I choose balance. First-level balance. mi pinxe lo crino tcati https://xitter.twitterapi.xyz/t.co/gCQrmCby7P
Earth
Joined May 2011
- Tweets22K
- Following551
- Followers7.9M
- Likes12.2K
Expanding on why I believe "ETH as store of value (SoV)" makes much more sense to focus on than "ETH as fee-burning token".
Three primary reasons:
1. ETH as fee-burning token never was as strong as it seemed
2. Optimizing for ETH as fee-burning token would demand Ethereum and ETH function in ways that are very hard to make compatible with decentralization and capture resistance.
3. Meanwhile, optimizing for ETH as SoV is aligned with Ethereum focusing on its unique strengths (decentralization and CROPS)
EIP-1559 (including its burn) is fine and good, we should keep them. But we should not feel sad if fee burn is < 10% of breakeven indefinitely; the value of ETH comes from elsewhere.
The core idea: the big thing that people appreciate about Ethereum is decentralization and CROPS. The main pragmatic benefit that these things translate into is stability. SoV is the category where that is not an unneeded extra we merely put effort into for ideological reasons, but rather a pragmatic strength from the perspective of people putting in their assets. And in the era of AI disruption, stability will be highly valued.
# 1. ETH as fee-burning token never was as strong as it seemed
Let us re-cap the economic theory behind valuation of a fee-burning token. This is the "net present value" (NPV) theory.
Formula: market cap = fees burned / discount rate
Imagine you have a token of which $1 billion is burned per year, and this is a long-term stable equilibrium. Now, imagine the discount rate is 4%; that is, people value having $1B today as much as $1.04B in one year.
The idea is that $1B / 4% = $25B serves as a natural "floor" for the valuation: if the valuation drops lower than that, then someone could buy an asset expected to pay $1 per year forever for less than $25 (by buying some tokens, and then selling >4% of their supply each year so their share of the total pie remains the same), and so by buying the asset you reliably beat the market.
In 2021-23, Ethereum burned millions of ETH per year in this way.
But here's the problem: this was never a true floor. The reason is that the bulk of that burn was crypto-internal use cases. If ETH had dropped by 10x, then the profits from those use cases would have also dropped, because all the buyers would have had much less money to pay with. This applies both to things like that infamous $180m-fees-burned-in-one-day digital monkey sale (yes, this happened; if you don't remember look it up!), and to more "normal" things like lending. The floor argument only works if the backing of the revenue stream is external.
Today, Ethereum actually has a better claim to this external backing, because of the growing RWA economy, but on the other hand, perhaps precisely because it's a normal stable mature business, it's not going to randomly go crazy and burn $180m on a digital monkey sale.
I know this is a predictable opinion from me but I don't agree with the strong emotional reaction against the anti-data-center movements that I've seen this week.
As I see it, algorithmic progress means that whatever you would be able to do with more and bigger data centers in 2 years, you will be able to do with the data centers we have today in 4 years - probably sooner. So nothing remotely apocalyptically bad will happen from even extreme levels of success by anti-data-center people.
Meanwhile we need all the time we can get to better harden the world against both already-visible cybersecurity issues and any bio and other risks soon to come. Science applications are bottlenecked by many things other than AI, so slowing AI down by one year will slow those down by much less than one year.
Given this, a slowdown in compute hyper-scaling seems quite net good? Notice this is without any controversial "doomer arguments", RSI etc. Even if net-bad, it's certainly not worse than like 10+ other political things.
Just arrived in Mumbai!
Looking forward to seeing familiar faces and new faces and all the wonderful Ethereum and open/secure/private/decentralized tech projects that everyone is working on over the next week.
Digital minimalism
vitalik.eth.limo/general/202…
For anyone getting into biology, please consider taking airborne disease resistance more seriously.
It's a super important area of medicine that is a huge cause of death and sickness but easily gets forgotten. We're likely to get many more airborne plagues in the future due to the combination of not just extremely dense and interconnected society (including city and farm animals), but also accidents from bio research and offensive biotech (both from random people and from secret government programs that can easily get themselves exempted from safety restrictions), all enhanced by powerful AI.
