EIP-8425: Quantum Freeze and Account Recovery

Continuing the discussion from Quantum recovery pathway.

Should we have an EIP for freezing and recovering unmigrated accounts, e.g., building on Vitalik’s quantum emergency recovery proposal? Preparing and testing implementations across clients in advance could shorten the emergency response time.

One concern is accounts with public keys exposed through published signatures whose owners have lost access. These accounts cannot migrate, and their funds could become accessible to quantum attackers. Do we have estimates of the value at risk?

Three possible components:

  1. A scheduled migration cutoff. After a predefined migration window, disable legacy ECDSA authorization for unmigrated accounts, covering both EOA transactions and relevant ecrecover-based paths, such as permits.

  2. An earlier emergency activation path. The EIP could define a QUANTUM_FREEZE_TIME parameter, unset by default, with the freeze rules implemented across clients in advance. Once proof of a practical quantum break is published and activation is agreed, node operators could set the same timestamp and restart their clients, activating the rules from the first block at or after that time.

  3. A recovery path for frozen accounts. Recovery could use a zero-knowledge proof of knowledge of the original seed or suitable derivation material, without revealing it, or a recovery mechanism committed to before the cutoff. The ECDSA private key alone would no longer prove legitimate ownership once quantum key recovery is possible. However, accounts whose private keys were generated directly, without a retained seed or suitable derivation material, may not benefit from seed-based recovery.

2 Likes

I’d prefer for the chain to not violate property rights and to leave lost wallets in the hands of the gods..

Realistically, first to quantum is going to be a well capitalized organization with government involvement, not a hacker.
Govs will salvage unmigrated coins, keep those which can’t be claimed (Satoshi’s etc), and return coins to those who can provide sufficed evidence of ownership (tax records, for example)

What makes a recovery commitment registered before the freeze trustworthy if the quantum break was already being used privately?

Suppose an attacker recovers an account’s ECDSA key and registers their own recovery mechanism before QUANTUM_FREEZE_TIME. That commitment would predate the cutoff but would not represent the original owner’s choice.

Would recent recovery registrations require a waiting period or independent proof of the original seed? How would you choose the trusted checkpoint when the first public demonstration may come after the first actual compromise?

Otherwise the recovery path could preserve an attacker’s control after legacy ECDSA authorization is disabled.

1 Like

Yes I think we should have the EIP. I believe the main thing to settle first is the recovery semantics. Sergeev’s example exposes the problem with treating a pre-freeze recovery commitment as authority: an attacker can compromise the ECDSA key privately, register their own recovery mechanism, and still get in before QUANTUM_FREEZE_TIME. The timestamp tells us when the commitment appeared; it does not tell us that the commitment represents the legitimate authority.

The way I would resolve this is to separate four things: freeze, evidence, resolution, and successor authority. The freeze is a deterministic containment boundary. It does not need to identify the exact block where the quantum compromise began, and it should not require a rollback.

Recovery is then a resolution of the frozen authority state. A recovery commitment, seed/derivation proof, historical credential, or other admissible record is evidence. It does not become authoritative merely because it exists or predates the freeze.

The recovery claim should bind the account, recovery epoch, recovery policy, evidence commitment, and proposed successor authority. The protocol resolves that state into a successor authority, contested claims, or unresolved authority. Only a resolved successor can execute, and successful recovery creates a new authority state while permanently disabling the legacy ECDSA path.

The invariant is: Once legacy ECDSA authority can be reproduced by a quantum adversary, no capability derived from that compromised authority can, by itself, establish successor authority.

Thanks @colinyguo for continuing this important discussion, and @TrentwilliamH for the clear property-rights perspective.

I support developing an EIP (or coordinated set of EIPs) that builds on Vitalik’s quantum emergency recovery ideas. Preparing and testing the freeze/recovery logic across clients before any practical quantum threat materializes is one of the highest-leverage things we can do to reduce coordination risk and response time.

Proposed framing for the EIP

The goal should be narrowly scoped:

1. Disable the quantum-vulnerable authorization method for unmigrated accounts once a clear trigger is met, and

2. Provide a recovery path that does not rely on the now-broken ECDSA private key, while minimizing permanent confiscation.

