0x1a771ce

Ethereum | zk | smart contract security | mev

[vitalik.eth @VitalikButerin]

Very welcome recent news from Signal: they are working on letting you register an account without a phone number.

https://t.co/3dTG4UD6cF

That said, an important counterpoint about what this would and would not accomplish.

The good #1: reducing dependence on phone numbers. Even aside from privacy benefits, reducing dependency on a highly oligopolistic system of chokepoints is good in itself.

The good #2: phone numbers are for many people not a good "root" of identity from an access control perspective. Phone numbers get sim swapped all the time.

The good #3: allowing phone-number-free accounts will make it harder for them in the future to discriminate against people by country - and so make it harder for governments to pressure them to block their own citizens.

Now, on privacy. Significantly better than status quo, so yes it is good #4, but...

In practice, in 2026, I believe that pseudonymity (a long-term persistent account that is not tied to your primary identity) is a dead concept. There are just too many channels by which we accidentally slowly leak data about who we are - timing of messages, the pattern of who we send messages to with what frequency, size, etc. And too many highly effective AI-based means (both using LLMs per-user, and LLMs helping every person and agency under the sun use math that we had all along) to uncover and piece together those hints.

As a trivial example, whatever server you interact with learns your IP address, but even if you hide *that* with a VPN or Tor, there are many other identity leakage vectors.

And so the only defensible form of privacy is *message-by-message unlinkability* - no one except sender and receiver knows the (sender, receiver) pair, ideally even not knowing who the sender or the receiver are.

A natural taxonomy of privacy is the following 2x2:

* Sitting duck: adversary knows "X did Y"
* Confidentiality: adversary knows "X did ???" [E2E encryption provides this]
* Anonymity: adversary knows "??? did Y" [aka message-by-message unlinkability]
* Ideal: adversary knows "??? did ???"

Signal has already had confidentiality for a long time. (Note: in other contexts, "confidentiality" sometimes means "someone knows X did Y, and we trust that someone to not reveal it", ie. not true privacy. Here, by confidentiality we mean hiding contents from third parties)

This adds pseudonymity: in the above schema, adversary knows "0x8b512c... did Y", where they don't initially know who 0x8b512c... is, but may figure that out over time. The ideal is getting to message-by-message unlinkability.

Actually accomplishing that gets into territory that is currently being explored by mixnet projects as well as newer messengers, eg. @session_app and @SimpleXChat.

Once we get deeper into this territory, I suspect the primary frontier will be spam and DoS protection. Right now, much of the internet blocks all Tor exit nodes - not because they personally hate privacy, but because that's where DoS attacks come from. So we need ways for people to prove their non-spammer status while maintaining message-by-message unlinkability. See here https://t.co/C3tX5tOYJo for one direction (which complements https://t.co/1Q2Hqg0DZg nicely).

So I hope that we appreciate the victory that is mainstreaming of end-to-end encryption, that we actually get Signal accounts without phone number dependency (it's a great thing even if it had zero privacy consequences), and then that we keep moving forward and pushing the frontier of data leakage minimization.

[vitalik.eth @VitalikButerin]

Two weeks ago, Ethereum researchers met in Berlin to continue charting the protocol's long-term trajectory, following along discussions with client teams in Svalbard in April.

The updated strawmap is at https://t.co/9e2AQ6rhz6, and I attached a picture of it to this post.

My own high-level takeaways:

* "Lean Ethereum" is not a single one-shot upgrade, it is a collection of improvements that will come online to the Ethereum network over the course of three or four years. But make no mistake, this IS the third major iteration of Ethereum in the same way that the Merge was the second. Almost every major piece of the protocol will be replaced:

- Verification through recursive STARKs, rather than direct re-execution. Recursive STARKs become an enshrined first-class core component of the protocol
- Replacing everything quantum-vulnerable with quantum-safe alternatives
- Consensus: decoupled available chain and finality, one or two-round finality. Theoretically optimal security properties, simpler than today, and faster than today
- Multidimensional gas
- State: not just tree structure, but what *types* of state are available
- Changes to client architecture
...

At the same time, simplification, cleanup and future-proofing. And this will all be done in a way that minimizes disruption to existing application. We've done this before (the Merge), we can do it again.