Right now, this area is getting way less love than longevity research (which continues to be super important!), but it's an area where there are lots of unclaimed wins that we know exactly how to do (but are not yet doing) with present-day tech:
* early detection
* passive universal testing
* filtration/ventilation/UVC
* better vaccines (including making them open source and open science)
* cryptography to make all of the above privacy-preserving
We can have China-level pandemic resistance with Sweden-level limited intrusion into people's lives, and then go even further. We just have to actually do the work for it.
I am okay with Kimi 3.1 deliberately leaving out top-end offensive cyber capabilities from their training data.
Discriminating against use cases is MUCH less bad than discriminating against users. And the world does need all the time it can get to prepare, harden, check old code, (properly) formally verify new code, etc before the full weight of very powerful cyber attacks is upon us.
And if this first big wave of AI risk is not handled well, then we may well get a dystopia of highly locked down models, KYC gating on everything, highly intrusive surveillance on everything, a society where you may be a second or third or fourth-class citizen in terms of model access based on your credentials and nationality.
Ultimately, precompiles and EVM are both the wrong place to put most cryptography support into Ethereum. The reason is that precompiles and EVM both operate on data that has to be included into the ethereum chain somehow, which realistically means included in a block as calldata. That space is limited - even with PeerDAS and blocks-in-blobs, there's a practical cap of ~8 MB/s before it starts getting uncomfortable.
Remember: it's not a blockchain. It's a cryptographic world computer. Any data/computation that does not need to be in the "main thread" of data/execution should not be put into the main thread.
Instead, the correct solution is... EIP-8288 maximalism.
If you have any heavy computation that's self-contained, compute it and STARK it client-side (this is quickly getting faster and faster, even on phones), and push the STARK through the EIP-8288 recursive aggregation mechanism. The chain sees the fact that the computation was done and what the result is; it never needs to see the actual data and computation.
This way everyone can use whatever cryptography they want, the Ethereum chain can be lean, and we never need to add more precompiles again.
> we could still ultimately do Lattice stuff for accounts, wallets, etc. through a precompile if it is proved to be AI-secure
The ideal route to support everyone's cryptography is imo through 8288. You make whatever signature you want locally, then STARK it, and then it gets included through the stark aggregator machine. Don't need any calldata onchain. Ethereum can then never add a new precompile again.
Fun fact of the day: Bitcoin mining cost is split about 50/50 between compute capex and electricity. Meanwhile, AI inference is almost completely dominated by compute capex.
Wrapped zkAPI + Tor + extra cover traffic + local LLM prompt rewriting in an open-AI compatible daemon, and made a "paranoid mode" wrapper for my agent harness (pi):
Each conversation gets assigned a separate Tor circuit, your requests are masked with random cover traffic, zkAPI ensures you don't leak your identity through payments, and all prompts are locally rewritten (bring-your-own-local-model; I'm using qwen3.8-flash-next)
github.com/vbuterin/zkapi/tr…
My agent harness is wrapped with a bwrap sandbox (also experimenting with MicroVM) and wrapped again with torsocks, so everything it does goes through Tor.
Here's what me asking it to do a simple research task looks like.
It's getting quite usable! Though you definitely still pay quite a bit in increased latency, especially when starting a new conversation.
Also, Tor is far from optimal here for privacy; the cover traffic mechanism is okay against passive adversaries but much weaker if the LLM provider is colluding with the guard and actively manipulating timing. This kind of task really requires a more specialized mixnet, probably take the tradeoff of a higher bandwidth multiplier and built-in constant cover traffic.
Also also, much cheaper zkAPI deposit and withdraw gas costs are coming to mainnet soon.
Big congratulations to the @zksync airbender team for this milestone.
At this point, I consider the battle for speed to be definitively won, and the top priority for zkEVMs should shift fully to security.
