Quantum Proof Protocol POST-QUANTUM · EVM NATIVE
Shor's algorithm will break every ECDSA wallet on Ethereum. Not someday. On a defined timeline. QP2 is the first protocol to make EVM accounts permanently quantum-safe — without changing your address, moving your funds, or waiting for a hard fork.
The Quantum Threat
Based on Webber et al. (2022), IonQ roadmap (2025), and Google Willow breakthrough (2024) — consensus estimate: 2030–2033
Target date: Jan 1, 2033 (mid-range consensus) · Sources: Webber et al., IonQ 2025 roadmap, Google Willow paper
Why ECDSA Cannot Be Patched
The Core Break
High-quality qubits exist but error correction is immature. Cannot run Shor's at secp256k1 scale. Gap is ~10,000× in physical qubits.
Approaching threshold. Error correction improving rapidly after Google Willow's below-threshold breakthrough. Watch closely.
Cryptographically relevant quantum computers plausible. ECDSA keys crackable in weeks to days. Harvest-now attacks become profitable.
Keys crackable in hours. Every exposed Ethereum public key — including yours from today — is at risk. Migration window has closed.
Why Existing Solutions Are Not Enough
The industry knows the quantum threat is real. Multiple teams are working on it. None of the current solutions are deployable on existing EVM chains today without requiring users to abandon their on-chain identity.
On-chain verification cost per transaction — Base L2 (June 2026 gas prices)
The QP2 Solution
Traditional EVM: address = f(ECDSA_pubkey) — your identity IS your key. Quantum breaks the key, breaks your identity.
QP2: address = contract_address — permanent. The key is a swappable storage slot. Quantum can crack the slot. The address survives.
Your wallet derives addr_n from your master seed: keccak256(masterSeed || n || chainId || proxyAddr). This address has never signed anything. Its public key is hidden behind a hash. Quantum-safe until it signs.
The QP2Factory deploys your proxy via CREATE2. The proxy address is deterministic — the same on Ethereum, Base, Arbitrum, Polygon, and every future EVM chain. Your address is permanent and chain-agnostic from day one.
Each transaction is signed by the current addr_n and simultaneously registers addr_n+1 as the next authority. After signing, addr_n is retired permanently. A quantum computer cracking addr_n finds a key that controls nothing.
The proxy stores an IQP2Verifier module — a swappable plugin. When ML-DSA precompiles land, when FALCON gets cheaper, when a new NIST standard emerges — you call switchVerifier() with one transaction. Same proxy address. Zero fund movement.
For critical accounts, enable SHA256VaultVerifier: a two-transaction commit-reveal scheme. Phase 1 commits sha256(txn_data + key + nonce) without revealing it. Phase 2 reveals and executes. Even if a quantum computer cracks the signing key, it cannot execute without knowing the committed preimage — which is never published until after the transaction is protected.
OTA Key Rotation — Per Transaction
Modular Verifier System
QP2 treats cryptographic algorithms as swappable modules. The proxy stores a verifier address — one switchVerifier() call changes it. When NIST publishes a new standard in 2030, QP2 registers a new verifier. Your address migrates with one transaction.
Uses Ethereum's native ECDSA infrastructure with one-time addresses. Each address signs exactly once then is permanently retired. Quantum-safe because the attack window (hours) exceeds the key exposure window (~2 seconds). Zero new primitives. Works today on every EVM chain.
Two-transaction scheme for high-value accounts. Phase 1 commits sha256(txn_data) without revealing it. Phase 2 reveals and executes. Two independent quantum-resistant layers must both be broken simultaneously — mathematically impossible even for a future quantum computer.
NIST-standardized post-quantum signature scheme. Based on the hardness of Module Learning With Errors (MLWE) — no known quantum speedup, no known classical attack. When Ethereum's Hegotá precompiles ship, gas drops from ~800K to ~30K.
Smallest post-quantum signatures of any NIST-standardized algorithm. 666 bytes per signature versus 2,420 for ML-DSA. Based on NTRU lattice hardness. Complex implementation requires careful timing-safe key generation, but offers the lowest calldata cost of all PQ schemes.
The most conservative post-quantum algorithm. Security assumption reduces entirely to SHA-256 being a secure hash function — the most battle-tested assumption in all of cryptography. No lattice math, no algebraic structure. If SHA-256 holds, SLH-DSA holds.
NIST is already working on next-generation post-quantum standards. When they are published, QP2 token holders vote on adding new verifiers to the registry. Your proxy address migrates with one transaction. The protocol outlives any algorithm.
Security Analysis
When addr_n signs a transaction, its public key is visible in the mempool for approximately 2 seconds on Base before the block confirms. A cryptographically-relevant quantum computer running Shor's algorithm needs an estimated 3–28 hours to crack a secp256k1 key (Webber et al., 2022). The attack window is 5,400× smaller than the crack time. By the time the key is cracked, addr_n has been retired for hours — and controls nothing.
SHA256 Vault adds a second independent security layer. Breaking the vault requires breaking both simultaneously: (1) crack the OTA ECDSA key with a quantum computer — hours to days — AND (2) reverse the SHA256 preimage to learn the committed transaction data — computationally equivalent to 2^128 operations even with Grover's algorithm. The second layer is provably infeasible regardless of quantum hardware.
Against OTA alone
Against SHA256 Vault
Hash function quantum safety: Keccak-256 (used for Ethereum addresses) and SHA-256 (used in QP2's vault) are only vulnerable to Grover's algorithm — which provides a quadratic speedup reducing 256-bit security to 128-bit effective security. 2^128 operations remain computationally infeasible on any quantum computer, now or in any foreseeable future. The address layer of QP2 (derived via CREATE2 with Keccak-256) is permanently quantum-safe with no action required.
Every QP2 digest includes address(proxy), block.chainid, and nonce. A signature valid on Base cannot be replayed on Ethereum. A signature valid in transaction 47 cannot be used for transaction 48. The domain separation is enforced at the cryptographic layer — it cannot be bypassed by a relayer or bundler.
The QP2 multisig controls the VerifierRegistry — it can add new verifiers and deprecate old ones. It cannot execute transactions on behalf of users, cannot migrate user accounts, cannot access user funds, and cannot change the active verifier without a valid proof from the user's current key. The registry is an upgrade menu, not a backdoor.
The quantum threat is not a theoretical concern. It is a solved mathematical problem waiting for hardware. The harvest-now-decrypt-later attack is already underway. Every transaction you've ever sent has permanently exposed your public key. QP2 is designing the only protocol that lets you protect your existing EVM identity — same address, quantum-safe, without migrating.