PQ-Vault: Provably Quantum-Safe Asset Custody for Unmodified Ethereum

What it is

PQ-Vault is a custody design from Khodaiemehr, Bagheri and Feng (UBC Okanagan), posted to arXiv on 21 October 2026 as v1 and submitted to IEEE TDSC. It holds assets in an Ethereum contract released only by ML-DSA and hash checks, backed by a PQ proof-of-stake sidechain. It needs no change to Ethereum (L1). An open artifact with a Solidity vault and real certificates is cited.

How it works

The paper first proves that any protocol leaving L1 rules unchanged cannot protect an asset still spendable by an ECDSA key whose public key is on chain (Proposition 2). L1 validity depends only on the ECDSA predicate, so a quantum attacker's transaction cannot be told apart from the owner's. The corollary: the asset must sit under a contract predicate that rests only on PQ assumptions and L1 integrity. An EOA delegating to contract code via EIP-7702 stays ECDSA-controlled and is not protected.

Three further results shape the design:

• Certificate parameters. Classical compact certificates set k_rev = ⌈(λ + log2 q)/log2(Ws/Wp)⌉. Under quantum queries the paper's rule is k_rev = ⌈(λ + 2·log2 q + κQ)/log2(Ws/Wp)⌉, with design bound q = 2^64. With classical parameters only about 60 bits are provable, and the paper gives an attack at 2^-81. The verifier also checks that every revealed leaf covers some coin and every coin is covered.
• Leader election. In hash-chain PoS where the next seed depends on the proposer, a leader can steer the seed by skipping, and splitting stake pays. The steering gain for m split identities at stake fraction α is mα/(1 + (m−1)α). The fix is commit-reveal epoch seeds with random reveal order and fallback proposers. At α = 0.3 the per-epoch failure probability is below 2^-40.
• L1 acceptance. A Groth16 wrapper to cut gas is not PQ (Theorem 17), so the vault uses optimistic checkpoints with single-reveal fraud proofs that need one signature check.

Preconditions / Affected

The paper states these assumptions:

• ECDSA key recovery takes longer than the L1 inclusion delay (A3). This is needed only for transactions that expose an ECDSA key, such as deposits and challenges from fresh EOAs.
• At least one honest watcher is online whenever a proposal is pending (A4). It must fetch certificate records within a set window and pay a challenge bond.
• Corrupted plus offline validators hold under one third of stake. Corruption takes effect three epochs after request.
• Unbonding releases stake only after the vault finalizes a checkpoint whose next attestor set excludes that validator.

What to do

For an engineer weighing options, the paper's cost comparison is the decision input. A contract account verifying ML-DSA or Falcon per operation costs 1.3 to 8.2 million gas per operation (Table 8). PQ-Vault costs about 100,000 gas per exit plus about 420,000 per shared checkpoint. Certificates for 2^8 to 2^16 validators use Dilithium (round 3), with a FIPS 204 cross-check. At 65,536 validators a certificate is 0.8 MB, 260 times smaller than all signatures, and verifies in about 20 ms.

Anyone building compact certificates on classical parameters should check them against the quantum reveal rule above.

Caveats

This is an unreviewed preprint. The fetched text ends early in Section 5, so the dispute protocol, the full Section 8 assumptions and the evaluation tables were not seen here. The custody guarantee depends on the watcher assumption A4 and on the slow-attacker assumption A3. Funds in ECDSA-controlled accounts must move into the vault before Q-day, since nothing external can protect them afterward.