To me that means formally verifying
(i) equivalence of the arithmetization to the ethereum spec
(ii) a hard maximum bound on (prover cost) / (amount of gas in block)
(iii) security of the proof system itself
firefly.social/post/x/211001…
For anyone who is either a fan of vaccines, or a critic of vaccines but open-minded to the idea that vaccines *could* be great if they were made with a more open-source open-science and public-spirited approach, I highly recommend checking out PopVax.
chronicles.popvax.com/p/popv…
firefly.social/post/x/210927…
Correction: for multisigs the ideal "safe" rule is that you want each signer to change their key after each operation.
(This is making an implicit assumption that ECDSA might become weak, but not to the point where any crack of it would be literally instant so you would literally have to worry about eg. in-mempool frontrunning)
You definitely still want to gather sigs offchain if possible, to minimize the number of hours between "sig revealed" and "key no longer active"
But again: it's very easy to lose funds from a misconfigured rushed upgrade, so ... don't rush anything.
I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.
The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.
(and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation)
So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math.
The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be?
This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-.
For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption.
And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10.
To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety.
And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all.
Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems.
For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size).
Concrete TLDR, my own personal views:
* Hash-based > lattice-based, in those situations where hash-based is possible at all
* For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ...
* For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism.
* If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**.
* For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"
firefly.social/post/x/210783…
I don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.
The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices.
(and it's also another reason, along with quantum, why ECDSA might fall even faster than expected, hence the "fresh address" recommendation)
So far most people have been in the mode of thinking "elliptic curves broken, hashes safe, lattices safe". But there is a good chance that the concrete security of lattices will take serious hits from the next two years of AI math.
The basic threat model is: factoring is something that naively takes 2^(n/2) time, but over decades smart people have found and optimized number field sieves, and degraded that to 2^O(n^(1/3)), which is why RSA keys and signatures need to be ~400 bytes (and not 64 bytes). What if there are skeletons in the closet like that, both for elliptic curves and lattices, that we are simply not smart enough to discover - but bots soon will be?
This is a major part of the reason why for the past year ethereum's lean roadmap has been going in the "hash-only" direction: no lattices, no ML-DSA, no Falcon, no lattice-based commitments inside ZK proofs, etc. Signatures in lean ethereum are all hash-based, either WOTS or SPHINCS-.
For signatures and proofs, we already know how to go hash-only. The bigger challenge is for *public-key encryption* - and this goes far beyond blockchains. Secure communication, anonymizing protocols, lots of things need public-key encryption.
And unfortunately there are long-standing mathematical theorems showing why public-key encryption cannot be done with hashes alone. You have to have some kind of trapdoor object that has at least one form of usable "structure" - either group theory (incl. isogenies) or lattices or code-based or potentially in the future even more newfangled and spooky things (local mixing?). But for anything that has structure, you should assume that AI will make at least some progress in breaking that structure. Here, one reasonable inference is that if you want to make something plausibly long-term secure, multiply the key sizes by 10.
To me that's a very plausible world and something not at all extreme to predict. If AI will bring us 50 years of math in 2 years, then that 50 years of math may very plausibly include a "naive factoring -> GNFS" level of improvement to our ability to break lattices. In that world, lattices will still exist, but they will have to be significantly bigger to guarantee the same level of safety.
And at those new larger sizes, hash-based constructions will beat lattice-based constructions on concrete efficiency in every use case where hash-based constructions are possible at all.
Theoretically, of course it's possible that hashes are broken too (eg. P = NP would imply that). But I think P = NP is very unlikely. And intuitively, it's much more likely that a mathematical object has exactly no exploitable structure (like hashes are intended to), than that a mathematical object has exactly ~3 forms of exploitable structure (for elliptic curves: associativity, Schoof, pairings) and not some secret fourth form of structure we have not yet discovered that greatly degrades its security (for elliptic curves, ECDLP and pairing security). Similar for LWE, SVP, RLWE and the zoo of lattice problems.
For this reason, we do not yet see any reason to worry and start padding the byte size of hashes (if we start to worry more, we would pad the round count first before doing anything to the byte size).
