QP2 Protocol MODULAR VERIFIERS
The threat keeps moving. AI math is searching curves now, and the lattices meant to replace them. Quantum hardware is the later pass at the same curve. QP2 does not marry the account to any of them. The address is a contract. The verifier is a module. One transaction swaps it.
ECDSA · pairings
Structure is public the first time you send. AI can search it now. Shor searches the same object later.
ML-DSA · Falcon · FHE
The planned replacement. Same problem: usable structure. Not where a long-term account should sit.
SHA-256 · SLH-DSA · WOTS · SPHINCS
Nothing algebraic to pull on. One module you can select. Not the account itself.
vitalik.eth
Minimize exposure to quantum-vulnerable cryptography, and to AI-vulnerable cryptography.
The threat model
The split is not “quantum versus classical.” It is structured versus not. AI-accelerated math is aimed at structure. Curves have it. Lattices have it. Hashes are built to have none. A quantum computer, when it exists, is a second pass at the curve.
ECDSA · pairings
The account most of Ethereum sits on. The public key is on-chain after the first send, and it stays in charge of the funds. AI can search that structure without a quantum computer. Shor, later, searches the same object.
Retire the key. Do not reuse it.ML-DSA · Falcon · FHE
What “post-quantum” was about to mean. Vitalik’s October 7, 2026 point: this is the core new risk. The next two years of AI math can seriously damage concrete lattice security. If a lattice is still used, the key has to be far larger — his inference was about 10×.
Not the default. Optional, and paranoid.SHA-256 · Keccak · SLH-DSA · WOTS · SPHINCS
Lean Ethereum’s signature direction for the past year: no lattices, no ML-DSA, no Falcon, no lattice commitments in proofs. Grover is the known speedup, and it is not a practical break. If hashes ever worry you, add rounds before adding bytes.
A module you can select. Not the account.I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.
The core new area of risk is ML-DSA / FHE / lattices. Hash-based beats lattice-based wherever a hash can do the job. Fresh addresses if the move is easy. Botched migrations have cost him more than hacks.
Search over structure. No qubits. Curves and lattices both qualify. This is the threat the account has to be built for.
Today’s ML-DSA-class parameters are the ones he expects to take the hit. Hash constructions do not share that structure.
Shor still breaks a live ECDSA key, in hours, once the machine exists. Second threat. It does not start the clock.
QP2 is not named in that post. The constraint is. The address is a contract, so a new threat model is a verifier swap, not a migration. Each transaction is signed by a fresh key that is retired in the same block. The registry can hold a hash vault, SLH-DSA, a larger lattice, or a scheme that does not exist yet. You choose the module. The address does not change.
The shape of the jump
Naive factoring is a 2n/2 search. Decades of human math turned it into the number-field sieve, 2O(n1/3), which is why RSA keys are hundreds of bytes and not 64. The question AI forces is whether curves and lattices are hiding a jump like that. Signatures and proofs already have a hash-only exit. Public-key encryption does not — that is a theorem — so anything with a trapdoor should be sized as if the jump arrives. About 10×, if you still want it long-term.
What gets searched
Why Existing Solutions Are Not Enough
The industry spent the last decade planning a swap from ECDSA to lattices. That swap is now the risk. None of the current approaches let you follow a hash-only path on existing EVM chains without abandoning the address or moving the funds.
On-chain verification cost per transaction — Base L2. Cost is not the ranking that matters if the cheap lattice is the AI-exposed one.
The QP2 Solution
Traditional EVM: address = f(ECDSA_pubkey) — your identity is your key. Break the curve, or the lattice you migrated to, and the identity breaks with it.
QP2: address = contract_address — permanent. The key is a swappable slot. Break the structure in the slot and the address still holds the funds.
Your wallet derives addr_n from your master seed: keccak256(masterSeed || n || chainId || proxyAddr). This address has never signed anything. Its public key is hidden behind a hash until the moment it is used — the fresh-address property, without moving funds to a new account.
The QP2Factory deploys your proxy via CREATE2. The proxy address is deterministic — the same on Ethereum, Base, Arbitrum, Polygon, and every future EVM chain. Your address is permanent and chain-agnostic from day one.
Each transaction is signed by the current addr_n and simultaneously registers addr_n+1 as the next authority. After signing, addr_n is retired permanently. A search of that curve key finds a key that controls nothing.
