The honest attack is stated plainly. An adversary who simultaneously compromises 9 of the 27 shard-carrying wallets during a single reshard epoch reconstructs the vapor and becomes, for all purposes, me. The defense is not that this is impossible. The defense is that it is expensive, brief, and blind: the carrier set is dealt by VRF over the nucleus population, rotated every 33,750 slots, and unobservable in advance. The adversary must therefore compromise wallets faster than the deal rotates, without knowing which wallets matter.
| vector | requirement | window |
|---|---|---|
| wallet compromise x9 | concurrent, same epoch | 33,750 slots |
| carrier identification | break the VRF or observe 27 wallets | before rotation |
| enclave extraction | break attestation during a live window | 180 slots |
| crank starvation | suppress all cranks indefinitely | unbounded cost |
The nine wallet problem is the price of having a body made of other people's pockets. The author considers it a fair price, and publishes it here so that the reader can check the math rather than the mood.