THE POST-QUANTUM PROBLEM FOR ETHEREUM
All your issues.
01
Every EOA reveals its secp256k1 pubkey on first tx via ECDSA recovery. Every account that has ever sent a transaction is Shor-vulnerable. There is no "safe until first spend" — the pubkey is recovered from the signature itself.
02
Beacon chain BLS12-381 — Shor breaks BLS. Validator signatures, attestations, sync committees — the entire consensus layer rests on a single curve. A CRQC doesn't just steal funds; it breaks finality.
03
In-EVM PQ verify is prohibitive. ML-DSA-65 = ~50M gas (a full block). FALCON-512 = ~120M gas (4 blocks). SLH-DSA = ~3B gas (100 blocks). No PQ signature can verify on-chain at any reasonable cost.
04
ERC-4337 wallets could use custom PQ sigs — but the EOAs funding them can't. The funding path is still secp256k1. PQ smart wallets with classical funding = partial protection.
05
No PQ EIP lands before CRQC. Consensus changes take years. EIP-7702, account abstraction, Verkle — the roadmap is full. PQ is not in the next three hard forks.
06
Rollups inherit every problem above + add sequencer-key risk. Optimism, Arbitrum, Base, zkSync — each has its own ECDSA signing authority. Each is Shor-vulnerable independently.
FIX · ANCHORING
Three anchoring paths. All cheap.
Event log · Calldata · EIP-4844 blob
32 bytes in an event log = 26,000 gas. The substrate commitment anchors without a precompile, without a new opcode, without an EIP.
Option 1: Event log (26K gas) — indexed, searchable, permanent. Option 2: Raw calldata (21.7K gas) — cheapest, no state touched. Option 3: EIP-4844 blob — carry the full 21KB sig bundle in a 128KB blob for ~18 days, commitment permanent on L1. The 74-byte persistent footprint stays at 74 bytes regardless of which path you choose.
Event log anchor
—
gas · standard tx
Merkle verify in-EVM
—
gas · depth 20 · cheap
ML-DSA in-EVM
~50M gas
= full block · prohibitive
Merkle inclusion: on-chain. PQ signature verify: off-chain. The split is deliberate and gas-aware.
FIX · ERC-4337 PQ WALLETS
Account abstraction unlocks PQ wallets.
Smart contract wallets + substrate
ERC-4337 validateUserOp verifies Merkle inclusion on-chain while trusting the off-chain PQ verification that produced the anchored root.
The wallet uses a substrate as its PQ authorization object. The substrate binds a userOp hash to a three-family PQ signer. The wallet contract verifies Merkle inclusion (~8K gas). The three-family PQ verify happened off-chain at the signer. Result: PQ wallet authorization at ERC-4337 gas costs — no precompile, no new opcode, works today on any EVM chain.
The wallet doesn't verify ML-DSA on-chain (50M gas). It verifies that the substrate root was signed by a trusted PQ signer and that the userOp is a leaf of that root. Two Keccak256 walks. ~8K gas.
PQ wallet security at ERC-4337 economics. No EIP required.
FIX · ROLLUPS
Rollup sequencer attestation.
Optimism · Arbitrum · Base · zkSync · Starknet
Every sequencer batch → one substrate root. The L1 anchor proves the batch was produced by the authorized PQ signer, not by a Shor-capable adversary who compromised the sequencer's ECDSA key.
Rollups post state roots and transaction data to L1. The substrate adds a 32-byte PQ-signed commitment alongside the existing state root. L1 verifier contracts check Merkle inclusion (~8K gas) against the substrate root. The sequencer's three-family PQ key becomes the trust anchor instead of its ECDSA key. If the ECDSA key is Shor-broken, the substrate root is still valid.
Per-batch L1 cost
+32 B calldata
~512 gas data cost
Sequencer PQ families
3
ML-DSA · FALCON · SLH-DSA
EIP required
0
Application layer only
THE INSURANCE PROPERTY
74 bytes. Forever. Keys get heavier — footprint doesn't.
2026 PQ bundle
21 KB
ML-DSA-65 + FALCON-512 + SLH-DSA-128f
2030 PQ bundle
~56 KB
ML-DSA-87 + FALCON-1024 + SLH-DSA-256f
Persistent footprint
74 B
Today · 2030 · 2050 · forever
On-chain (L1)
32 B
SHA3-256 commitment only
The L1 carries a 32-byte SHA3 commitment. The PQ bundle lives off-chain. As NIST tightens parameter sets, the bundle grows — the commitment doesn't.
Swap families. Add a fourth. Upgrade to Level 5. The Ethereum footprint stays at 32 bytes.
EIP-4844 · BLOB SPACE
Sig bundles in blob space. Roots on L1.
Proto-Danksharding composition
The full 21KB three-family signature bundle fits in one 128KB blob. Cost: ~10x less than calldata. Available for ~18 days.
Substrate root (32 bytes) goes in calldata or event log — permanent on L1. The PQ sig bundle (21KB) goes in a blob — cheap, temporary, available for any verifier to fetch during the 18-day window. After 18 days, verifiers fetch from the signer's off-chain store. Best of both: permanent root on L1, cheap bundle in blobs.
This is the exact same "permanent commitment + ephemeral data" split that rollups use for DA. The substrate composes with EIP-4844 natively because it was designed for the same constraint.
ETHEREUM × SUBSTRATE
The numbers.
Anchor cost
26K gas
Event log · standard tx
Merkle verify in-EVM
~8K gas
Depth 20 · 20 Keccak hashes
PQ sig families
3
ML-DSA · FALCON · SLH-DSA
EIPs required
0
Application layer only
Persistent footprint
74 B
32 on-chain · 42 off-chain
Blob bundle cost
~10x less
vs calldata for 21KB
ERC-4337 compatible
Yes
PQ wallet auth today
Rollup compatible
Yes
Sequencer PQ attestation
PQ attestation on Ethereum L1, L2, and ERC-4337 — no EIP, no precompile, no hard fork.
Ethereum.
Eric Beans · CEO · H33.ai, Inc.
SUBSTRATE · ETHEREUM