The quantum canary
A bounty sits on an ordinary ed25519 address whose private key nobody knows. The only way to move it is to break ed25519. If it ever moves, the canary trips and keepers evacuate every wallet linked through the Escape Hatch.
trip_canary is permissionless and succeeds only when the watched balance is below the recorded baseline. Topping the bounty up raises the baseline (raise_baseline), never lowers it.
Once tripped: escape_token works for every linked wallet without panic, keepers broadcast every stored SOL escape, and links can no longer be changed.
Honest limits: whoever breaks ed25519 first might not touch this bounty, and an attacker who breaks one wallet key does not need to. The canary is a public alarm, not a guarantee. Panic on /escape does not wait for it.
The address is a hash, not a generated key pair. Hash a fixed string with a counter until the result is a valid point on the ed25519 curve. A point found this way has no known private key: finding one would mean solving the discrete log problem.
P(i) = SHA256("noxvault/canary/v1" || u32le(i))
canary = P(i) for the first i where P(i) decodes to an ed25519 point
→ i = 0A bigger bounty makes the alarm louder: breaking ed25519 and taking it becomes worth more. What you send here is gone for good, because nobody can sign for this address. One transaction sends the SOL and raises the baseline.