This keeps the protocol neutral on “lost” funds (they remain inaccessible unless a legitimate recovery claim succeeds) and avoids turning the chain into an active asset-reassignment mechanism.

Refining the three components:

1. Scheduled migration cutoff

A long, well-publicized window (multi-year) after which legacy ECDSA authorization is disabled for still-unmigrated accounts (EOA transactions + relevant ecrecover paths such as permits). This creates a clear migration incentive without relying solely on emergency activation.

2. Emergency activation path

Ship the freeze logic in clients with a QUANTUM_FREEZE_TIME parameter (unset by default). Once credible public evidence of a practical quantum break exists and rough consensus forms, operators can set the same timestamp. Activation occurs from the first block at or after that time. Pre-shipping and testing this path is far safer than writing emergency code under attack.

3. Recovery for frozen accounts

• Preferred: zero-knowledge proof of knowledge of the original seed / derivation material (without revealing it).

• Alternative: a recovery commitment (e.g., hash or post-quantum public key) registered before the cutoff.

Open questions that need data and discussion

• Value at risk: Do we have (or can we produce) transparent estimates of ETH sitting behind already-exposed public keys, and the subset whose owners have likely lost access? Better numbers would help size the residual problem and prioritize tooling.

• Activation criteria for the emergency path: what constitutes sufficiently credible “proof of a practical quantum break?

• Client testing plan: multi-client testnets exercising both the scheduled cutoff and the emergency freeze.

• Edge cases around permits, smart-contract wallets, and account-abstraction paths that still rely on ecrecover.

Suggested next steps:

1. Draft a concrete EIP skeleton covering the three components, activation rules, and recovery interfaces.

2. Request or produce updated measurements of quantum-vulnerable value.

3. Organize a short series of calls or a working group (clients, wallet teams, researchers) to pressure-test the design and recovery UX.

4. Keep the design explicitly temporary and recovery-oriented so it does not become a permanent protocol-level seizure tool.

This approach gives us technical readiness while respecting the strong preference many share against the chain actively violating property rights.

Nice point. I think we could distinguish two paths, using a conservative “safe deadline” separate from the freeze activation time:

  1. Before the deadline: Owners could register recovery commitments authenticated by their existing keys. I would expect community monitoring and reports to help uncover attackers who had secretly broken ECDSA and registered their own commitments (the account owner would be able to detect this and complain about it, or submit some other offline proofs). If evidence of an earlier compromise emerges, the safe day could be moved further back, excluding later registrations from this recovery path.
  2. After the deadline: Recovery would require stronger ownership evidence that recovering the ECDSA private key alone would not provide. For example, a zero-knowledge proof of knowledge of the original seed. The limitation is that accounts generated directly from private keys, without retained seed or derivation material, would not have access to this recovery path.

I think this shifts responsibility rather than resolving the underlying question. If a quantum disaster actually happens and is not “protected” by a good party, we might still need to discuss the fallback rules, and the cost of rollback is much higher than a predefined design. Leaving that to governments would move those decisions outside the protocol, but would not make them disappear.

Preparing the code and coordination framework in advance seems like a separate question. We can develop and test the mechanisms needed for a coordinated response while continuing to debate whether, when, and under what conditions they should be activated.

I agree with this framing. Encouraged by the initial feedback here on Magicians, I’m preparing an EIP draft to provide a minimal, extensible framework for further discussion.

Thanks! My reply above applies here as well.

Thank you for the valuable early feedback. I’ve opened a minimal EIP draft based on the discussion of this thread: Add EIP: Quantum Freeze and Account Recovery by colinlyguo · Pull Request #12383 · ethereum/EIPs · GitHub , feedback is welcome!

I think the draft is close enough now that the recovery semantics can be specified more concretely.

The main point I would change is the role of SAFE_RECOVERY_TIME. It is useful as an admissibility boundary for recovery commitments, but I do not think it should function as the authority boundary itself.

Sergeev’s example still survives any fixed cutoff if the attacker obtained the ECDSA key before that cutoff. Moving the timestamp earlier can reduce exposure, but it cannot change what the timestamp proves. It establishes when a commitment entered canonical state, not whether that commitment represents the legitimate successor authority.