* H-star (aka Hegota) is probably Ethereum's last thematically "pre-Lean" fork. Starting from I-star, most of everything we do will have a very strong "Lean" feel to it in one way or another.

* Privacy is no longer an afterthought, it is a first class goal. When designing Frames, the mempool, additions to the state tree, we explicitly ask the question "okay, how do quantum-safe, intermediary-free privacy protocol transactions go through this, and what is the overhead?"

* Formal verification of everything for security.

* FV also makes us much more comfortable with canonicalization (having pieces of the protocol that are directly defined as a piece of bytecode expressed in some language). evm-asm is being written in part to become a canonical proof system for the EVM.

* Quantum safety has shifted up a LOT in priority. This adds a lot of work (eg. finalizing a quantum-safe blobs design has become urgent; this work has already been ongoing for months)

* Probably the single most disruptive part of the plan is the changes to state. There is growing consensus around leaving present-day-style "dynamic state" mostly unchanged, but scaling it only a medium amount, and adding new types of state that are more scalability-friendly (eg. no need for builders to sync/store all of it) but more restrictive, and that will scale a large amount.

eg. possible Ethereum in 2030: 2 TB of present-day-style (dynamic) state, and 100 TB of new-style (scalable but restrictive) state

This "new-style" state would work very well for ERC20s, NFTs, many defi use cases, but not eg. highly "central" objects like Uniswap contracts, or onchain order books, or other complex things (which are crucial for Ethereum but which only take up a small percentage of state)

Hence, it will not be *necessary* to rewrite any apps, but it will be *very cost-effective* to eg. rewrite an ERC20 token into a newer design that uses a new type of UTXO storage that is currently being explored, so that it will have >10x lower txfees.

Design of these new state types (current ideas: keyed nonces, ring buffers, UTXOs, statically accessible state, temp state) is an area where we will need a lot of feedback from application developers (incl. privacy-friendly application developers) and probably several rounds of rethinking and iteration.

* In the context of a much larger total state size, we need to figure out the incentive issues around who stores this state and what motivates them to. Even saying "each node stores 1%" is not good enough - why do they store that 1% and why are they willing to serve it? This is being elevated as a first-class research area.

* Ethereum will need to have a "VM" other than EVM in one form or another - at the very least, we need something like leanISA for recursive STARKs - and the gains are large in exposing it to users so that we support programmable privacy and better scalability. Right now, the most likely contenders are leanISA and RISC-V.

My own ideal is that in this world, we adjust the protocol so that the EVM becomes a high-level-language compiler-level feature, and the protocol only "sees" RISC-V / leanISA directly. But this is still far away.

* Gas limit increases, blob increases and slot time decreases will happen many times over the next ~5 years. We expect a large gas limit increase with Glasterdam. Each step of increased scale or decreased slot time is a matter of getting to the point where it is safe to do it, which comes from a combination of client optimization and protocol changes.

Ethereum is CROPS.

Ethereum is scaling.

Ethereum is reinventing itself.

Onward.

[BlockSec Phalcon @Phalcon_xyz]

.@taikoxyz was reportedly attacked, with losses exceeding $1.7M. Our initial investigation suggests the likely root cause was an exposed Raiko SGX enclave signing key on GitHub. Raiko is Taiko’s multi-prover stack for Taiko and Ethereum blocks, so an exposed Raiko SGX enclave key could directly impact Taiko’s on-chain proof verification path.

Because the enclave signing key was publicly accessible, the SGX prover trust model may have been broken. The exposed key may have allowed the attacker to register attacker-controlled SGX instances via SgxVerifier.registerInstance.

Once registered, those instances could sign proof public inputs accepted by Taiko’s proof verifier, allowing fraudulent state/signal proofs to pass.

The attacker then used the forged source signal to register a fake bridge message as RETRIABLE, and later called retryMessage to make ERC20Vault release canonical L1 assets.

Leaked key:
https://t.co/sIAt355YHJ

[0x1a771ce @lithium_sea]

都在吹claude opus 4.8能够找到 #ZEC 的漏洞的事情，但是很少有人注意到漏洞发现者 @DefuseSec 本身就是ZCash开发公司Electric Coin的安全人员，他熟悉ZCash的底层代码和电路，所以设计出了能够找到bug的AI Harness；但有些人总幻想自己一句prompt "找到比特币的漏洞" 就能够发现一些惊为天人的bug🤣

[Chaofan Shou @shoucccc]

Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness -

Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack.

