ERC: Quantum Bridge Shield

What it is

Quantum Bridge Shield is a draft ERC from Quantova Inc (PR #2071 on ethereum/ERCs, reference implementation in quantova-inc/Quantova-bridge-guard). A guard contract approves a bridge's batch Merkle root only if a committee has signed it with RFC 8554 LMS keys. The authors present it as an answer to harvest-now-break-later attacks on ECDSA and BLS committee keys.

How it works

• Parameters: LMS over SHA-256 with 32-byte outputs, tree heights 5 to 25, Winternitz 1, 2, 4 or 8. A public key is 56 bytes. A W4 height-10 signature is 2,508 bytes.
• Approval: a strict majority of distinct unfrozen keys must sign. The guard records each used leaf as a hash of the digest and signature, and freezes any key that signs one leaf twice.
• Binding: digests include a domain tag, chain ID, guard address and epoch. Each root waits at least 60 seconds before use.
• Hybrid mode: during migration, each LMS signature is paired with an ECDSA signature.

Measured cost

Approval is expensive, but it is paid once per batch. The per-message cost after approval is small.

Preconditions / Affected

Relevant if you run or audit a bridge whose committee signs with secp256k1 or BLS12-381. Integration needs a leaf binding for your bridge design. The draft only specifies one, the packet verifier binding.

What to do

There is no deployable action yet. For an engineer evaluating it:

• Check the 6-of-10 approval cost (about 1.69M gas) against your batch cadence.
• Check your committee size against the rotation limit. The 12.44M worst case is the largest rotation the guard accepts.
• The authors ask for feedback on three things: the default parameter set (W4 at height 15 or 20), whether the committee size bounds fit real operators, and leaf bindings for other bridge designs.

Caveats

• LMS is stateful, and one leaf reuse freezes a key. The authors say their signer kit handles this with durable leaf reservation, a monotonic high-water mark, and refusal of network file systems. Operators would have to run that kit or equivalent.
• Benchmarks are at height 10. The default under discussion is height 15 or 20, so the figures may not carry over.
• The assurance claims are the authors' own: a NioLabs assessment with no critical or high findings, 55 contract tests, RFC 8554 Appendix F vectors, and CI. The page does not give the assessment's scope or any medium or lower findings.
• The page is partly a Quantova promotion. It does not discuss the trade-offs of the 60-second delay.