chain · quantum risk
Solana Accounts, Authorities, and Quantum Risk
Verdict
If an authority key can move funds or upgrade a program, that key’s algorithm and custody define quantum (and classical) risk for everything it controls.
Overview
Solana programs manipulate accounts. Authorities decide who may debit, mint, upgrade, or configure. That graph of power is the real attack surface—quantum or not.
Quantum planning that only says “Ed25519 is broken someday” without listing upgrade keys, freeze authorities, and custody signers is incomplete for any serious team.
Pair this page with the SOL asset dossier for holder language and the Ed25519 spoke for algorithm language.
What breaks
- Single upgrade authority for critical programs
- Shared hot fee-payer keys across many services
- Opaque multisig membership for treasuries
Mitigations
- Map authorities for every critical program and treasury account
- Use multiparty schemes for upgrades
- Rotate and least-privilege operational fee payers
FAQ
Are PDAs quantum-proof?
PDAs are deterministic program addresses. They do not provide post-quantum signatures by themselves.
What is the first spreadsheet a startup should keep?
A list of every authority pubkey, its purpose, where the seed/key lives, and who can approve changes—updated when people leave.
Key concepts (technical dictionary)
Terms used on this page — open a definition: