Governance

Folding vs full-verifier recursion for PQ signature aggregation in leanVM: measurements and negative results

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 08/11/2026, 12:43:25 UTC.

Briefings

A study on leanVM-based post-quantum signature aggregation found that folding verifications directly or using hash-based accumulation (WARP) does not beat leanVM's full-verifier recursion. The research measured CPU cycles, latency, and memory usage on an 8 GB M2 machine running leanVM at commit df7d122. Key findings include that verifying one child inside a merge costs 186.8k VM cycles, while folding signatures requires at least 7.1M R1CS constraints, making it significantly slower. The study also found that batched child openings save 17.6% but still lagged the baseline by 2.4% at the slot deadline. The work provides a detailed cost anatomy of the leanVM process, including specific cycle counts and hardware constraints.

Key points

• Verifying one 250-signature child inside a merge costs 186.8k VM cycles with 55% of that time spent on WHIR openings.
• Folding leanXMSS verifications directly requires at least 7.1M R1CS constraints, which is approximately 450x the per-signature cost of leanVM.

Context

This research investigates whether hash-based accumulation methods can replace recursive proofs in leanVM for Ethereum's post-quantum signature aggregation. The study compares full-verifier recursion against folding verifications and hash-based approaches, using a low-end M2 aggregator to measure performance under specific constraints defined by EIP-8292.

Limitations

The study is limited to a single aggregator configuration on an Apple M2 machine with 8 GB RAM. Results are inferred from measured WARP rates and cost models rather than direct empirical verification across different hardware or configurations. The research does not account for swap usage or other system-level factors beyond the specified machine environment.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 08/11/2026, 12:48:00 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeifdpike4qkfblsykv2jhhbgsbplajfdaqsbfj2sl6cvpfeut2qgui