/anchor/issues/1831#issuecomment-1109124934).
+    A working solution was mentioned [here](https://solana.stackexchange.com/q/3029/36).
     Install libssl.
     ```bash
     wget http://nz2.archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1l-1ubuntu1.2_amd64.deb
@@ -110,6 +142,7 @@ $ rustup toolchain install nightly-x86_64-apple-darwin
 
 
 ## Release Process
+
 SPL programs are currently tagged and released manually. Each program is
 versioned independently of the others, with all new development occurring on
 master. Once a program is tested and deemed ready for release:

SECURITY.md

@@ -42,7 +42,7 @@ for details on classes of bugs and payment amounts.
 ## Scope
 
 Only a subset of programs within the Solana Program Library repo are deployed to
-the Solana Mainnet Beta and maintained by the team. Currently, this includes:
+the Solana Mainnet Beta. Currently, this includes:
 
 * [associated-token-account](https://github.com/solana-labs/solana-program-library/tree/master/associated-token-account/program)
 * [feature-proposal](https://github.com/solana-labs/solana-program-library/tree/master/feature-proposal/program)

account-compression/README.md

@@ -29,3 +29,8 @@ With a built local SDK, the test suite can be ran with:
 1. `yarn link @solana/spl-account-compression`
 2. `yarn`
 3. `yarn test`
+
+## Audit
+
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.

binary-option/README.md

@@ -12,6 +12,11 @@ Now suppose the Bucks win Game 3, and the estimated probability of the Bucks win
 
 We'll discuss this mechanism in more detail later.
 
+## Audit
+
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.
+
 ## Client Setup 
 First, clone down the repository (TODO publish to PyPI)
 

binary-oracle-pair/README.md

@@ -1,4 +1,4 @@
-Simple Oracle Pair Token
+# Simple Oracle Pair Token
 
 1. pick a deposit token
 2. pick the decider's pubkey
@@ -10,3 +10,8 @@ the mint term end slot.  After the decide term end slot the `Pass`
 token converts 1:1 with the deposit token if and only if the decider
 had set `pass` before the end of the decide term, otherwise the `Fail`
 token converts 1:1 with the deposit token.
+
+## Audit
+
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.

docs/src/token-lending.md

@@ -2,13 +2,10 @@
 title: Token-Lending Program
 ---
 
-A lending protocol for the Token program on the Solana blockchain inspired by Aave and Compound.
+A lending protocol for the Token program on the Solana blockchain inspired by
+Aave and Compound.
 
+## Audit
 
-### On-Chain Programs
-
-| Cluster | Program Address |
-| --- | --- |
-| Mainnet Beta | [`LendZqTs8gn5CTSJU1jWKhKuVpjJGom45nnwPb2AMTi`](https://explorer.solana.com/address/LendZqTs7gn5CTSJU1jWKhKuVpjJGom45nnwPb2AMTi) |
-| Testnet | [`LendZqTs8gn5CTSJU1jWKhKuVpjJGom45nnwPb2AMTi`](https://explorer.solana.com/address/LendZqTs8gn5CTSJU1jWKhKuVpjJGom45nnwPb2AMTi?cluster=testnet) |
-| Devnet | [`LendZqTs8gn5CTSJU1jWKhKuVpjJGom45nnwPb2AMTi`](https://explorer.solana.com/address/LendZqTs8gn5CTSJU1jWKhKuVpjJGom45nnwPb2AMTi?cluster=devnet) |
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.

docs/src/token-swap.md

@@ -5,25 +5,22 @@ title: Token Swap Program
 A Uniswap-like exchange for the Token program on the Solana blockchain,
 implementing multiple automated market maker (AMM) curves.
 
-## Available Deployments
+## Audit
 
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.
 
-| Network | Version | Program Address | Fee Owner Address |
-| --- | --- | --- |
-| Devnet, Testnet | 3.0.0 | `SwapsVeCiPHMUAtzQWZw7RjsKjgCjhwU55QGu4U1Szw` | Any |
-| All | 2.0.0 | `SwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8` | `HfoTxFR1Tm6kGmWgYWD6J7YHVy1UwqSULUGVLXkJqaKN` |
+## Available Deployments
 
-The Token Swap Program was deployed to all networks by the Serum team at
-`SwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8`, requiring a fee owner of
-`HfoTxFR1Tm6kGmWgYWD6J7YHVy1UwqSULUGVLXkJqaKN`, but that version was deprecated
-in the middle of 2021.  Though that program still exists, it is not actively
-maintained.
+| Network | Version | Program Address |
+| --- | --- | --- |
+| Testnet | 3.0.0 | `SwapsVeCiPHMUAtzQWZw7RjsKjgCjhwU55QGu4U1Szw` |
+| Devnet | 3.0.0 | `SwapsVeCiPHMUAtzQWZw7RjsKjgCjhwU55QGu4U1Szw` |
 
-For devnet and testnet, please use the maintained deployment at
-`SwapsVeCiPHMUAtzQWZw7RjsKjgCjhwU55QGu4U1Szw`, and for mainnet, please use any
-other AMM project on Solana. Almost all of these were based on Token Swap!
+While third-party deployments of token-swap exist on Mainnet Beta, the team has
+no plans to deploy it themselves.
 
-Check out
+Check out the
 [program repository](https://github.com/solana-labs/solana-program-library/tree/master/token-swap)
 for more developer information.
 
@@ -66,8 +63,7 @@ bindings](https://github.com/solana-labs/solana-program-library/blob/master/toke
 are available that support loading the Token Swap Program on to a chain and
 issuing instructions.
 
-Example user interface built and maintained by Serum team is available
-[here](https://github.com/project-serum/oyster-swap)
+Example user interface is available [here](https://github.com/solana-labs/oyster-swap).
 
 ## Operational overview
 

docs/src/token-upgrade.md

@@ -8,6 +8,11 @@ tokens from one mint to another.
 The program provides a simple mechanism for burning the original tokens and receiving
 an equal number of new tokens from an escrow account controlled by the program.
 
+## Audit
+
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.
+
 ## Background
 
 Token-2022 contains many new features for mint owners to customize the behavior

examples/c/README.md

@@ -19,4 +19,9 @@ To build the examples and run the tests:
 
 ```bash
 $ make
-```
+```
+
+## Audit
+
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.

examples/rust/README.md

@@ -8,3 +8,8 @@ with a live cluster.
 
 The root [README](../../README.md) gives instructions on how to build and test
 these examples.
+
+## Audit
+
+The repository [README](https://github.com/solana-labs/solana-program-library#audits)
+contains information about program audits.