Authors: SNZ Holding, ETHTAO

This article is compiled from the September 16 AMA by EF researchers on Reddit with the community, original AMA record: https://www.reddit.com/r/ethereum/comments/1wf48x3/comment/p9pw3pv/

Quantum resistance throughout all aspects

On September 16, 2026, the Protocol team of the Ethereum Foundation held a new round of AMA on Reddit. The discussion covered scaling, privacy, quantum resistance, formal verification, ETH issuance, and client funding. By putting these answers together, one can see a gradually clearer main narrative: **Quantum migration is influencing the technical priorities of Ethereum over the next few years, and ZK proofs are increasingly involved in the design of accounts, consensus, and privacy.** At the same time, the progress on the technical route has not eliminated economic policy and governance differences.

The value of this AMA lies in the fact that researchers explained the ongoing work and openly discussed trade-offs and different judgments. Many answers clearly represent personal opinions, hence understanding this discussion requires consistently distinguishing between achieved results, pending upgrade proposals, and more long-term research concepts.

Quantum resistance is the starting point for understanding these trade-offs. The goal proposed by the Protocol team is to achieve a quantum-resistant Ethereum L1 by December 2029. This goal involves the entire chain: user accounts need new signature mechanisms, the consensus layer needs an alternative to BLS signatures and aggregation methods, and the data availability layer also needs to adjust its dependence on KZG. Work at different levels must coordinate with each other; it is difficult to complete through a single isolated upgrade. Completing the migration of the core protocol will not automatically grant wallets, Rollups, bridges, and applications quantum resistance; these systems still need to individually assess cryptographic dependencies and migrate.

Frame transaction is all you need——The ultimate answer to account abstraction

The key change at the account layer is Frames, which make transaction validation logic programmable. In conjunction with the relevant migration proposals, users will have the opportunity to free accounts from the control of the original secp256k1 keys and continue to switch signing schemes in the future. This flexibility is important because quantum-resistant technology is still developing, and the protocol needs to allow space for evolving different schemes.

However, there is still a significant distance between supporting a new signature and making it cheap and user-friendly. Vitalik compared that the computational and data costs of ECDSA signatures are about 4,000 gas, while SPHINCS- quantum-resistant signatures require about 100,000 to 250,000 gas, depending on parameters. Therefore, subsequent work also includes aggregating signatures before transactions enter blocks and replacing large amounts of raw data and computations with proofs. Such a mechanism serves both quantum-resistant accounts and may lower the costs of privacy transactions.

ZK-EVM begins to enter actual production

L1-zkEVM and quantum migration have thus seen more technical intersections. Both paths are leveraging RISC-V zkVM, where investments in proof systems and optimization tools can be reused. Over the past year, related work has progressed to execution specifications, testing, client integration, and the construction of open-source tools. Multiple zkVMs have made progress in performance and security, and executing clients and proved programs are undergoing tests such as block validation and execution witness generation. A current important point is whether the optional execution proof EIP-8025 can be included in Hegotá, to accumulate experience for future deployment.

Justin Drake is quite optimistic about real-time proof. He believes that the main performance risks have significantly decreased and mentions that some teams are optimistic about achieving approximately two seconds of proof for the vast majority of mainnet blocks by 2027. However, other responses emphasize engineering conditions: gas limits, new precompiles, and block structure will all change the proof burden, and if performance is insufficient, mandatory proof should be postponed. State growth may also become a scaling bottleneck sooner than proof delays. Performance breakthroughs are expanding optional solutions, but mainnet launch still requires complete security and integration work.

This architecture also brings a decentralized trade-off. Generating proofs may require specialized hardware, but validating proofs can be very cheap. Ethereum hopes to enable ordinary validators not to constantly upgrade equipment as execution throughput increases through this division of labor. Accordingly, the centralization risks of builders and provers need to be taken seriously, with research directions including lowering the hardware threshold for individual provers and exploring distributed proving.

Privacy is advancing in an orderly manner; there is still a lot of foundational work to be done

Privacy is advancing based on these accounts and proof capabilities. The seemingly contradictory statements in this AMA actually point to different levels: some believe that support for native privacy transactions is expected by 2027, while Justin feels that the probability of achieving a protocol-based privacy pool by the end of 2028 is close to zero. The former discusses how privacy applications can directly use Ethereum's public transaction channels, while the latter discusses whether to write a unified privacy pool into the protocol.

