Post by AZOOZGG about Meteora Token ($MET)

$MET is a gem!

Building on @Solano's on-chain check of the MET token mint, I looked at a different layer: the DLMM program account itself (LBUZKhRxPF3XUpBCjp4YzTKgLccjZhTSDM9YuVaPwxo), queried directly via Solana RPC and cross-checked on Solana Explorer against the DLMM Changelog in the docs.

What's good: the program's upgrade authority (JADaUV8kvDpDbJr55wxXJHVaBS3VCj8thZZHjfeuCVLd) looks like a Squads v3 multisig — 8 of its last 15 transactions route through the Squads program. That's much safer than a single upgrade key, and worth surfacing as a positive signal. The program ID also matches the one published in the changelog.

What I couldn't verify, and think the team should close:

1. Deploy vs changelog mismatch. On-chain, the program was last upgraded on June 3, 2026 (slot 423,977,638). The newest changelog entry is lb_clmm 0.12.0, "planned for May 21, 2026 (Wednesday)" — but May 21, 2026 is a Thursday, and June 3 is a Wednesday. So the dates don't line up, and there's no way from the public docs to tell whether the June 3 deploy is 0.12.0 or a later patch.

2. No source link for the running code. In the 0.12.0 release table, the SDK/CLI/commons rows all link to PR #273, but the Program row is just "—". Solana Explorer also shows "Program Not Verified". So there's no verified build tying the ~2.2 MB of deployed bytecode back to a specific commit.

3. Breaking release, no audit reference. 0.12.0 is marked a breaking release (adds limit orders, permissionless claim_fee, and changes swap-quote math), but the changelog entry doesn't reference an audit for it.

4. No security.txt. I scanned the full program data for the security.txt marker and found none, so a researcher looking at the program on-chain has no embedded disclosure contact.

Suggestions: record the actual deploy slot next to each release, link the program source/tag, publish a verified build (solana-verify), note which audit covers each version, and embed a security.txt.

Question for the team: which commit is running at slot 423,977,638, and which audit covers lb_clmm 0.12.0?