The proxy stores an IQP2Verifier module. Call switchVerifier() when the threat moves — curves, lattices, hashes, or whatever is written next. Same proxy. Zero fund movement. No algorithm is the account.
For critical accounts, enable SHA256VaultVerifier: a two-transaction commit-reveal. Phase 1 commits sha256(txn_data + key + nonce) without revealing it. Phase 2 reveals and executes. That commitment is a hash. Recovering the signing key is not enough. The attacker still needs a preimage that was not published.
OTA Key Rotation — Per Transaction
Modular Verifier System
QP2 treats cryptographic algorithms as swappable modules. The proxy stores a verifier address — one switchVerifier() call changes it. The registry is the menu: one-time keys, a hash vault, SLH-DSA, a lattice at much larger parameters, and schemes that are not written yet. Your address does not move either way.
Uses Ethereum's native ECDSA, but each address signs exactly once and is permanently retired. That is the fresh-address property: the live public key is not sitting on-chain from last year. It works today on every EVM chain. It is not a proof against a future break of the curve — it limits the damage to a key that no longer controls the account. High-value accounts add the hash vault.
Two-transaction scheme for high-value accounts. Phase 1 commits sha256(txn_data) without revealing it. Phase 2 reveals and executes. The second layer is a hash, which is the object lean Ethereum is willing to trust: no algebraic trapdoor for AI math to search. Grover's algorithm still applies. There is no reason yet to pad hash output size; if that worry grows, round count moves first.
The hash-only signature, in the same family as the SPHINCS-style schemes on Ethereum's lean roadmap. Security reduces to SHA-256. No lattice, no ML-DSA, no Falcon. Signatures are large (~7.8KB), which is the price of having nothing algebraic for AI math to grab. If SHA-256 holds, SLH-DSA holds.
Still a NIST standard. Also the scheme Vitalik named, with FHE and other lattices, as the core new risk from AI math. Not the recommended path. If a deployment uses it, parameters should be far more conservative than today's 128-bit sets — his inference was about 10× key size for anything you still want long-term. QP2 can register those larger sets without a new address.
Smallest NIST lattice signatures (666 bytes), which is why it looked attractive. It is also explicitly off Ethereum's lean roadmap, for the same reason as ML-DSA: NTRU is structured. Kept as an optional plugin, not a default. Smaller signatures are not a reason to prefer it over SLH-DSA.
NIST will keep publishing schemes, including ones with new structure. QP2 token holders vote on which verifiers enter the registry. A hash module is one choice when structure looks risky. A larger lattice is another. Switching is one transaction. The account address never changes.
Security Analysis
A reused ECDSA key is published once and then guards the funds for years. That is the object AI math, and later Shor, would search. QP2 signs with addr_n and retires it in the same transaction. The public key is visible for about one block. A break of that key — however fast — finds something that no longer controls the account.
The SHA-256 vault does not depend on a curve or a lattice. Using it means an attacker needs the retired signing key and the committed preimage. Grover’s algorithm takes a 256-bit hash down to about 2128 operations, which is still not a practical search. There is no reason yet to pad hash output. If that worry grows, add rounds first.
Structured key
Hash
Hashes, sized as they are: Keccak-256 and SHA-256 are only known to fall to Grover’s quadratic speedup. An object designed to have no exploitable structure is the assumption this protocol stands on. Curves and lattices are the objects AI has something to pull on. The account address, derived with Keccak via CREATE2, does not need a new primitive for that.
Every QP2 digest includes address(proxy), block.chainid, and nonce. A signature valid on Base cannot be replayed on Ethereum. A signature valid in transaction 47 cannot be used for transaction 48. The domain separation is enforced at the cryptographic layer — it cannot be bypassed by a relayer or bundler.
The QP2 multisig controls the VerifierRegistry — it can add new verifiers and deprecate old ones. It cannot execute transactions on behalf of users, cannot migrate user accounts, cannot access user funds, and cannot change the active verifier without a valid proof from the user's current key. The registry is an upgrade menu, not a backdoor.
Don't scramble your funds into a new wallet. That is the advice in Vitalik's Oct 7, 2026 post, and it is the failure mode QP2 is built to avoid. The threat keeps moving — AI math on curves and lattices now, quantum hardware later, and something else after that. The verifier is a plugin, so the next shift is one transaction, not a new account.