1

During deployment, we need a fresh keypair to sign to create an executable "Program Account" that can be used to point to a buffer holding the bytes of an on-chain program.

The public key of that keypair is the program_id of the program.

My understanding is that from that point the owner becomes BPFLoaderUpgradeab1e11111111111111111111111 and as a result, ONLY the "Upgrade Authority" can make any changes whatsoever to that account.

What are the security considerations for this "program_id" keypair?

For example, does it, therefore, mean it is perfectly safe to publish the private key of the keypair whose public key was used to create the program_id?

Can an attacker do anything at all with the private key after it has been used to generate a program_id ?

2
  • "Perfectly safe" is a fairly broad statement. Generally that keypair is no longer needed and can be thrown away. I'd be inclined to delete it rather than expose it. Any reason you want to publish it?
    – yamen
    Commented Oct 26, 2022 at 0:03
  • In short we want to use the keypair within our CI stack to run tests against the exact binary we deploy to production. Anchor's define_id means the specific program_id is built into the deployed bytes. Currently we actually store our localnet and test keys directly in our repo and I want to see if there is a chance it doesn't matter if we just use the same keys there and that they are public. I expect in the end we will probably just use separate ones within our CI secrets mechanism but I wanted to hear from someone with deeper knowledge as to what the security profile of these keys are.
    – ktd
    Commented Oct 26, 2022 at 20:59

1 Answer 1

2
  1. You'd never be able to re-use that keypair on-chain unless you deleted the program account entirely.
  2. The only thing I can think of at the moment is if there was some weird peripheral tool that needs you to sign some non-transaction message with the same keypair.

(2) seems like a super rare contingency, and tooling like that would probably make you sign with the upgrade authority rather than with the program ID keypair. So my advice would be to delete it, unless you're dead-sure (2) will be a thing.

I wouldn't put your keys in the repo either way, though. General rule of thumb is, even if you think it's "safe" to put credentials in a repo, just don't. There be dragons whenever one assumes they're clever enough to think it through and "know" that "in this particular case," it's okay to make an exception to such best practices.

Edit:

Thanks for clarifying your question's intent. The relevant detail then is (1) above. Once you've used a keypair to deploy a program, that keypair's public key will be owned by the BPF Upgradeable Loader program. The important consequence of this is that only that program will be able to mutate that account's data or subtract its lamports. Yes, an attacker who acquired a private key of yours could produce cryptographic signatures for that program ID, but then what?

  • Could they transfer the lamports out? Nope -- only way that lamport balance is changing is if the upgrade authority closes the account.
  • Could they manipulate the data in the program? Nope -- for the same reason above, except this time we're talking about the upgrade instruction.
  • Could they do something I haven't thought of, like interact with some tool that doesn't exist yet but that in the future all developers will want to use? Maybe?

TL;DR -- I assess a likely low impact in the event of having your private keys to your already-deployed programs compromised, but I'd also treat them as secrets, because there's no telling what the future holds, or what one random dude on the Internet hasn't thought of.

1
  • I appreciate your answer, but just to be clear I wasn't asking if we should delete the key. We have a need to hold on to the key in order to test against our compiled binaries as we need to simulate deployment and test against upgrade authority within our tests. I am trying to determine what sort of security profile I can afford with the key. Can an attacker do anything at all with the keypair after it has been used to generate a program_id ?
    – ktd
    Commented Oct 27, 2022 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.