From a wallet support perspective, the notice problem matters whichever default is chosen. Most people will never read an EIP thread; if they hear about a cutoff at all, it’ll be through their wallet. A clear in-wallet warning well ahead of time (whether the account is affected, what to do, and by when) would reach far more owners than announcements alone, though it can’t help anyone who has already lost access.
1 Like
If we take that approach, EIP-8298 could provide the opt-in migration path, while assets controlled by lost keys would remain exposed to quantum attackers after Q-day.
The key question, then, is the total value of assets that could become accessible by recovering lost ECDSA private keys whose public keys are exposed, including through ecrecover-based authorization paths. Could the subsequent sale of those assets materially affect the market? Do we have any estimates?
Yes. EIP-8298 is the opt-in path. An account that can still sign migrates, adopts code, and disables ECDSA. That is the rule for everyone who can act.
The market question mixes two sets. One is live holders who have not migrated yet. They can still move, including under 8298, before the boundary. The other is keys that are already lost. Those cannot opt in, cannot opt out, and cannot answer a notice. Leaving them on ECDSA is not a failure of the migration path. It is the residual of accounts that path cannot reach.
We do not have a clean estimate of that residual. Conor Grogan’s lost-ETH figure is about 913k ETH from bugs, typos, and permanently locked contracts, and he is explicit that it undershoots because it does not cover lost private keys. Exposed-public-key is a different number: essentially every EOA that has ever signed, which is most of the ETH that has moved. That is not the lost subset. Dormancy is not proof of loss. Do not price a seizure off a number we cannot measure.
A later sale of recovered coins could move the market. So could a freeze that rewrites the spending condition on every silent account. That is a protocol seizure of the residual set, and the market will price it as one. Price impact is not a reason to rewrite the condition on accounts that cannot consent. Live holders take the 8298 path. The silent set keeps the predicate it shipped with. Ordering decides who spends. No later policy moves that set into the freeze because someone estimates the dump would be large.
1 Like
Thanks for the thoughtful analysis. I agree that some of these quantities are difficult to measure or even estimate reliably.
Opposition to a freeze is one position in an open debate. That disagreement strengthens the case for preparing a contingency plan that takes different community views into account.
We can still keep an EIP open for discussion now, gather feedback, and prepare a well-specified option. Whether to activate it would remain a community consensus decision. That seems preferable to scrambling for a response or doing nothing after Q-day arrives: the community would have a switch ready and could decide whether to flip it, rather than starting an emergency sprint.
Agreed on the process. Better to have a switch than to invent one after the break. The content of the switch is the part that is still open.
Opposition to a default freeze is not just a view to be noted. It is a second rule that has to be written if the contingency is real. Two options, both normative, both ready:
- Freeze. Unmigrated accounts go to executionAuthority = NONE. Only an admissible successor restores execution. EIP-8298 is the pre-boundary opt-in to this path.
- No freeze for the silent set. Accounts that never opted in stay on ECDSA possession, however obtained. Ordering decides. No later policy moves them into (1) because a notice was imagined.
The community can choose which to activate. It cannot choose if only one is specified. A draft that only contains the freeze, with the residual set left as “hard to measure, decide later,” is a freeze with a comment, not a contingency that takes both positions into account.
So keep the EIP open. Specify both rules in it. Make activation a choice between them, not a choice of whether to turn the freeze on. The silent set cannot answer a cutoff and cannot meet a cryptographic successor class. Its rule has to be written before the community is asked to pick.
I see no conflict here. No freeze simply means not activating the freeze mechanism, though we can refine this into more granular activation switches later. The rationale for both positions can be documented in the EIP as clarifications and considerations.
1 Like