Not even Shor can open it.

1. 01

   Chains

   34 random 28-byte seeds. Each is hashed 256 times with Keccak-256 truncated to 224 bits. The 34 chain tops, hashed together, are the public key hash and the seed of the vault's program-derived address.

2. 02

   Message

   To withdraw, the message is the 32-byte pubkey that receives the funds. Its Keccak digest gives 32 values from 0 to 255, plus a 2-byte checksum of their complements.

3. 03

   Sign

   For chain i with value v, reveal the seed hashed 256 − v times. Revealing it lets anyone hash forward, never backward: the signature can be verified but not reversed.

4. 04

   Verify on-chain

   The program hashes each revealed element v more times, hashes the tops, and checks that the result derives the vault address. Then it moves the lamports and closes the account. No key, no curve, no Shor.

Why the checksum matters

The original solana-winternitz-vault (MIT, Dean Little) omits the checksum chains. Without them, anyone who sees a withdrawal in flight can hash the revealed elements forward and produce a valid signature for any destination whose digest is byte-wise smaller, about 2³² attempts for a typical case, which a GPU does in seconds. This fork adds the two standard checksum chains: lowering any message value raises the checksum, and a raised chain cannot be forged. The test suite includes a forgery attempt that must fail.

Spec sheet · your wallet vs the vault

Source published at mainnet: the Rust program with its tests (including the forgery case), wots.js (the same signature in 120 lines of JS), derive.py and watcher.js.

Where the vault goes next

1. Shipped
   The vault, open source and tested

   Program built from source with the checksum fix, in-browser Winternitz signer, open / deposit / withdraw from this page, full test suite, end-to-end run on a validator. Devnet deployment is the step in progress.

2. Next
   Mainnet, immutable

   Same program id, same code, deployed with the upgrade authority removed so nobody, including us, can ever change what the vault checks. Build hash published next to it.

3. Planned
   A vault for $QBOUNTY itself

   Today the program locks SOL. A token-account variant puts the token behind the same one-time signature.

4. In design
   Vault alerts

   A hosted watcher on websocket subscriptions instead of polling: Telegram and X alerts the moment a keyless vault or a watched output moves, holders first.

5. Planned
   Watchlist governance

   Holders vote which exposed outputs join the watchlist: more Satoshi-era blocks, famous dormant P2PK coins, other chains.

6. Planned
   Exposure scanner

   Tells you whether a Bitcoin or Solana address already has its public key on-chain: pay-to-pubkey outputs, reused addresses and every Taproot output do.

7. Research
   Keyless vault v2, post-quantum

   A third keyless vault whose spend path is a NIST post-quantum signature such as Falcon, the scheme Solana's roadmap converges on.

A nothing-up-my-sleeve (NUMS) point is a public key built from a hash instead of a secret, so it has an address but no owner. BIP-341 relies on the same idea for Taproot outputs that must not be spendable through the key path: it tells wallets to use an internal key "with unknown discrete logarithm" and offers H = lift_x(SHA256(G)) as the example. The vaults do exactly that with a public, reproducible seed, so the only way to sign for them is to solve a 256-bit discrete logarithm, which is the problem Shor's algorithm breaks.

1. 01

   Hash the seed

   SHA256 of the public seed string followed by a 4-byte big-endian counter. Bitcoin lands on counter 0. Solana lands on counter 2, because hashes 0 and 1 do not decode as ed25519 points.

2. 02

   Lift to the curve

   Bitcoin: BIP-340 lift_x turns the hash into a point P with even y. Solana: the hash is decoded as an ed25519 point and multiplied by 8 to clear the cofactor.

3. 03

   Tweak and encode

   Bitcoin: Q = P + tagged_hash("TapTweak", P.x)·G, then bech32m with witness version 1. Solana: the 32-byte compressed point, then base58.

4. 04

   Compare

   Run derive.py, or press the button below and let your own browser do it. If the output matches the addresses on this page, there is no private key to find, only one to compute. That takes Shor.

import hashlib
def H(b): return hashlib.sha256(b).digest()
def tagged(tag, m): t = H(tag.encode()); return H(t + t + m)

# Bitcoin: hash -> x-only internal key -> TapTweak -> output key -> bech32m
x   = H(BTC_SEED.encode() + (0).to_bytes(4, "big"))     # counter 0
P   = lift_x(int.from_bytes(x, "big"))                    # BIP-340, even y
t   = int.from_bytes(tagged("TapTweak", x), "big")        # no script tree
Q   = add(P, mul(t, G))                                   # Q = P + t*G
btc = bech32m("bc", 1, Q[0].to_bytes(32, "big"))          # bc1p...

# Solana: hash -> ed25519 point -> clear cofactor -> base58
h   = H(SOL_SEED.encode() + (2).to_bytes(4, "big"))     # counter 2
Pp  = ed_mul(8, ed_decode(h))                             # 8*P, order L
assert ed_mul(L, Pp) == (0, 1)                            # prime-order check
sol = base58(ed_encode(Pp))                               # Cjp...

Expected output

BTC internal key x

89cab8a147d54575a8fe4b9248435fe71b9811ea513e8982895e621d5f362b15

BTC TapTweak t

d234ceabc8758b652f3586af800b48fd36b136434aa9e80e27a813b54a3a4db4

BTC output key x

bc5b325601cc529103187ee1511110038190c1c4f946454334ff6f337efbd4f1

SOL public key

ae689445fb688e39de4a599ad48a568f04a7313b8237edb43b35d7baf8cc1f12

Download derive.py python3 derive.py --check · exit code 0 means every value above was reproduced