Anza Technology, Inc. contributed the following description of Pinocchio and p-token:

Pinocchio is a zero-dependency library to create Solana programs in Rust. It takes advantage of the way SVM loaders serialize the program input parameters into a byte array that is then passed to the program's entrypoint to define zero-copy types to read the input. Since the communication between a program and SVM loader is done via a byte array, Pinocchio defines its own types to mitigate dependency issues.

p-token is a reimplementation of the SPL Token program using Pinocchio. The purpose is to have an implementation that optimizes the compute units, while being fully compatible with the original implementation — i.e., support the exact same instruction and account layouts as SPL Token, byte for byte.

Zellic conducted a security assessment for Anza Technology, Inc. from May 27th to June 16th, 2025. During this engagement, Zellic reviewed Pinocchio and p-token's code for security vulnerabilities, design issues, and general weaknesses in security posture.