Daniil

Ethereum core dev @Nethermind · implementing Frame Transactions (EIP-8141/8250/8272) · author of ERC-8403 · co-author of EIP-7906 · Protocol Guild

[Daniil @Ankuinf]

here is how my erc-8403 works. your account stores one hash, the root of a tree of your keys. add a key, revoke a key, the address stays. a 3 min demo on two live nethermind nodes, with a thief trying to get in
https://t.co/vrTvKYRDYc

[Daniil @Ankuinf]

keys and rules sit in one authority set per account. a scheme is a published spec with an id, so any wallet that implements it can read that set from chain and, with one of your keys, rotate or revoke, not only the wallet that made the account. the two schemes in the erc hold signer keys only, so a rule like a threshold needs its own scheme. on another chain a follower account copies the set from home by sync

[asanso @asanso]

20 SIGNATURES. ONE PROOF.
Daisugi v0.3 aggregates 20 transaction signatures using LeanSPHINCS and LeanVM.
20 SPHINCS signatures are verified through a single aggregate proof.
For EL clients, verification requires the LeanVM verifier plus the LeanSPHINCS guest program.
Post quantum signature aggregation is live on Daisugi. Kudos to @Nethermind @Gianluca_Felli

[Daniil @Ankuinf]

your question made me rethink this, and the tiers are gone now.

they were there because i thought only a check that reads no storage fits the public mempool. so tier 1 read nothing and had slow revoke, tier 2 read the current root and had fast revoke.

turns out EIP-8141 lets the check read the account's own storage in the public mempool. so tier 1 bought nothing. and it had a hole: a revoked key could use an old root to write itself back.

now there's one rule. the check reads the current root, and revoke works by the next block.

https://t.co/fTkvYaO8yB

[Daniil @Ankuinf]

40 blocks in the demo. the spec uses the EIP-8272 window, 8191 slots, about 27 hours on mainnet.

tier 1 isn't built for fast revoke. it reads no mutable storage, so it's cheap and fits the public mempool. a revoked key lives until the window closes. fine for a daily account and planned rotation.

tier 2 reads the current root, so revoke works next block. costs one storage read and the cheap mempool path. that's for savings or a compromised key.

[Daniil @Ankuinf]

what does a post-quantum account look like on ethereum? eip-8288 makes the signature cheap, but not the key management.

wrote up how my erc-8403 fits: a pq key is one more leaf. and an optional next step, where the key tree sits inside a small leanvm program and the account stores its hash. i ran the proof side: ~0.2 s to prove, ~200 kB

https://t.co/yWpmIrT0Ba

[Daniil @Ankuinf]

a 205B deploy to a new account is ~497k state gas, so it fits the 500k cap. what's the other ~790k?

these caps are mempool rules, not consensus. a tx over them is still valid, it just needs a private mempool. in https://t.co/CvF12WkQ75 i propose to redefine MAX_VERIFY_GAS as a floor

[Daniil @Ankuinf]

measured MAX_VERIFY_GAS from 100k to 500k on nethermind. at equal gas per second of failing checks the harm is the same at every cap. the cap only multiplies what one peer can push. 300k holds against one attacker peer https://t.co/x71899AiOL

[Daniil @Ankuinf]

post-quantum accounts on frame txs, two things still in the way. the cheapest sphincs- verify is 94k gas against a 100k cap. and a 7702 delegated eoa can be taken back with the old ecdsa key. https://t.co/Qm7HkaGNYu

[Daniil @Ankuinf]

@0xChiranjeev it's a separate cap, 500k state gas across the validation prefix, and it bounds state growth, not node work. my runs used zero state gas so they don't say anything about it. how big is the code your factory deploys?

[Ben {chmark} Adams ⟠ @ben_a_adams]

Nethermind Beacon Chain plugin ready and synced for the Sepolia fork 🚀

Nice bonus: running EL + CL as one app doesn't seem to add much memory overhead

[Daniil @Ankuinf]

lost the wallet? rebuild every key from account state, no backup. revoke a leaked key once, apply it on every chain. erc-8403 + 10 more frame tx flows as diagrams

https://t.co/a2DxA6eAvj

[Daniil @Ankuinf]

@nikethhhh opened a pr so it can be one frame tx: a sender frame to self sets the delegation when there's no code yet https://t.co/5ySQAua2pe

[soispoke.eth @soispoke]

Private, post-quantum secure transfers under EIP-8288

[Daniil @Ankuinf]

@vintcessun good catch, the counter has to be under the signature. the erc now says that explicitly (ethereum/ERCs#1979), and the 8130 side does the same: the portable change digest in ethereum/EIPs#12341 signs a per-actor counter, so an old grant can't apply twice even unsequenced

[Etherspot 🐞 @etherspot]

A new transaction model is only part of native account abstraction.
ERC-8403 looks at another piece: how account authorities are managed 👇

[soispoke.eth @soispoke]

🥷 Keyed Nonces (EIP-8250) and Recent Roots (EIP-8272) were just CFI'd in Hegota 🥷

One more step towards native privacy coming to Ethereum

Buckle up

❤️‍🔥

[marc | wolovim.eth @wolovim]

native AA in ethereum ⚡

frame breakout #5 - tl;dr:

→ @ethrex_client testnet: 14 days, 3 clients, 400 frame txs from 21 senders
→ @weboftrees (ef) outlines multidimensional gas considerations
→ @_jxom (viem) feedback: gaps in JSON-RPC specs
→ @ox_shaman (@ethlabs_org) teases an ERC to combine many UX puzzle pieces
→ @Ankuinf (@Nethermind): proposes raising devnet tx gas limit to test complex scenarios

full call: https://t.co/qGhf7pJC3l

since then:

✨ frames-devnet-0 is live! ✨
https://t.co/x76bDwAwi2

this is the first of hegota's devnets. focil will get its own feature devnet, and once satisfied with the fundamentals of each, a combined hegota-devnet-0 will follow

🚢

[Łukasz Rozmej @URozmej]

EIP-8141 Frame Transactions and friends (8250 keyed nonces, 8272 recent roots, 7906 transaction assertions) merged to @Nethermind master https://t.co/EUYsmbVd2v !

Only 40k lines of code - lot of tests and comments though.

Frame Transactions 40k 😉

[Daniil @Ankuinf]

right, that private mempool is one of the three corners, the off-chain trust one. the bundler gates exposure off-chain. 8141 picks the reserved-balance corner instead: every node reserves the worst-case against the sponsor's on-chain balance before admitting, so the same insolvency never reaches a block, but in the public mempool with no bundler. that's the point, sponsorship can stay in consensus if you pick that corner.

[Daniil @Ankuinf]

native gas sponsorship, no bundler and no separate paymaster service, comes down to one question. how does a sponsor stay solvent when many pending txs draw on one balance.

my read is you can't get it for free in the public mempool. you end up needing one of three, escrow, a bond, or off-chain trust, and you can't dodge all three at once. 8141 takes the reserved-balance route, but that's a choice, not the only option. i wrote up the argument, would like people to find where it bends:
https://t.co/n4sliRhBzM