
EF Protocol: Current and Emerging Priorities
The Ethereum Foundation Protocol cluster lays out its security-driven roadmap through 2029, centered on making Ethereum L1 quantum-resistant across execution, consensus, and data layers by December 2029 (planning for Q-day as early as 2030). It details the fork sequence delivering a minimum-viable post-quantum milestone, cryptographic agility via native account abstraction (Frame transactions, EIP-8141), retirement of vulnerable BLS withdrawal credentials (EIP-8365), and censorship-resistance and privacy work via FOCIL (EIP-7805), EIP-8369, EIP-8250 and EIP-8272.
What it is
The Ethereum Foundation Protocol cluster's roadmap post detailing the Hegotá hard fork (next fork after Glamsterdam, implementation starting ~Q4 2026) and the fork sequence (Hegotá → I → J → K → L) leading to full post-quantum readiness on L1 by December 2029.
How it works
The Strawmap sets two possible cadences: a 7.2-month average per fork to reach full PQ readiness at L (five forks after Glamsterdam), or a 12-month cadence reaching a contingency "minimum viable post-quantum" (MV-PQ) milestone at J. MV-PQ is a fallback that keeps Ethereum running through Q-day with reduced (not yet fully defined) security guarantees — leanSPHINCS transactions (execution), leanDA sampling (data), and a PQ heartbeat (consensus) land at J, while a PQ public-key registry lands at I. A pending reorder would swap K/L: moving PQ attestations forward to K and pushing mandatory zkEVM proofs back to L, trading a 9-month cadence requirement for earlier consensus-layer PQ coverage. The cluster commits to treating the December 2029 deadline as non-negotiable only until January 2027, when it will be reassessed with outside experts.
Hegotá itself has two SFI'd (spec-frozen-for-implementation) headliners that must ship together and be tested for interaction: EIP-7805 FOCIL and EIP-8141 Frame Transactions. The post explicitly states appetite for additional consensus-layer scope is "close to zero" unless it directly supports PQ readiness, since it would draw researchers/client devs away from I/J prep.
flowchart LR
Glamsterdam[Glamsterdam<br/>Dec 2026] --> Hegota[Hegotá<br/>FOCIL + Frames]
Hegota --> Istar[I*<br/>PQ key registry]
Istar --> Jstar[J*<br/>MV-PQ milestone]
Jstar -->|9mo cadence, reorder pending| Kstar[K* or L*<br/>mandatory zkEVM proofs]
Jstar -->|7.2mo cadence| Lstar[L* or K*<br/>Full PQ / PQ attestations]Preconditions / Affected
Applies to Ethereum L1 client teams, validators, and anyone relying on withdrawal credential or transaction-signature security. BLS withdrawal credentials are affected by EIP-8365 retirement, which can start now independent of the full PQ consensus design.
What to do
No commands; this is a planning/roadmap document. Actionable items are timing-based: client teams should plan Hegotá implementation starting late Q4 2026; the deadline commitment itself is subject to reassessment in January 2027; stakeholders can submit questions ahead of the EF's Reddit AMA (r/ethereum, September 16, 2pm UTC) and should consult the companion "Hegotá EIP Opinion Post and Tier List" for per-EIP grading detail not contained in this post.
Caveats
The 7.2-month and 9-month fork cadences are described by the cluster itself as "quite aggressive" with "little room for error." MV-PQ's exact reduction in security guarantees is explicitly still undefined ("researchers are still defining exactly what that reduction in guarantees would look like"). The K/L fork-order swap (PQ attestations vs. mandatory proofs) is "in review," not finalized.
Organisations named here
- EIP-7805
- EIP-8250
- EIP-8272
- EIP-8365
- EIP-8369
- Hegota
- leanDA
- Q-day
Technologies named here
- FOCIL
- Ethereum L1
- Glamsterdam
- Frames
- EIP-8369 VOPS Profiles for FOCIL Eligibility
- Hegotá
- EIP-8250 Keyed Nonces
- secp256k1
- EIP-8272 Recent Roots
- leanDA sampling
- leanSPHINCS transactions
- Post-quantum public-key registry
- Ethereum
- EIP-8141
- LeanSphincs
Techniques named here
- Post-quantum migration / quantum resistance
- Minimum viable post-quantum
- Censorship resistance via inclusion lists
- Mandatory execution proofs / zkEVM progression
- Withdrawal credential retirement
Related in Blockchain

THORChain Exploit Report #2 — GG20 root-cause disclosure

Black Thursday revisited: MakerDAO keeper exploited for $500K
.jpg)