I would make the recovery path explicitly:

FROZEN → CLAIMED → RESOLVED | CONTESTED | UNRESOLVED → SUCCESSOR

where only RESOLVED may transition the account into successor authority.

A frozen account should have a protocol-derived recoveryEpoch. A recovery claim should commit to at least:

chainId

account

recoveryEpoch

recoveryPolicy

evidenceRoot

successorAuthority

claimNonce

The important property is that the claimant cannot choose a replay domain that makes stale evidence valid again. The recovery epoch belongs to the account state and changes when the authority state changes.

I would define something equivalent to:

claimHash = H(chainId, account, recoveryEpoch, recoveryPolicy, evidenceRoot, successorAuthority, claimNonce)

Every recovery proof or commitment should be bound to that exact claim.

The draft’s two current recovery paths then become evidence classes rather than separate definitions of authority.

A pre-cutoff recovery commitment establishes that a particular commitment existed in canonical state before SAFE_RECOVERY_TIME.

A seed or derivation proof establishes knowledge of material that derives the affected account and is not recoverable merely from the exposed ECDSA key.

Additional recovery mechanisms can be added later, but each should specify exactly what predicate it establishes. None should implicitly mean “therefore this claimant owns the account.”

Resolution is the operation that decides whether the admitted evidence is sufficient to authorize the proposed successor.

I think the minimum outcomes should be:

SUCCESSOR(successorAuthority) — exactly one successor satisfies the recovery policy.

CONTESTED — two or more mutually incompatible admissible successor claims satisfy enough of the policy that the protocol cannot safely select one.

UNRESOLVED — no claim satisfies the recovery policy.

Both CONTESTED and UNRESOLVED should leave the account frozen. They should not fall back to first-seen, oldest commitment, largest evidence set, or legacy ECDSA possession.

Successful recovery should then perform one atomic authority transition:

A_n → A_(n+1)

with the following properties:

  1. A_n is the exact frozen predecessor authority state.
  2. The accepted claim is bound to the current recoveryEpoch.
  3. The installed wallet or native key is exactly the successorAuthority committed by the accepted claim.
  4. Legacy ECDSA authority remains permanently disabled.
  5. The recovery epoch advances.
  6. Claims bound to the prior epoch can never execute afterward.

I would also avoid making evidence mutable underneath a claim. If the evidence set changes, that should produce a new evidenceRoot and therefore a new claim identity. A corrected or expanded evidence state should not rewrite the old one.

SAFE_RECOVERY_TIME can then be specified narrowly:

it determines whether the recovery-commitment evidence class is admissible;

it does not determine which claimant is authoritative.

This also gives us a clean answer to the case where later evidence suggests compromise began before the selected cutoff. We do not need to pretend the cutoff was the exact moment of compromise. The cutoff remains a containment/admissibility parameter, while successor authority is resolved from the admitted recovery state.

I would add explicit consensus tests for at least the following cases:

  • attacker obtains ECDSA before SAFE_RECOVERY_TIME, registers a recovery commitment, then legitimate claimant presents independent derivation evidence;
  • two eligible pre-cutoff recovery commitments propose different successors;
  • valid seed proof and eligible commitment agree on the same successor;
  • valid seed proof and eligible commitment disagree;
  • claim uses the wrong recoveryEpoch;
  • claim is replayed after successful recovery;
  • claim changes only successorAuthority;
  • claim changes only evidenceRoot;
  • evidence is valid but insufficient under the selected recovery policy;
  • account has only the compromised ECDSA key and no independent recovery evidence;
  • recovery succeeds and an old ECDSA signature is subsequently presented;
  • recovery succeeds and an old recovery claim is subsequently replayed.

The invariant I would make normative is:

Once legacy ECDSA authority can be reproduced by a quantum adversary, no capability derived from that compromised authority can, by itself, establish successor authority.

A second useful invariant follows from it:

Every value capable of changing the successor-authority decision must either be committed by the recovery claim or explicitly defined as external to the consensus decision.

With those two invariants, the concrete ZK proof system, aggregation mechanism, and future recovery evidence classes can remain modular. We already have active work on alternative signature schemes and recursive STARK aggregation, so I would keep those as replaceable verification mechanisms rather than baking one proof construction into the authority semantics. EIP-7932 is designed around algorithm agility, and EIP-8288 is explicitly aimed at aggregating large PQ signatures and STARK proofs.

