Anchor → Pinocchio,
with proof.
Paste an Anchor program in, get a cargo-buildable Pinocchio project out — plus a byte-equal gate that runs both inside a real VM and checks data + lamports + owner against the Anchor original. So you know a port is deploy-safe instead of trusting it.
npm install -g anvil-sol- Byte-equal: data · lamports · owner
- 196 differential tests
- 14+ real programs verified
- klend build-sbf GREEN
$ anvil verify ./my-anchor-program building anchor reference .so … building anvil pinocchio .so … synthesizing scenario from IR … replaying in litesvm (anchor ∥ anvil) … ✓ BYTE-EQUAL — all 4 compared accounts match data · lamports · owner identical negative probes revert identically # cargo-green is necessary. this is the correctness signal.
Cargo green is necessary. It is not sufficient.
Anvil builds your Anchor source and the emitted Pinocchio into separate .so files, runs the same instruction sequence against both inside LiteSVM, and asserts the end state is byte-identical. Anything else fails the gate loudly.
every account's bytes, after the full instruction sequence
balance deltas across signers, PDAs, and vaults
the program each account is left assigned to
- wrong CPI account order
- missing or off-by-one bump
- Borsh layout drift
- account left with the wrong owner
- a dropped access-control check
verify also fires unauthorized-caller and missing-signer probes — they must revert identically on both binaries, so access control is verified too, not just the happy path.
Three commands, end to end.
Migrate
$ anvil compile ./program --target pinocchioDiscriminator routing, signer / writable / owner checks, args decoding, PDA derivation, and manual Borsh — all generated. Output is a cargo-buildable project, not a sketch.
Prove
$ anvil verify ./programOne shot: builds both binaries, synthesizes a scenario from the IR with negative probes, and byte-compares post-state in LiteSVM. Safe-by-default — it refuses to call a port clean when it isn't.
Ship
$ cargo build-sbfDeploy the leaner Pinocchio binary with the same on-chain behavior — and measurably lower compute. The gate is your green light.
Optional companion: anvil audit scans source and transpiled output side by side and flags any security guarantee the transformation may have dropped. Anvil works fully without it.
Not demos. Production Solana programs.
Externally-authored programs cloned verbatim from public repos. Anvil's emit produces post-scenario state byte-identical to the Anchor reference.
klend
First top Solana lending protocol fully compilable to Pinocchio.
Helium circuit-breaker
First multi-file real-world byte-equal — identical on-chain state under the same scenario.
Metaplex
Full catalogs emit real CPIs — no stubs — verified against a staged .so in LiteSVM.
DeFi cohort
Large, adversarially-shaped instruction sets transpile and compile.
30–48% less compute, same behavior.
Built both as the Anchor original and Anvil-emitted Pinocchio, deployed side by side, and measured. Real numbers — not estimates.
vault::initialize9,384 → 4,893 CU−48%counter::initialize6,074 → 3,268 CU−46%escrow::create_escrow26,614 → 16,133 CU−39%counter::increment2,753 → 1,801 CU−35%vault::deposit6,726 → 4,674 CU−31%SPL-heavy workloads save more — Helius's hand-written p-token Pinocchio measures 97–98% CU reduction on transfer/mint/burn primitives, and Anvil's SPL emit uses the same builders. Reproduce the table above with bun scripts/measure-cu.ts.
Migrate off Anchor without the correctness risk.
Install the CLI, transpile a program, and prove it byte-equal in one command. Fully local — everything runs on your machine.
npm install -g anvil-sol