raz

Co-Founder and CTO @LayerZero_Labs

[raz @ryanzarick]

Zero is the first multi-core decentralized world computer. Each core is capable of 2 million TPS and the blockchain scales horizontally to near infinity.

It lives up to everything we stand for:

- Decentralized
- Permissionless
- Censorship-resistant

🧵

[LayerZero @LayerZero_Core]

https://t.co/vVPUwJ2BSl

[Justin Thaler @SuccinctJT]

A few reflections on the lattice vs. hash-only debate that our recent Aerie post sparked:

1. Cryptographic ossification for blockchains was never safe. Until the day we know with certainty that P ≠ NP, that finding short vectors in lattices is intractable, that Keccak effectively behaves like a random oracle in deployed SNARKs, and that every single bug has been eliminated from our codebases, blockchains cannot ossify. That is simply not how safe systems are built. Issues will arise, and the system will have to respond.

It’s a double standard to reject lattices because blockchains are hard to upgrade if lattices break, while counting on upgrades if AI breaks your hash function or finds a critical zkVM bug.

The best counterargument is that hash-only designs are more agile: if your hash function breaks, just swap out the hash. But we must aspire to a higher level of agility than this. Indeed, as I cover next, if SNARK recursion itself turns out to degrade security, the proposed hash-only blockchain designs would need to be rethought from the ground up.

2. The real security debate is not lattices vs. hashes — it is lattices vs. building everything on SNARK recursion. That’s because “hash-only” is not really hash-only: it rests on hashes plus the soundness of deep SNARK recursion. Ethereum’s roadmap relies on exactly that: hash-based aggregation needs recursion to keep up with a slot’s worth of signatures, and EIP-8288 would send other signature schemes and users’ own proofs through the same recursive pipeline. In contrast, Aerie proves a slot’s worth of signatures on one laptop without any recursion.

All deployed post-quantum SNARKs rely on the Random Oracle Methodology (via Fiat–Shamir) to establish their security. This is an idealization we know fails in the real world: we have explicit counterexamples where “SNARKs” coming out of this methodology are totally insecure when instantiated with any concrete hash function.

We generally ignore these counterexamples in part because they only arise when proving contrived, self-referential statements about the very hash function used by the SNARK verifier.

But proving statements about the verifier’s own hash function is the exact thing you do in SNARK recursion. That’s why the security of recursive SNARKs can’t be established even in the random oracle model.

On top of that, the standard security proofs for recursion (in other models) suffer an “extractor runtime” blowup that is exponential in the recursion depth, suggesting that security may degrade as more recursion is applied. Yet Ethereum’s own EIP-8288 enables unlimited-depth recursion, even as it lists soundness of recursive SNARKs as a trust assumption. Proofs in more idealized models avoid the blowup, but they mainly tell us that an attack on SNARK recursion would have to exploit the concrete hash function, which is exactly what the Fiat–Shamir attacks above do.

To be clear, we don’t know of any outright attacks on SNARK recursion, and I very much hope it is secure. But some of us who have studied the question have a lingering sense that an attack may be possible in some settings. And if AI is going to supercharge cryptanalysis, there is no reason to expect it to spare Fiat–Shamir for SNARKs, let alone SNARK recursion, both of which have had far less scrutiny than lattices.

So, I do not concede that a “recursion everywhere” hash-only approach is clearly more conservative than one built on standard lattice assumptions.

3. “Just wrap everything in a hash-based SNARK” (like EIP-8288) faces challenges.

Aggregating signatures and proofs off-chain into a single block-level proof is a powerful design independent of the hash-only vs. lattice debate, and I am not telling people to avoid it. But claiming, as Vitalik Buterin did this week, that users can run whatever cryptography they want locally and wrap it in a client-side leanVM proof glosses over major hurdles.
For example, leanVM today is a minimal VM designed almost entirely to prove hash-based signatures and recursion, not general-purpose computation. And binary-field SNARKs like leanVM remain slow at proving the integer multiplications that lattice cryptography does en masse.

I am optimistic that many of these zkVM challenges can be met (including via my own work, binary-field Twist and Shout, which are now implemented in Magnetar). But regardless, if lattices can make aggregation simpler and faster, then they should be leveraged. We need to be agile no matter what.

4. For chains whose reason for existence is privacy, I truly struggle to understand the pushback. Public-key encryption (and fast single-server PIR) cannot be built from hashes alone, at least not in any black-box way. If lattices break, it is going to be very, very hard for these chains to provide acceptable levels of privacy and functionality. For a project whose entire reason for existence is privacy, a loss of confidentiality is an existential failure. Next to that, a second signature upgrade (after the first one, from elliptic curves alone to, hopefully, a hybrid lattice scheme) is easy.

Summary: We don’t know for sure what is secure and what isn’t. We are all weighing unquantifiable risks against each other, and we do not need to agree on a total order on them. But hash-only solutions face many open engineering challenges, and they are not more “conservative” in the way some have argued. Some of those challenges are entirely prosaic and have nothing to do with bugs or cryptography, like hardware support for custom schemes whose hash function is still undecided. I hope we can overcome those challenges within the appropriate timelines, but they must be acknowledged and portrayed realistically.

Overall, cryptographic agility and defense in depth (e.g., hybrid signatures) are the answer, which is why we are building both lattice-Jolt and hash-Jolt. In practice, the positions are less polarized than social media discourse suggests: for example, StarkWare is working to make Falcon verification cheap (https://t.co/FM68hmkqRx), which is great to see.

