Quantum

Drops

Ethereum

<h2 id="strong-key-takeaways-strong"><strong>Key Takeaways</strong></h2>
<div class="light-yellow-block">
 <ul>
  <li><strong>Live on Ethereum mainnet since September 30.</strong></li>
  <li><strong>Protocol default: 1,000 payments per hash chain.</strong></li>
  <li><strong>Front-running flaw found and fixed on October 21.</strong></li>
 </ul>
</div>
<p>The founder, who posts as Hadamard, described the design in an <a href="https://ethresear.ch/t/a-hash-only-rollup-op-stack-l2-accounts-as-lamport-style-hash-chains-no-ecdsa-inside-the-l2/26172" rel="noopener noreferrer nofollow">October 24 Ethereum Research post</a> and asked for critical feedback.</p>
<p>Ordinary Ethereum accounts authorize transactions with ECDSA signatures, which a large enough quantum computer running Shor’s algorithm could break. No machine today can do that, but <a href="https://coindoo.com/cryptos-quantum-risk-begins-with-wallet-keys-says-europol/" rel="noopener noreferrer nofollow">warnings about exposed wallet keys</a> have pushed developers to look for alternatives. BB84, an OP Stack rollup on Ethereum mainnet with chain ID 42069000, removes signatures from its network altogether.</p>
<p>Each account is built from a secret that is hashed over and over with keccak-256, creating a chain of values. Only the last value is public. To pay, the wallet reveals the value before it, which anyone can check by hashing it once. The network then records that value and moves the account one step down the chain. The protocol default is 1,000 steps, while BB84’s <a href="https://bb84.com/docs" rel="noopener noreferrer nofollow">developer CLI</a> creates 10-step chains for each one-time address. A step is used up even if the payment itself fails, and the chain rejects any conventionally signed transaction.</p>
<p>Payments run only in bridged USDC and EURC. Both the commit and reveal transactions are free for users, and payers create a fresh one-time address for each recipient.</p>
<p>The post spells out the security trade-off. Inside the network, everything rests on keccak-256 being hard to reverse, and Grover’s quantum search algorithm only cuts that to about 2^128 operations. Addresses, however, are shortened to 160 bits, which leaves about 2^80 of quantum resistance on the address itself. BB84’s documentation advertises 128-bit post-quantum security without that caveat. Ethereum mainnet is also still ECDSA: deposits start from ordinary Ethereum wallets, and withdrawals pay out to them.</p>
<h2 id="the-flaw-found-while-writing-the-post">The flaw found while writing the post</h2>
<p>Revealing a secret makes it public, so anyone watching could copy it into a transaction paying themselves. To prevent that, the wallet first sends a commit transaction that locks the secret to one exact payment without showing it. The reveal must follow within five blocks by default.</p>
<p>The weak point was that commits carry no signature, because there is nothing to sign with. In the first version, a new commit simply replaced the pending one. An attacker who spotted a secret in a pending reveal could swap in a commit tying that secret to their own payment. Hadamard says the team found the flaw while writing the post and fixed it with a new rule that took effect on October 21. Under it, the first commit wins, the slot clears only after the matching reveal or expiry, the wallet waits for its commit to land in a block before revealing, and the public RPC does not expose pending transactions.</p>
<div style="margin: 22px 0; padding: 16px 20px; border-left: 4px solid #7c3aed; background: rgba(124, 58, 237, 0.08); color: inherit;">
 <p style="margin: 0 0 8px; font-weight: 800; color: #8b5cf6;">What the fix does not cover</p>
 <p style="margin: 0 0 6px;"><strong>Griefing:</strong> anyone can post a junk commit and block an address for up to five blocks, though they cannot move its funds.</p>
 <p style="margin: 0;"><strong>A rogue sequencer:</strong> if an honest commit expires or is reorganized out while its reveal is pending, the secret is no longer locked. Today only BB84’s own sequencer sees pending transactions.</p>
</div>
<p>Hadamard suggests a stricter “Guy Fawkes” rule, in which commits are appended instead of replaced, but says it has not been built. BB84’s documentation goes further than the post, stating that commit and reveal mean a sequencer cannot steal a withdrawal.</p>
<h2 id="a-wallet-that-must-not-lose-count">A wallet that must not lose count</h2>
<p>Because each chain has a fixed number of steps, the <a rel="noopener noreferrer nofollow">wallet</a> has to renew it on the very last one by including a new commitment in that final payment. If it misses that step, the address is dead. Keeping count is just as important: Hadamard says the app and the chain fell out of sync in production, so wallets must be able to resynchronize from chain data.</p>
