Hash-signed treasury

QuantArk’s treasury is a program account that ignores Ed25519 entirely. Tokens leave it only when a withdrawal carries a valid LM-OTS signature.

Why LM-OTS

LM-OTS is the one-time signature from RFC 8554, approved by NIST in SP 800-208. Its security rests only on SHA-256. The best known quantum attack on a hash, Grover’s algorithm, only halves its strength in bits, which leaves a 24-byte output far out of reach. Ed25519, by contrast, falls completely to Shor’s algorithm.

	Ed25519	LM-OTS (N24, W8)
Rests on	Elliptic-curve discrete log	SHA-256 only
Quantum attack	Key recovered from public key	No known shortcut
Signature size	64 bytes	652 bytes
Reuse	Unlimited	One signature per key

The parameter set is LMOTS_SHA256_N24_W8: 24-byte hashes, 26 chains of 255 steps. The verifier is QuantArk’s own Rust crate, tested against the RFC 8554 vectors.

How a withdrawal works

PlayStepstep 1 of 5

Treasury vault

q = 0

key K0

vaultqnext_keymintdestinationamount

LM-OTS signature · 652 B

key matches · transfer

The vault stores leaf q and its 24-byte public key.

1. The treasury account stores a key identifier id, a counter q and the current 24-byte public key.
2. The holder of the secret signs a message that names the vault, q, the next public key, the token mint, the destination and the amount.
3. Anyone submits the transaction. The program rebuilds the candidate key from the signature and message and checks it against the stored key.
4. The tokens move, q increments and the stored key becomes the next key.

Because the signature binds every effect, the Ed25519 wallet that pays the transaction fee has no power. A quantum attacker who controls the fee payer can only submit the exact withdrawal that was signed, or nothing.

Measured
Withdraw transaction	1,071 bytes (limit 1,232)
Compute	about 361,000 units

Keys are used once

A one-time signature leaks part of its key. Signing twice with the same key would let anyone forge a third. That is why every withdrawal rotates to a new key, chosen in advance and bound into the signature.

After Q-day

The canary freezes everything that trusts Ed25519. Treasury withdrawals do not, so the treasury stays usable when the rest of the program stops. See Q-day and the canary.

Anyone can open their own vault with init_pq_vault. The instruction is permissionless.