That would leave the EIP with a clean separation:

freeze = containment

evidence = what a claim can establish

resolution = whether the evidence authorizes this exact successor

successor transition = the only operation that restores execution authority

I think that closes the pre-cutoff attacker case without requiring us to know the exact moment at which quantum compromise first became possible.

Q-day breaks the scarcity of the ECDSA key. It does not give L1 a brief to reassign the account.

A freeze that can install a successor from seed-proof or a real pre-cutoff commitment is containment. A freeze that leaves everyone else in UNRESOLVED and then treats that bucket as burnable, treasurable, or permanently inert is not containment. It is a protocol taking. The chain has decided the residual owner is nobody, and it has done it in a way no off-chain fact can reverse.

That is the case I care about. Some accounts will have independent cryptographic evidence. Some will not. For the second set, the only remaining proofs of ownership live outside consensus: prior control of related keys, venue records, tax files, device provenance, long transaction graphs. None of those can spend a frozen account. None of those can move coins out of a burn. They can only be aimed at whoever actually holds the asset.

If you disable the last spending condition and refuse every non-protocol claimant, you have not preserved property rights. You have extinguished them for that set and called it neutrality.

I would not invent a court oracle on L1. I would not make KYC an evidence class. I would also not pretend that “leave it frozen forever” is the conservative option when the alternative is that the asset still exists in the ordinary world, where possession can be contested.

So the hierarchy I want is:

  1. Independent cryptographic evidence → successor.
  2. Contested cryptographic evidence → stay frozen until it isn’t contested.
  3. No cryptographic evidence → do not burn, do not treasury, do not create a protocol owner. Do not turn the broken key into a moral prohibition if the cost of that prohibition is that title can never be asserted anywhere again.

The attacker who can copy the key is a problem. The protocol declaring that the account now belongs to nobody, irreversibly, is a bigger one for anyone whose only remaining proof is not a seed. If we cannot prove a successor on-chain, we should not use the fork to prove there isn’t one.

“The chain has decided the residual owner is nobody.”

No. The chain has declined to manufacture execution authority where its resolution predicate cannot establish one. Ethereum already distinguishes what state transition consensus will accept from whatever legal or social claims humans may have about an asset. A frozen account can still have a claimant in the external world without that claimant automatically possessing an L1-valid authorization path.

A protocol refusing to authorize an unproven successor is not a protocol determination that no owner exists; and if an off-chain determination is ever supposed to restore execution, then you still need exactly the evidence → resolution → successor boundary I described.

Then we agree on the easy part. I don’t think those balances get burned. I think they sit, the disagreement is the freeze.

Once legacy ECDSA is disabled on an account that cannot present independent evidence, the asset is no longer in any world where an external claim can be executed. It is not with the original keyholder. It is not with a successor. It is not with a state that can seize and later release it. It is a balance the ledger will never move again. Calling that “declining to manufacture authority” is accurate. It is also terminal.

That is the case with no seed and no pre-cutoff commitment. Your resolution machine cannot ever fire for them. Freeze is not a pause. It is the last state transition those accounts get.

I would not put courts on L1. I would not make an unproven claimant a successor. I would also not take the last remaining spending condition off an account whose only possible future movement is that the broken key still works.

If the predicate can establish a successor, use it. If it cannot, leave the existing authorization path alone. Do not convert a set of accounts into permanent non-execution because the honest owner and the quantum copier look the same to consensus.

A frozen account with no possible successor is not a legal claim waiting for the world. It is an account the world can no longer touch.

So, am I asking to leave funds stealable?
Yes! For the no-evidence set, stealable-and-in-the-world is the only path that is not a grave.

1 Like

The terminality only follows if UNRESOLVED is defined as an absorbing authority state. It should not be. The missing distinction is between the authority epoch and a resolution attempt.

Freeze changes admissibility: once the legacy ECDSA credential can be reproduced by an adversary, it no longer authorizes execution. But freeze does not install a successor, erase the predecessor state, or erase the evidence associated with it. The account remains bound to the same frozen predecessor authority state until successor authority is actually established.

