Quantova proposes hash-based shield for Ethereum bridges

Quantova Inc has proposed a standard called the “Quantum Bridge Shield” — an ERC that would let an integrating Ethereum bridge hold a cross-chain message until a committee signs the batch with hash-based signatures. The filing centers on LMS keys, which it says a quantum computer cannot forge, and it takes direct aim at the signature schemes currently protecting bridge committees.

The primary document is the Quantum Bridge Shield proposal on Ethereum Magicians. The guard contract it describes accepts a batch’s Merkle root only once a strict majority of distinct, unfrozen committee keys has approved it. Every approved root then sits for at least 60 seconds before messages from that batch can be used. That delay is baked into the mechanism, not something left to the bridge operator to configure.

Any bridge integrating this shield absorbs that mandatory one-minute hold.

The filing’s argument starts with the signature schemes already in use. Committees currently sign with secp256k1 ECDSA or BLS12-381. Per the proposal, Shor’s algorithm can recover private keys for both in polynomial time. NIST IR 8547 proposes deprecating quantum-vulnerable signatures from 2030 and disallowing them after 2035; CNSA 2.0 sets the same transition window for signing.

The replacement is LMS keys specified in RFC 8554, approved in NIST SP 800-208 and listed in CNSA 2.0. SHA-256 with 32-byte outputs, tree heights from 5 through 25, Winternitz parameters of 1, 2, 4, and 8. An LMS public key is 56 bytes; a W4 signature at height 10 is 2,508 bytes.

The security claim is narrow. The shield’s security rests only on SHA-256 and Keccak-256, providing about 128 bits against Grover search. The committee mechanism changes the signature layer protecting message batches; it doesn’t eliminate the committee or its obligation to bind accepted messages to an approved root.

The gas bill

Costs come in two stages. Verifying an LMS W4 signature at height 10 runs between 185,093 and 223,979 gas, with a mean of 204,807, across 16 signatures. A hybrid configuration pairs every LMS signature with ECDSA during migration.

For the committee examples in the proposal: two-of-three hybrid approval costs 549,015 gas. Six-of-10 costs 1,686,595 gas. Once a batch of 256 messages has an approved root, accepting a single message from that batch costs 7,078 gas.

The filing’s batch structure makes committee-approval frequency and batch size central to the per-message cost. Using the filing’s 6-of-10 numbers, the 1,686,595-gas approval cost spread across 256 messages works out to roughly 6,588 gas per message; tack on the 7,078-gas acceptance cost and you’re at about 13,666 gas per message. That calculation uses only the proposal’s committee, batch, and per-message figures — other bridge execution costs aren’t included.

A LayerZero packet routed through the shield costs 128,683 gas per the filing. The worst-case committee rotation the guard accepts costs 12.44 million gas. The proposal references a 16,777,216-gas cap; 12.44 million against that cap is roughly 74.2%, about three-quarters of the limit.

Rotation is a distinct cost event, not folded into ordinary message acceptance. How often committees rotate, and how many messages each signed root covers, drives the economics here more than the per-message figure does.

Rather than ripping out existing signatures immediately, the proposal includes a migration path. In hybrid mode each LMS signature is paired with ECDSA, preserving the current signature type while a bridge transitions. At a 6-of-10 configuration, that hybrid approval costs 1,686,595 gas.

What is documented so far

Quantova’s reference implementation comes with 55 contract tests, 512-run fuzzing, 24 rounds of byte-level parity testing, RFC 8554 Appendix F vectors, 48 signer-kit safety checks, and a 12-step live run on a local Ethereum node. The proposal says a NioLabs security assessment found no critical or high-severity issues in the Quantum Bridge Shield.

Those results are reported in the proposal itself. They describe the testing attached to the reference implementation.

Quantova situates the ERC inside a broader post-quantum stack. The company says every account on its network signs with ML-DSA-65 or SLH-DSA, validators sign every block and finality certificate with ML-DSA-65, nodes establish channels with ML-KEM-768, and settlement-path hashing uses SHA3-256 with no elliptic-curve cryptography.

The immediate exposure described by the Ethereum Magicians filing is architectural: bridges adopting the ERC take on LMS committee operations, a mandatory 60-second root delay, hybrid verification costs during migration, and a worst-case committee rotation cost of 12.44 million gas. For market context, CoinGecko listed ETH at $2,509.86, up 0.4% over 24 hours.