The recent goals are closer to the former. Through Frames, relevant account mechanisms, and FOCIL, privacy application transactions are expected to utilize public mempool and protocol-provided censorship resistance, reducing dependency on specialized relays. Ethereum can thus support various privacy applications without having to specify a unique official privacy pool first. If it can efficiently aggregate quantum-resistant privacy proofs, it may also further improve costs and scalability. The relevant years are still conditional targets or personal predictions.

Whether a built-in privacy pool is needed in the long term remains a subject of differing considerations among researchers. Justin has mentioned default privacy staking for ETH, and ideas for incorporating unstaked ETH into this system; meanwhile, other respondents have pointed out that immutable privacy applications post-upgrade may already possess attributes similar to protocol-based pools, thus whether it is worthwhile to continue writing it into the protocol still needs discussion. Enhancing L1 privacy capabilities does not mean that privacy L2 loses its function: basic transfers, privacy stablecoins, privacy DeFi, and a complete privacy contract environment may still be carried out by different systems.

Formal verification is developing positively

If ZK is expanding what protocols can do, formal verification provides a stronger security basis for these changes. The post lists some security proofs for signature schemes, validations of zkVM circuit constraints, and work related to EVM execution programs. The verification process has already helped teams discover and fix real errors, but end-to-end verification covering cryptographic constructs, proof systems, and specific execution programs is still not complete.

It's worth noting that this work is forming a more complete toolchain. Clean is trying to directly describe circuits in Lean; hax and Aeneas help connect Rust implementations to formal specifications; VCVio and ArkLib provide a cryptographic proof foundation; evm-asm is advancing verifiable execution programs. Automated research and performance optimization have also begun to integrate with proofs, allowing optimized programs to undergo rigorous checks. This makes formal verification more likely to enter daily development rather than just appearing in the review stage after development is completed.

A faster Ethereum is on its way

Ethereum's pursuit of speed is also adapting to these new constraints. Ben Edgington noted that the originally envisioned single slot finality path has, in his view, ended, but the goal of coming close to this experience remains. The new decoupled consensus idea allows for gradual improvement of finality without having to wait for the verification scale, network, and signature aggregation issues to be resolved simultaneously. He anticipates that in the early stages, finality time may be reduced from approximately sixteen minutes to about four minutes, with the long-term aim of achieving one to two slot scales of finality.

Monetary policy still requires broader community consensus

Technical designs can continuously narrow down the scope of problems, but ETH issuance policy still needs broader social consensus. Justin Drake and Anders Elowsson have both explicitly supported adjusting the current issuance mechanism in a personal capacity. They are concerned that ongoing staking incentives will place increasing relative pressure on non-stakers, pushing more users toward exchanges or liquid staking tokens, and increasing contract, governance, and centralization risks.

This debate also involves the role of ETH in the economy. How will the status of native ETH as currency and collateral change if more ETH is converted into staking certificates with additional risks? Does the business around staking rewards crowd out other DeFi innovations? Will reducing issuance make it harder for independent stakers to enter? These questions cannot be answered solely by comparing nominal annual yields; an analysis of participants' actual costs and the composition of stakers is also necessary.

Support for reform does not mean that solutions have been determined. Anders emphasized that adjusting issuance requires clearly designed incentive effects, models that can explain the total amount of staked ETH and the composition of participants, as well as open discussions about benefits and costs. Community members have raised objections about the urgency of reform, who should convene discussions, and whether existing processes are sufficient. The AMA did not reach a policy conclusion that has already decided to reduce issuance or limit staking ratios.

New organizational structure at EF, with dedicated teams collaborating with the community

Collaboration at the organizational level is also expanding. The Access Layer has begun to take on the application and developer support work on top of the protocol, Ethlabs members continue to participate in technical discussions and architectural discussions, and Ethereum Institutional collaborates with researchers to explain the quantum resistance pathway and Strawmap to institutions. The future connection between research, implementation, and application will increasingly rely on continuous collaboration among multiple teams. At the same time, the roadmap itself will still be revised, and researchers have not provided comprehensive answers regarding L2 value capture, cross-chain liquidity, and privacy interoperability.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。