Check https://t.co/d0SZSf1KqF

[OōEli.eth @ooeli_eth]

说实话，这本《上海交通大学生存手册》(主要作者交大校友、AI专家侯晓迪博士)，尤其第一章，适合所有从应试教育里走出来的人看一看。

因为如果你只接受了应试教育，而没有高认知的父母指引或者自我再教育，你的思维很容易僵化、随大流，也很容易做出人穷志短、舍本逐末的选择。

册子里很好地告诉你:

✅怎么改善错误的思维方式
✅怎么做人生规划
✅怎么提升自己的身价
✅学习和研究的本质
✅留学中介的套路
✅甚至怎么带团队
……
电子书：https://t.co/IFhT1QnkoB

[LayerZero @LayerZero_Core]

https://t.co/3vIHs3Xgs4

[Avihu Levy ✨🐺 @avihu28]

Quantum-Safe Bitcoin Transactions Without Softforks

https://t.co/1lx5waX9VV

[0x1a771ce @lithium_sea]

@young_0521 前几年eth比现在贵

[ETHPanda @ETHPanda_Org]

好文推荐✨

Flashbots 提出了 Flashnet，一种基于 TEE + 密码学的新型低延迟匿名广播协议，解决以太坊执行管线中的“网络匿名性”缺失问题。它在保持强匿名性的同时大幅降低延迟，并支持部分节点失效情况下继续运行，可用于用户匿名交易提交，也可作为去中心化区块构建的协调层基础设施。

欢迎点击原文查看 👀

[Broly @0x_Broly]

https://t.co/yJ6JPtVQlI

[a16z crypto @a16zcrypto]

https://t.co/Xb0vvVVUvm

[Justin Drake @drakefjustin]

Today marks an inflection in the Ethereum Foundation's long-term quantum strategy.

We've formed a new Post Quantum (PQ) team, led by the brilliant Thomas Coratger (@tcoratger). Joining him is Emile, one of the world-class talents behind leanVM. leanVM is the cryptographic cornerstone of our entire post-quantum strategy.

After years of quiet R&D, EF management has officially declared PQ security a top strategic priority. Our journey began in 2019, with the "Eth3.0 Quantum Security" presentation at StarkWare Sessions. Since 2024, PQ has been central to the @leanEthereum vision. The pace of PQ engineering breakthroughs since then has been nothing short of phenomenal.

It's now 2026, timelines are accelerating. Time to go full PQ:

→ PQ ACD: Antonio Sanso (@asanso) kicks off a bi-weekly All Core Devs PQ transactions breakout call next month. These sessions focus on user-facing security, covering dedicated precompiles, account abstraction, and longer-term transaction signature aggregation with leanVM.
→ PQ foundations: Today we are announcing a $1M Poseidon Prize to harden the Poseidon hash function. We are betting big on hash-based cryptography to enjoy the strongest and leanest cryptographic foundations. Check out our other $1M PQ initiative, the Proximity Prize.
→ PQ devnets: Multi-client PQ consensus devnets are live! Shoutout to pioneers @zeamETH, @ReamLabs, @PierTwo_com, @geanclient, @ethlambda_lean, as well as established consensus teams Lighthouse, Grandine, and soon Prysm. This incredible teamwork is coordinated by @corcoranwill via weekly PQ interop calls.
→ PQ workshops: Building on last year's PQ workshop in Cambridge (see photo), the EF is hosting another 3-day PQ event in October. Top experts from around the world will convene. In addition, a PQ day is set for March 29 in Cannes just ahead of EthCC.
→ PQ FV and AI: Last week Alex Hicks (@alexanderlhicks) ran a specialised maths AI for 8 hours, at a $200 cost. It one-shotted a formal proof one of the hardest lemmas in the foundations of hash-based snarks. Mind-blowing. Applied cryptography will never be the same.
→ PQ roadmap: A comprehensive breakdown of the EF's proposed PQ strategy will be shared soon™ on pq[.]ethereum[.]org. The roadmap targets a full transition in coming years with zero loss of funds and zero downtime. Stay tuned :)
→ PQ education: The ZKPodcast (@zeroknowledgefm) is producing a 6-part video series on Ethereum's PQ strategy. EF Enterprise Acceleration is also preparing material for enterprises and nation-states. Finally, Ethereum is now represented on the PQ advisory board that Coinbase announced yesterday.

