The PQ verify precompile exposes no signature context, so signatures are not bound to a purpose #494

The SLH DSA verify precompile takes a verifying key, a message, and a signature, and checks a pure SLH DSA signature with an empty context. The interface exposes no context parameter, and the roadmap does not define a purpose binding convention for post quantum signatures. The precompile and the planned post quantum ecrecover are still pre production and not protecting live assets, so this is the right moment to raise it as a design point rather than a live concern.

Without a context, a single SLH DSA key reused across Arc's mechanisms, the raw precompile, the planned ecrecover override, account abstraction, and dApps, produces signatures that are not bound to a purpose. A signature produced for one mechanism verifies in another whenever the signed bytes coincide, which is the cross context reuse that domain separation exists to prevent. The EIP 712 digest binds the ecrecover path, but the raw precompile and cross dApp use have no enforced binding, and leaving it to each caller is where it tends to be missed.

FIPS 205 includes a context string for exactly this. Exposing it in the precompile interface and defining one distinct context per mechanism binds every signature to its purpose by construction, at negligible cost.

We raise this from direct experience. We standardised purpose binding for post quantum signatures on another chain, where every signature is bound to its context so it cannot be replayed across uses, and we are glad to share the construction and help shape the convention here.

We would be happy to open a pull request for the interface change and the test vectors if the direction is welcome.