Post by light about Orca token ($ORCA)

$ORCA is a gem!

I checked Whirlpools’ upgrade authority on-chain with the Solana CLI, the Squads V4 SDK and Osec’s public API, instead of relying on explorer labels. On 2026-10-13, solana program show listed GwH3Hiv5mACLX3ufTw1pFsrhSPon5tdw252DBs4Rx4PV as the upgrade authority, and the SDK derives that exact address as vault 0 of multisig BQsDWkL417U4tVE2sDnPks469pKdm6YzFgKH77doiEjF. Decoding that multisig shows 9 voting members, an approval threshold of 5 and a 24h (86,400 s) timelock, which matches the 5-of-9 multisig with a timelock described in Orca’s compliance disclosure.

One suggestion: the README says the program is deployed with a verifiable build and links Osec’s result, but at 07:25 UTC on 2026-10-13 that endpoint returned is_verified: false, commit None and no last_verified_at. That may just be a missing record; I’m not claiming a source mismatch. Audit counts also differ by page: the README lists 6, the compliance disclosure (updated May 26, 2026) says 8, and docs.orca.so lists 11 (latest 2026-09-30). Publishing the verified commit, hash and date, plus the commit each audit covered, would let readers tie the deployed binary to its audits.