Believe in something. Believe in PQ security.

[Itamar @itam_r]

This wasn’t a “simple frontrun.”

What happened here looks like a fully automated real-time system:
contract deploy → bytecode scan → logic reconstruction → EVM simulation → entrypoint + loan sizing discovery → private bundle construction → inclusion in the very next block.

All of this within ~12 seconds, with no verified source code and no prior access.

The uncomfortable reality: this capability doesn’t meaningfully exist for whitehats — not because it’s impossible, but because there is no viable incentive to do it responsibly.

Today, this level of automation is economically reserved for adversarial actors.

And once again, most of the value flows to the block builder, reinforcing that the market currently rewards private orderflow and dark execution — not prevention or responsible disclosure.

[0x1a771ce @lithium_sea]

@jiahao_luo9 资金大还可以买硬件钱包，大多数库像alloy这样的都支持

[0x1a771ce @lithium_sea]

Star的发言还是那么务实，以技术为核心。

[Star_OKX @star_okx]

我来谈谈钱包被盗的几种常见情况，希望对大家有所帮助：

1️⃣ DEX Bot 类产品的私钥集中化风险
不少 DEX Bot 产品会将用户私钥上传到服务器，以明文或可解密形式存储。
👉 这意味着内部技术人员可以接触私钥，一旦遭遇黑客入侵，其风险等级实际上已等同于交易所。
因此，这类产品的安全标准必须达到交易所级别，否则风险极高。
同时，这类产品本质上并不属于自托管钱包。在多数司法辖区内，相关服务商可能被认定需要履行 KYC、AML 等合规义务；若未履行，未来可能面临合规甚至刑事层面的风险。

2️⃣ 自托管钱包的代码漏洞或主观作恶风险
包括代码缺陷、供应链攻击、代码仓库被入侵，导致私钥被窃取并外传。
👉 前几天某知名钱包被盗，就属于这一类型。

3️⃣ 用户终端设备被攻破或数据外泄
手机或电脑被植入木马，监听键盘输入、剪贴板；
或将助记词截图保存，被相册软件自动云备份。
👉 我们曾处理过真实司法案件：某大型相册厂商员工在服务器端编写程序，遍历用户备份相片，专门筛选包含助记词的图片。

4️⃣ 自动化策略对私钥托管的结构性依赖
许多用户依赖 Bot 的自动化策略功能，不得不将私钥托管给 Bot 服务商。
OKX Wallet 即将发布的 Smart Account，将通过 TEE 技术，在不托管私钥的前提下实现自动化策略执行，解决这一长期存在的安全矛盾。

5️⃣ 钱包安全的正确演进方向
私钥安全与易用性并不是对立关系。
OKX Pay Wallet 的设计理念，正是结合：
•机构级安全与风控体系
•用户本地 Passkey / 自身控制

OKX Pay 目前仍是一个概念性产品，但在接下来一年里，我们会持续引入更强大的能力，为普通用户更好地守护资产安全。

[0x1a771ce @lithium_sea]

hyperliquid

[Hyperliquid @HyperliquidX]

Hyperliquid is built on a foundation of onchain transparency. A recent article made several claims that are factually incorrect:
+ Solvency: Every dollar is accounted for; the author failed to count native HyperEVM USDC.
+ Integrity: Testnet functions are exactly that - testnet only for testing. They cannot be executed on mainnet.
+ Transparency: Hyperliquid is more transparent and decentralized than all other major venues for perps trading. The entire state is independently maintained by a permissionless validator set and verified through BFT proof-of-stake consensus by each node. Every order, trade, and liquidation is available in real time during execution. Anyone can run a node and index the chain’s state and transitions. No major perps platform comes close to this guarantee for users.

See our response to the writer’s individual points below.

Claim: The system is undercollateralized by $362M

False: The Hyperliquid blockchain state is fully and verifiably solvent. The author excluded the HyperEVM USDC (a publicly announced and much anticipated integration), which exists in parallel to the Arbitrum bridge. Every USDC in circulation on HyperCore is accounted for transparently, by summing up the balances of https://t.co/Fk2lhZvpXD and https://t.co/pGBPcsJUTl. At the time of writing, this amounts to 3.989B + 362M = 4.351B USDC on HyperCore. USDC on the HyperEVM can be computed by subtracting 362M from the 421M on the HyperEVM USDC contract (https://t.co/ohiJm3WzN8), totaling another 59M USDC on HyperEVM.