Here is the (apparently) controversial take I am sticking to: Conditioned on agility, whenever lattices make systems simpler or more functional, we should embrace them rather than default to “hash-only” designs. Lattices are what the rest of the world will depend on, with decades of study and hardening behind them, and at the system level, less functional often means less secure. Where hash-only designs are just as simple and functional, by all means use them.

[LayerZero @LayerZero_Core]

The countdown begins: Zero mainnet and lzATLAS go live on November 30.

[raz @ryanzarick]

So pumped 🔥🔥🔥

[LayerZero @LayerZero_Core]

The countdown begins tomorrow at 9a ET.

[Will Papper @WillPapper]

Ethereum using non-standard cryptography a second time around (for post-quantum) would be a big mistake

We could have had every iPhone act as a hardware wallet with Apple Wallet support if Ethereum had used standardized cryptography. Let’s fix this now instead of repeating it

[raz @ryanzarick]

Wait until you see what we do with it.

[LayerZero @LayerZero_Core]

New from LayerZero Research: Aerie.

A new system capable of aggregating 32,000 post-quantum Falcon signatures in just 0.65 seconds on a MacBook Pro.

ML-DSA, NIST’s standardized default, is already working inside Aerie at high performance.

https://t.co/IXm2vLB00X

[LayerZero @LayerZero_Core]

New from LayerZero Research: Aerie.

A new system capable of aggregating 32,000 post-quantum Falcon signatures in just 0.65 seconds on a MacBook Pro.

ML-DSA, NIST’s standardized default, is already working inside Aerie at high performance.

https://t.co/IXm2vLB00X

[LayerZero @LayerZero_Core]

What does 200k TPS look like? See for yourself.

[LayerZero @LayerZero_Core]

September 2026 In Review

[LayerZero @LayerZero_Core]

Last month, over 90% of all volume transferred across chains via third-party protocols used LayerZero.

[LayerZero @LayerZero_Core]

New from LZ Research: Too Late to Slash

Today we’re sharing a new paper challenging a common belief: slashing backs the security of proof-of-stake blockchains.

Read the full research paper:
https://t.co/qQi6I73Q7i

[LayerZero @LayerZero_Core]

How fast is "sub-millisecond"?

See for yourself: https://t.co/0nTXbIFuul

[Bryan Pellegrino (臭企鹅) @PrimordialAA]

Little known fact but @chainlink was one of the first to build a LayerZero v1 DVN. 4 years later, @LayerZero_Core messages are still the #1 sender within their infrastructure. Cool to see the longevity here and shows just how sticky LayerZero is!

[Bryan Pellegrino (臭企鹅) @PrimordialAA]

Stablecoins have gone $5B -> $320B since 2020 (63x)
RWAs have gone $16m -> $38B since 2020 (2375x)

The most bearish RWA projection is $2T by 2030 (@McKinsey), the most bullish is $30T (@StanChart).

Stablecoins are projected to be $3T by 2030

RWAs as % of stablecoin supply have gone from 0.1% -> 1% in less than a year

RWAs are now held by almost 5M people (up 50% in just the past month alone), tokenized equities >3M people.

If you're not bullish looking at these #s with what blockchains are about to do to finance I don't know what to tell you

[LayerZero @LayerZero_Core]

Regulated stablecoins, everywhere.

@Anchorage, home to America’s first federally chartered crypto bank, has selected LayerZero as its interoperability partner for regulated stablecoin issuance.

[LayerZero @LayerZero_Core]

New from LayerZero Research - Challenging Poseidon

Today we’re sharing two new papers outlining a number of structural weaknesses in Poseidon, one of the most widely used hash functions in zero-knowledge proving systems.

https://t.co/lYp2uz4D6a

[LayerZero @LayerZero_Core]

Zero is coming.

[Bryan Pellegrino (臭企鹅) @PrimordialAA]

There are a series of posts today talking about Wyoming/FRNT that is so wildly hyperbolic and 'hit-piece-y' it feels like we must respond to it.

Here is the exact history

- We deployed the FRNT token on Solana on behalf of Wyoming. They had requested for it to be deployed with 'All extensions initialized'

- We handed over all related Token2022 extensions except for the 'Scaled UI Amount authority' that was missed by both Wyoming and us.

- This extension is UI scalar amount only. It can not mint, burn, freeze, seize, pause, transfer funds, change token supply, or modify raw balances. It was never modified and remained at 1 for the entire period.

- As soon as it was flagged that this had not been transferred, it was transferred to Wyoming within 24 hours

DLP5sGaLm596Fa8PCNPYNofFK1cZxzME7csK3xBsABCT
→
3FL7iZaerXVygpPAFtXyxoCGdoUt11eiSBYkko6mMD8x

The 'Scaled UI Amount Authority' is a view-only metadata account. There is also a claim that the key to this function was lost which is both wrong and a strange claim to make given you can see it being transferred on-chain and it was less than 24 hours from request to confirmed transfer.

As always I have nothing bad to say about @wyostable. I think they've been trying something really innovative and I wish them nothing but the best of luck. I continue to be a champion of what @wyoapollo and team are trying to do.

[raz @ryanzarick]

@WillPapper @alive_ @SuccinctJT @a16zcrypto @LayerZero_Core 🙏🙏🙏

[LayerZero @LayerZero_Core]

Introducing Akita, the first production-ready, lattice-based polynomial commitment scheme for post-quantum security.

It’s the first major step in making Zero quantum-secure, and will be implemented in Jolt on day one, thanks to our partnership with @a16zcrypto.

Read the full research paper:
https://t.co/QgiXsRlUTa

[Cathie Wood @CathieDWood]

Most investors do not appreciate the important role that @LayerZero_Core is playing in crypto messaging and interoperability. I am so impressed with the vision of Bryan, Simon, and the team.