P-Token: Anza's SPL Token rewrite saves up to 98 percent CU

What happened

Anza activated P-Token on Solana mainnet — a completely rewritten version of the SPL Token program. The activation went live in epoch 971 (confirmed live via Helius RPC). Authors are febo and Jon Cinque (Anza). The technical specification runs as SIMD-0266 “Efficient Token Program”. Official announcement: Anza thread on X.

Update 4 June 2026: Certora formal verification

Per the Solana developer team, the P-Token program has been formally verified by Certora. Formal verification goes beyond a classic audit: instead of sampling, it mathematically proves the code behaves to spec across all possible inputs. For a drop-in replacement of the most-used program on Solana, that is an important additional safety signal — on top of the already documented audits (Neodyme, Zellic) and fuzzing. The efficiency figures (drop-in, ~96 to 98 percent CU savings, freed-up block space) are unchanged; only the verification status is new.

What P-Token does technically

Three core points:

Drop-in replacement at the same program ID: P-Token uses the same address as the existing SPL Token program (TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA). Wallets, dApps, and indexers theoretically need no code changes. Activation goes through a feature gate (ptokFjwyJtrwCa9Kgo9xoDS59V4QccBGEaRFnRPnSdP) via validator vote.
Pinocchio + zero-copy + no_std: the entire program is written in Pinocchio style, without the standard library, with zero-copy account parsing. Plus: instruction-name logs are omitted, saving over 100 CUs by itself.
Full backwards compatibility: all existing instructions behave semantically identically to the old SPL Token program.

CU savings concretely

From the SIMD-0266 document, measured values:

Instruction	SPL Token (CUs)	P-Token (CUs)	Efficiency
Transfer	4,645	76	1.6 %
TransferChecked	6,200	105	1.6 %
MintTo	4,538	119	2.6 %
Burn	4,753	126	2.6 %
InitializeMint	2,967	105	3.5 %

Expected network-wide impact: token-program usage drops from roughly 10 percent to roughly 0.5 percent of block compute units. This frees up block space for other programs.

New instructions

Three additional instructions come with P-Token:

batch (discriminator 255) — multiple token instructions in a single CPI invocation, relevant for DeFi CPI-heavy paths.
unwrap_lamports (discriminator 45) — direct transfer of native SOL out of token accounts (wrapped-SOL unwrap in one step instead of two).
withdraw_excess_lamports (discriminator 38) — recovery of “bricked” SOL from mints and multisigs that got blocked through erroneous direct transfers.

Security status

Audits completed: Neodyme (June 2025), Zellic (June and October 2025)
Fuzzing: solfuzz_agave with millions of mainnet instructions
Formal verification: ongoing

Validator requirements

Validators need Agave v3.1.7 or newer for the activation. The current mainnet cluster runs (as of 13 May 2026) on Agave v3.1.13, so the requirement is met network-wide.

What changes for developers

Drop-in character means: existing wallets, dApps, and indexers keep working without code changes. But three concrete effects are immediately noticeable:

CU consumption of token transfers drops drastically. Fee estimations in wallet software (Phantom, Solflare, Backpack) now show lower values for standard transfers.
Logs lose instruction names. Indexers and forensic tools relying on program logs for activity tracking need to adjust their parsing logic.
New instructions available. batch, unwrap_lamports, and withdraw_excess_lamports are now usable by any program that does CPI to the token program.

Not financial advice. This article describes technical protocol changes in the SPL Token program.

Sources

Anza original post on X (13 May 2026, activation announcement)
SIMD-0266 “Efficient Token Program” on GitHub
Anza website
Neodyme audit reports (June 2025 for P-Token)
Zellic audit reports (June + October 2025 for P-Token)
Live verification: Solana mainnet epoch 971 (cluster version 3.1.13) via Helius RPC on 13 May 2026