> ## Documentation Index
> Fetch the complete documentation index at: https://new-docs.squads.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Programs

> Manage program upgrade authority with multisig security

Manage program upgrades collectively with your team. By delegating upgrade authority to your Squad, any program upgrade requires approval from multiple members based on your threshold. This eliminates single points of failure and prevents unauthorized changes to your programs.

With Programs, you can add programs to your Squad, initiate and approve upgrades, and transfer authority to other addresses.

## How programs work

When you transfer a program's upgrade authority to your Squad, that program can only be upgraded through the multisig approval process. The Programs tab provides an interface to manage the full lifecycle: adding programs, initiating upgrades, and changing authorities when needed.

Your Squad has two onchain addresses, visible on the **Settings** page. When transferring any authority to your Squad, always use the **vault address** (labeled **Squads Vault** in Settings). Your Squad executes transactions and signs from this address.

<Warning>
  Never set authority to the **Multisig account** address. Your Squad cannot sign as the Multisig account, so any authority set to it is permanently lost. The program cannot be upgraded, closed, or have its authority transferred again, and the SOL locked as rent cannot be reclaimed. Always use the **vault address** (labeled **Squads Vault** in Settings).
</Warning>

## Add a program to your Squad

<Steps>
  <Step title="Create and deploy your program">
    Create and deploy your program using the Solana CLI.
  </Step>

  <Step title="Open the Programs tab">
    In the sidebar, open **Developers** and select **Programs**.
  </Step>

  <Step title="Add the program">
    Select **Add program**. Enter the **Program name** and **Program ID**.
  </Step>

  <Step title="Confirm the program">
    Select **Next**. Squads checks onchain that the address is an upgradeable program and adds it to your list. No transaction is created at this step. If you are not signed in, you are asked to sign in first.
  </Step>

  <Step title="Transfer upgrade authority">
    Transfer the program's upgrade authority to the vault address shown in the UI. Confirm it matches the **Squads Vault** address on your **Settings** page before proceeding. You can transfer using one of these methods:

    * Copy the address and transfer authority from your CLI
    * Run the provided CLI command if your CLI tool holds the authority
    * Use Safe Authority Transfer (SAT) for an atomic two-party transfer

    The provided command has this form, with your program ID and vault address filled in:

    ```bash theme={null}
    solana program set-upgrade-authority <PROGRAM_ID> --new-upgrade-authority <VAULT_PDA> --skip-new-upgrade-authority-signer-check -um
    ```
  </Step>

  <Step title="Verify">
    Once the transfer is done, select **Verify**. The app confirms that the program's onchain upgrade authority matches your vault.
  </Step>
</Steps>

### Safe Authority Transfer (SAT)

SAT creates a transaction that requires signatures from both your Squad and the current authority holder, ensuring the transfer completes atomically. Because the vault PDA must co-sign the transfer, SAT prevents the wrong address from being used.

<Steps>
  <Step title="Create the SAT">
    Select **Create SAT**, add a note (optional), and select **Initiate**. The transaction appears in your **Transactions** page.
  </Step>

  <Step title="Add your CLI wallet as a member">
    Add your CLI wallet to the Squad on the **Members** page.
  </Step>

  <Step title="Execute with your CLI wallet">
    Once the transaction meets your Squad's threshold, execute it with your CLI wallet. The program authority transfers to your Squad upon execution.
  </Step>
</Steps>

<Info>
  If the current authority is managed by a DAO or external wallet, transfer authority using the standard CLI method instead of SAT.
</Info>

## Upgrade a program

<Steps>
  <Step title="Deploy the upgrade to a buffer account">
    Deploy your upgrade to a buffer account using the Solana CLI:

    ```bash theme={null}
    solana program write-buffer <PROGRAM_FILEPATH>
    ```
  </Step>

  <Step title="Start the upgrade">
    In the Programs tab, select your program, then select **Add upgrade** in the **Upgrades** section. Enter the upgrade details: **Upgrade name**, **Buffer address**, **Buffer refund** (defaults to your vault address if left empty), and **Commit link (optional)**. Select **Next**. No transaction is created at this step.
  </Step>

  <Step title="Set the buffer authority">
    Set the buffer authority to the address shown by running the provided CLI command. The address shown is your vault address. The command has this form, with your buffer address and vault address filled in:

    ```bash theme={null}
    solana program set-buffer-authority <BUFFER_ADDRESS> --new-buffer-authority <VAULT_PDA> -um
    ```
  </Step>

  <Step title="Verify and initiate">
    Select **Verify** to confirm the buffer authority was set correctly. Then open the upgrade from the **Upgrades** list and select **Upgrade**. In the **Execute upgrade** dialog, add a note (optional) and select **Initiate** to create the upgrade transaction.
  </Step>

  <Step title="Approve and execute">
    Once the transaction is approved and executed, the upgrade deploys.
  </Step>
</Steps>

### Extend program size

If the new binary is larger than the currently deployed program, extend the program size before upgrading. You can do this in the app or with the CLI.