<p>The secrets still need protecting like keys. The CLI warns that its wallet file stores spend keys unencrypted and lists encryption as a roadmap item. Removing signatures changes how spending is authorized, not the need to keep secrets safe.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/arbitrum-gave-one-company-all-its-guild-money-for-now/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2026/10/arbitrum-thumnail.jpg"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">Arbitrum Gave One Company All Its Guild Money – For Now</h4>
  </div></a>
</div>
<h2 id="getting-money-out-means-trusting-the-operator">Getting money out means trusting the operator</h2>
<p>BB84 has no fault proofs. A permissioned proposer posts the network’s state to Ethereum through a custom dispute game that resolves immediately, and with no proof system, Hadamard writes that by L2BEAT’s framework the chain “would not even be Stage 0.” Withdrawals therefore trust the proposer. The documentation still describes withdrawals as following the OP Stack fault-proof flow with a seven-day maturity delay, but as <a href="https://docs.optimism.io/op-stack/fault-proofs/explainer" rel="noopener noreferrer nofollow">Optimism’s explainer</a> sets out, fault proofs exist so wrong state can be challenged, and here nothing can be challenged during that wait. The sequencer is also run by BB84.</p>
<div style="margin: 24px 0; overflow-x: auto;">
 <table style="width: 100%; min-width: 460px; border-collapse: collapse; text-align: left; font-size: 0.95em; color: inherit;">
  <thead>
   <tr style="background: #6d28d9; color: #ffffff;">
    <th style="padding: 11px 14px;" scope="col">Stage</th>
    <th style="padding: 11px 14px;" scope="col">What the user trusts</th>
   </tr>
  </thead>
  <tbody>
   <tr>
    <td style="padding: 11px 14px; border-bottom: 1px solid rgba(124, 58, 237, 0.3);"><strong>Deposit from Ethereum</strong></td>
    <td style="padding: 11px 14px; border-bottom: 1px solid rgba(124, 58, 237, 0.3);">An ordinary ECDSA wallet and the bridge contract</td>
   </tr>
   <tr style="background: rgba(124, 58, 237, 0.06);">
    <td style="padding: 11px 14px; border-bottom: 1px solid rgba(124, 58, 237, 0.3);"><strong>Payment on BB84</strong></td>
    <td style="padding: 11px 14px; border-bottom: 1px solid rgba(124, 58, 237, 0.3);">The hash-chain secret, the commit rule and BB84’s sequencer</td>
   </tr>
   <tr>
    <td style="padding: 11px 14px; border-bottom: 1px solid rgba(124, 58, 237, 0.3);"><strong>Standard withdrawal, 7 days or more</strong></td>
    <td style="padding: 11px 14px; border-bottom: 1px solid rgba(124, 58, 237, 0.3);">The permissioned proposer</td>
   </tr>
   <tr style="background: rgba(124, 58, 237, 0.06);">
    <td style="padding: 11px 14px;"><strong>Merchant fast withdrawal, 2 hours</strong></td>
    <td style="padding: 11px 14px;">The proposer plus a registry operator</td>
   </tr>
  </tbody>
 </table>
</div>
<h2 id="what-would-change-the-picture">What would change the picture</h2>
<p>The post ends with questions that reach beyond one chain. The biggest is whether hash-chain accounts could become an EIP-7702-style or native account-abstraction validation mode on general-purpose layer-2 networks, which would make the idea available without moving to a dedicated chain.</p>
<div style="display: flex; flex-wrap: wrap; gap: 10px; margin: 20px 0; color: inherit;">
 <p style="flex: 1 1 calc(50% - 5px); min-width: 230px; box-sizing: border-box; margin: 0; padding: 12px 14px; border: 1px solid rgba(124, 58, 237, 0.35); border-radius: 8px;"><strong>Fault proofs:</strong> Hadamard says the extra checks are simple enough to prove with Optimism’s existing Cannon tooling.</p>
 <p style="flex: 1 1 calc(50% - 5px); min-width: 230px; box-sizing: border-box; margin: 0; padding: 12px 14px; border: 1px solid rgba(124, 58, 237, 0.35); border-radius: 8px;"><strong>A safer commit rule:</strong> the append-only design would close both the griefing and sequencer gaps.</p>
 <p style="flex: 1 1 calc(50% - 5px); min-width: 230px; box-sizing: border-box; margin: 0; padding: 12px 14px; border: 1px solid rgba(124, 58, 237, 0.35); border-radius: 8px;"><strong>A full paper:</strong> a longer write-up with the complete rules is being prepared for arXiv.</p>
 <p style="flex: 1 1 calc(50% - 5px); min-width: 230px; box-sizing: border-box; margin: 0; padding: 12px 14px; border: 1px solid rgba(124, 58, 237, 0.35); border-radius: 8px;"><strong>Ethereum’s wider migration:</strong> its <a href="https://ethereum.org/roadmap/security/quantum-resistance/" rel="noopener noreferrer nofollow">quantum roadmap</a> also covers validator signatures, data commitments and proof systems.</p>
</div>
<p style="text-align: center; font-size: 0.9em;"><em>This article is provided for informational purposes only and does not constitute financial or investment advice. Experimental networks carry technical and custody risks.</em></p>
<p>The post <a href="https://coindoo.com/ethereum-l2-drops-signatures-to-fight-quantum-threat/" rel="noopener noreferrer nofollow">Ethereum L2 Drops Signatures to Fight Quantum Threat</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Ethereum L2 Drops Signatures to Fight Quantum Threat

Table of Contents

Coindoo.com

Other articles published on Oct 25, 2026

Join our free newsletter for daily crypto updates!