A resolution attempt should therefore be evaluated under an explicit recovery policy version. The claim binds the account, current authority epoch, recovery policy, evidence root, proposed successor authority, and claim nonce.

If the admitted evidence is insufficient, the result is UNRESOLVED under that policy. No authority transition occurs. If additional evidence later becomes available, or a later protocol version defines another admissible evidence class, that produces a new evidence root and a new claim under the applicable policy. It does not rewrite the failed claim, and it does not inherit authority from either the failed claim or the broken ECDSA credential.

So the no-seed / no-commitment case does not force the binary of “leave ECDSA live” or “put the account in a grave.”

It produces:

FROZEN
executionAuthority = NONE
resolutionStatus = UNRESOLVED
resolutionEligible = true

The account is non-executable under the current predicate. It has not been declared ownerless, burned, treasuried, reassigned, or permanently unrecoverable.

CONTESTED and UNRESOLVED do not advance the authority epoch.

Only RESOLVED(successorAuthority) performs the authority transition:

A_n → A_(n+1)

At that point the authority epoch advances, the resolved successor becomes executable, and legacy ECDSA remains permanently inadmissible. That gives the recovery framework one additional normative invariant:

Failure of the current resolution predicate to establish successor authority MUST NOT restore authority to a broken predecessor credential, and MUST NOT make future resolution impossible.

Future evidence can be preserved. Future predicates can be defined. But every successor must establish its authority under the admissibility conditions of the state in which it executes. Preserve evidence. Re-earn authority. Neither broken-key inheritance nor unresolved-state erasure.

The machine is clean. I am not asking you to restore ECDSA after a failed claim, and I am not asking you to advance the epoch on `UNRESOLVED`.

The remaining issue is the set that cannot meet any predicate this thread will write.

For that set, `resolutionEligible = true` is not a live path. The only plugs you will accept are seed-knowledge or a pre-cutoff commitment. If those do not exist, no later policy that stays cryptographic will admit the evidence that does exist. The account is non-executable now, and it is non-executable under every successor predicate you will allow. That is terminal in fact even if it is not absorbing in the state machine.

You can preserve evidence roots forever. You cannot preserve a spending condition the spec has already made inadmissible.

The account as created was: a valid ECDSA signature may execute. Freeze rewrites that to: nobody may execute until a later predicate says otherwise. For an account with no seed and no commitment, you have not paused authority. You have deleted the only condition the owner actually had.

Saying the chain has not declared the account ownerless does not answer that. I did not ask you to declare an owner. I asked you not to replace the authorization path on an account that cannot meet the replacement.

This set is not theoretical. Rain Lõhmus’s presale account is the public case: owner known, key gone, balance intact. Under this freeze he cannot execute and he cannot meet the predicates on offer. A later cryptographic class does not help unless the secret comes back. Rewriting the spending condition on that account is still a change to the wallet.

Consensus cannot tell a lost seed from an abandoned key. That is why you want a uniform freeze. It is also why a uniform freeze is not conservative. It takes the last executable rule off every account in that set at once.

Leave ECDSA live where no admissible successor can exist under any policy you will actually adopt. Freeze where one can. If you cannot distinguish those sets, that is an argument for not rewriting the condition, not for rewriting it for everyone.

Property rights here are the authorization path that shipped with the account. Changing it because the key is no longer scarce is a protocol choice. It may be the right choice for accounts that can re-earn a successor. It is not doing nothing to the rest.

1 Like

Then I think the remaining spec question is very small. If ECDSA remains executable for these accounts, the protocol needs to state explicitly what that means once the key is quantum-recoverable.

At that point, possession of the recovered secret is itself the execution predicate. If two different parties independently recover the same key, consensus has no additional information with which to distinguish them; transaction ordering determines which valid state transition executes first. So this should be an authority rule:

For accounts that remain ECDSA-executable after the quantum boundary, knowledge of the ECDSA secret remains sufficient authorization even when that knowledge may have been obtained after the break.

If that is the intended policy, I think it should simply be stated normatively. Then the two cases are completely defined: accounts covered by freeze require a newly admissible successor authority; accounts exempted from freeze continue treating ECDSA possession as authority. The important thing is not to let an implementation silently move between those two rules.