The sum of the Arbitrum bridge and native USDC balances can be compared against the sum of user balances on HyperCore. As highlighted in the introduction, this exercise of verifying complete system solvency against user balances is uniquely possible on Hyperliquid compared to competitors.

The current Arbitrum bridge was an important stepping stone in bootstrapping the Hyperliquid network and will be deprecated as the migration to native USDC is complete, bringing Hyperliquid to parity with other major L1s.

Claim: There is retroactive volume manipulation via TestnetSetYesterdayUserVlm

False: This is a testnet-only function to allow for comprehensive testing. The author states that “the function’s presence is the problem…capability alone violates the trust model.” Testnet-only features that enable more rigorous testing of edge cases do not undermine the chain’s integrity. The fee schedule on Hyperliquid interacts in a complex way with inputs: user volume, aligned quote token status, maker vs taker, HIP-3, etc. It’s important to test these interactions on testnet, and therefore the testnet chain has a set of admin testing functions that do not exist on mainnet. The related TestnetAddMainnetUser action is to mark a testnet user as having corresponding mainnet state, to avoid DDOS and other attacks that are “free” on testnet. None of these functions are callable on the mainnet state.

While the execution source is not available, anyone can verify every trade onchain by running a node, and sum up the values to confirm that volume numbers are reflected accurately in onchain state. Similar to onchain solvency verification against the sum of all user account values, this is possible on Hyperliquid but not on most competitive platforms.

Given that this code path is entirely unreachable on mainnet, future development work will entirely compile out this testnet-only logic on mainnet nodes to avoid any possible misunderstanding or misinterpretation.

Claim: Some users have special privileges such as fee exemptions or retroactive volume manipulation used to influence the airdrop

False: Like system solvency, user balances, and individual trades, the fees paid by any address is available onchain. Each trade along with its fees paid or rebates received are transparently indexed by nodes, API servers, and third party analytics providers. There are no such mechanisms to distort fees, and no such mechanisms could have influenced the HYPE airdrop. Furthermore, the genesis distribution of HYPE is fully available onchain, and users can verify the historical behavior of every such address.

Claim: “CoreWriter” godmode can mint tokens, move user funds without signatures, crash random validators and basically do whatever it wants

False: The CoreWriter spec is fully documented here https://t.co/TTMWI5pDBB and replicable in the open source HyperEVM execution. CoreWriter is a way for smart contracts on HyperEVM to send HyperCore actions as part of HyperEVM block execution. It supports various actions that are normally sent by EOAs such as staking and placing orders, but has no such features to “mint tokens, move user funds without signatures, crash random validators and basically do whatever it wants.” This is a fundamental misunderstanding of how HyperCore interacts with the HyperEVM.

Claim: Chain can freeze via governance, and no undo function exists

Misinterpreted: The chain freezes during network upgrades. There is no undo function because the validators adopt a new binary at that height. This is analogous to how other networks perform hard forks at future heights determined by social consensus.

Suspicious activity on POPCAT in Nov 2025 did not cause the L1 to freeze, nor were any user funds frozen. The L1 was entirely operational, and any observer can see the blocks that were produced during this time. The Arbitrum bridge was automatically locked after the incident due to abnormal variation in account balances. As explained above, the Arbitrum bridge is not as secure as natively minted USDC, and therefore requires several conservative automated locking mechanisms as safeguards. The Arbitrum bridge’s locking mechanism is audited and open sourced, and the bridge is being deprecated with the transition to native USDC.

Claim: A single private key can set any oracle price instantly: no timelock, no limits

Misinterpreted: The author is likely mistaking the HIP-3 oracle updater logic with the validator-operated perps. HIP-3 oracle updates are indeed set by a single address, but this is up to the deployer to configure. The updater address need not be an EOA. For example, current HIP-3 deployers use a combination of MPC and CoreWriter architecture.