**In the app.** Open the upgrade from the **Upgrades** list. When the buffer does not fit, the upgrade shows **Program account too small for this upgrade** with the sizes, and **Extend size** takes the place of **Upgrade**. Select **Extend size**, review the **Extend program size** dialog (**Short by**, **Added**, **New size**, and **Rent paid by your wallet**), then select **Extend**. Your connected wallet signs and pays for this transaction. It is not a proposal: the program account grows as soon as the transaction confirms.

**With the CLI.**

```bash theme={null}
solana program extend <PROGRAM_ID> <ADDITIONAL_BYTES>
```

The extend operation is permissionless. Any wallet can run it, even when your Squad owns the program authority. Use Solana CLI version 2.2.6 or later. `<ADDITIONAL_BYTES>` must be at least 10,240 (10 KiB), unless less space remains before the program's maximum size.

An immutable program cannot be extended or upgraded.

## Transfer program authority

<Steps>
  <Step title="Open the Programs tab">
    In the sidebar, open **Developers** and select **Programs**.
  </Step>

  <Step title="Select the program">
    Select the program whose authority you want to transfer.
  </Step>

  <Step title="Initiate authority transfer">
    Select **Transfer** next to **Upgrade authority**. Enter the **New authority** address.
  </Step>

  <Step title="Approve the transaction">
    Add a note (optional), select **Initiate**, and approve the transaction in your wallet. The transaction appears in your **Transactions** page.
  </Step>

  <Step title="Execute the transfer">
    Once the transaction meets your Squad's threshold, execute it. The program authority transfers to the new address upon execution.
  </Step>
</Steps>

## Automate upgrades with GitHub Actions

The Squads GitHub Action creates the upgrade transaction in your Squad from CI/CD pipelines. It takes a buffer that is already written onchain, so build the program and write the buffer in earlier steps of your pipeline.

After the transaction is created, members can review the upgrade in the app and verify the onchain buffer matches the source code using [verifiable builds](https://github.com/solana-foundation/solana-verifiable-build).

Setup instructions: [github.com/Squads-Protocol/squads-v4-program-upgrade](https://github.com/Squads-Protocol/squads-v4-program-upgrade)

## Best practices

* **Verify the address before every authority transfer.** Open **Settings** and confirm the address you are using matches **Squads Vault**, not **Multisig account**. Setting authority to the Multisig account address permanently locks the program.
* **Use SAT when both parties can sign.** SAT requires your vault PDA to co-sign the transfer, which prevents the wrong address from being used.
* **Verify upgrades before approving.** Compare the onchain buffer against expected source code using verifiable builds.
* **Test on devnet first.** Before transferring mainnet program authority, run the full workflow on devnet to confirm you are using the correct address and process.

<Accordion title="Troubleshooting">
  | Issue | Solution |
  | - | - |
  | Program Data account not large enough | Open the upgrade and select **Extend size**, or run `solana program extend <PROGRAM_ID> <BYTES>` from any wallet before upgrading, adding at least 10,240 bytes. This is permissionless |
  | Authority transfer failed | Verify your CLI is using the correct keypair and RPC endpoint |
  | Authority set to Multisig account instead of vault address | This cannot be reversed. The program is permanently locked. Deploy a new program and set its authority to the correct vault address |
  | Buffer authority verification fails | Re-run the CLI command to set buffer authority to the address shown, then open the upgrade and select **Verify Authority** |
  | Upgrade transaction fails | The buffer may have been closed or its authority changed. Deploy a new buffer and restart the upgrade process |
  | SAT transaction won't execute | Execute the transaction from the CLI tool that holds the current authority |
  | Can't close program buffer | Not supported in the Squads UI. Open the upgrade, select **Change Authority** to transfer the buffer authority to a hot wallet, and close via Solana CLI |
</Accordion>

<Accordion title="FAQ">
  **Can I transfer authority back out of my Squad?**

  Yes. Select **Transfer** next to **Upgrade authority** on the program page to transfer the program's upgrade authority to any other address. This creates a transaction that your Squad must approve and execute.

  **Does extending a program require multisig approval?**

  No. Extending is permissionless. **Extend size** in the app sends a transaction from your connected wallet, and the `solana program extend` command can be run from any wallet, regardless of who holds the upgrade authority.
</Accordion>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.