For validator-operated perps, multiple validators can submit oracle price updates. The final prices are a robust weighted median across major centralized exchanges. There is no timelock and no limits explicitly because these limits make the system less, not more, safe. The events of 10/10 show the danger to solvency if ADL is not accurately triggered in a timely manner during high volatility. Hyperliquid was one of the only venues without performance degradation or a network outage during this time. If Mango Markets or a similar protocol with oracle rate limits were active during 10/10, they would have likely accrued bad debt. Further decentralization will involve other validators actively running independent and open-sourced oracle update binaries.

Claim: 8 undisclosed addresses control all transaction submission

False: Some transactions are already sent directly from the validators. Some such as orders are not, in order to minimize MEV, but a future upgrade will incorporate this logic for all transactions in a mechanism that is both MEV- and censorship-resistant. The careful consideration of MEV is in response to trader and researcher feedback based on predatory behavior observed on other chains. There is almost unanimous agreement that toxic transaction ordering degrades the end user experience. Ultimately, the validator set is permissionless, and there is no guarantee that validators in the mainnet set are always fully aligned with the ecosystem. A major milestone in decentralization will be solving this problem, including a multiple-proposer block building setup.

Claim: There is a liquidation cartel with unfair advantages

Misinterpreted: Only HLP may backstop liquidate users, and HLP subvaults are the only addresses in this set. However, depositing into HLP is permissionless, so HLP is a community-owned liquidity vault supporting the protocol. The fact that HLP has privileges is no different from other protocol liquidity vaults.

Relatedly, all liquidations are first attempted against the order book, which handles the vast majority of liquidated positions without backstop liquidation. This allows users to keep any remaining collateral, and allows all other users to compete in providing the best price to the liquidation flow, benefitting the liquidated user.

Claim: There is a hidden lending protocol with $1M+ supplied and no documentation

False: Portfolio margin, borrow lend, and the HLP supplied value were all publicly announced and are currently in pre-alpha rollout. The current documentation can be found at https://t.co/vvE8EhpIhX and has been progressively fleshed out over the past several weeks.

Claim: ModifyNonCirculatingSupply allows changes to token supply

False: The full supply of HIP-1 tokens on HyperCore is fixed at deployment. The non-circulating supply is a purely informational number that can optionally mark addresses as “non-circulating” for display purposes. Whether an address is marked as “non-circulating” does not affect execution. This is an example of onchain information that might make more sense offchain, but is not a vulnerability.

Thank you to the author for spending the time to verify the execution of Hyperliquid. The fact that this investigation could be done at all proves the transparency and decentralization that Hyperliquid has already achieved. Concretely, Hyperliquid is the only major perps venue where the entire state and every input diff is transparently available to anyone running a node.

A similar analysis on any of the other top perp DEXs is impossible. For example, Lighter uses a single centralized sequencer whose execution logic and ZK circuits are unavailable. Aster uses centralized matching and even offers dark pool trading, which is only possible with a single centralized sequencer without verifiable execution. Other protocols with some open source contracts do not have a verifiable sequencer.

On Binance, Lighter, Aster, or similar exchanges, it is impossible for anyone other than the sequencer to see a full snapshot of onchain state including order books, positions, and other user information. The centralized sequencer can also upgrade its software without any constraints. On Hyperliquid, the entire state is onchain, which means there are 24 validators executing the same state machine under BFT consensus rules. There is plenty left to do on the journey towards greater decentralization, but it’s important to highlight just how far Hyperliquid and its ecosystem have come compared to competitors.

Decentralization is progressive, and Hyperliquid will ultimately be fully open sourced. Hyperliquid is the most transparent of all major venues, even though this leaks advantages to competitors (all of whom are closed source), who can copy Hyperliquid’s innovations more easily. We think this is the correct tradeoff to balance value accrual to the community, speed of innovation, and upholding the values of defi.

The HyperEVM execution is open source, and Sprites, an independent community member, maintains a full archival node that powers many important integrations. HyperCore will follow the same path as soon as it reaches feature completion.

[0x1a771ce @lithium_sea]

@base @jessepollak Why this motherfucking guy can always backrun the tx with exact gas in basechain? Are you guys sell your orderflow in sequencer???
https://t.co/PiIjBemnAi

[Bas Westerbaan @bwesterb]

Google's Sophie Schmieg's take on the relative security of various post-quantum schemes.
https://t.co/zNip66A6qq

[Nico @nico_mnbl]

Asiacrypt discerning the test of time award to KZG commitments 👏👏