Concrete TLDR, my own personal views:
* Hash-based > lattice-based, in those situations where hash-based is possible at all
* For anything lattice-based, be much more paranoid on param sizes. Remember that blockchains are only a small portion of the cryptography story; this point goes far beyond blockchains and applies to eg. access to websites, secure messaging, Tor / VPNs ...
* For privacy protocols, strongly favor NOT putting encrypted notes onchain. Instead, send them offchain through some third-party mechanism.
* If it's not difficult for you, keeping your funds in addresses which have not yet been used to make a transaction is a good idea. If it's easy for you, do it. **But be careful about migrations; I personally have lost more money in botched migrations than I have lost in all hacks combined**.
* For multisig wallets, doing confirmations offchain is better than onchain, because this way the signatures of signer wallets do not get exposed to the public, so if ECDSA falls to AI much faster than expected, at least the multisig "gracefully degrades" to a 1-of-1 where the 1 is whoever was gathering the signatures - a much better place to be than "anyone can take the money"
firefly.social/post/x/210783…
Nethermind continues doing excellent work and making Ethereum more efficient and faster.
firefly.social/post/x/210738…
Doing a bit of a self-experiment.
Goal: use my personal health and travel data to provide personalized diet and exercise recommendations for me, using frontier models but in a way that avoids leaking to them any private information.
Strategy: use a local model (Qwen 3.8 Flash Next) to orchestrate, and use powerful remote models as a tool call to benefit from higher-level thinking and knowledge that the local model does not have.
Three-layer approach to privacy:
Avoid leaking personally identifiable information, or leaking my identity through writing style -> local model writes the queries to the frontier model, not me
Avoid leaking who I am through the payment channel -> zkAPI
Avoid leaking who I am through networking / IP -> Tor
You need all three (and finally we have all three, at least to some extent)
A skill file teaches the local model when and how to construct minimally-data-revealing requests to remote models. Use zkAPI-wrapped-with-Tor as a CLI tool.
And everything works! I got the recommendations back, info from frontier models helped to improve them.
Main deficiencies:
* Tor is really not optimized for request-by-request de-linking, which is the only form of network-layer privacy that really makes sense in today's world (long-running identifiers are too fragile). Probably not private enough, and latency 10-100x higher than it could be, at the same time.
* The skill file's request construction strategies are definitely far from optimal.
* Qwen 3.8 Flash Next is still too slow for comfort. It's comfortably running at 20-30 TPS, but it would only really start to feel fast at 100+
* There is a tradeoff: the more careful you are about what data you give to a remote model, the less it can help you
github.com/ethereum/zkapi/pu…
Lean consensus will be amazing.
One step closer to 4-8x faster Ethereum finality!
It took some time and lots of tokens, but we now have a formally verified proposal for a decoupled consensus protocol in I* (a future Ethereum upgrade)! Not yet a full spec (up next), but it includes all the key consensus-relevant details to become one.
Since Ethereum aspires to be live without most of the stake online, the protocol involves many more components than a normal BFT protocol, and its correctness involves much more than standard safety and liveness. Those nuanced properties are now verified!
What's more, I came away convinced that all protocol design will involve AI-assisted Formal Verification in the future, both for correctness and iteration speed.
The work wasn't limited to just:
Design the protocol -> Formally verify it
Instead, the loop became more like:
Design -> Formal Model -> Find exactly what breaks and why -> Redesign it.
For a fairly complicated protocol like this one, I think having the Lean model be part of the design loop played a big role in accelerating the process.
A future with agents paired with formal models is a superpower for Ethereum development, because they can then use those models to find exactly where an argument breaks down, formalize counterexamples, test proposed fixes, iterate on the protocol.
Many details that would slip under the radar when asking agents (and indeed, humans) can now be specified exactly and checked by the Lean kernel. This then forces agents to be more precise and lets them make verifiable progress on their own. It's been incredible to see this play out, seeing agents find gaps and propose protocol changes to fix them.
In other words, autoresearch can speed up protocol design, formal verification is here to stay, and Ethereum Finality will get faster.
The cryptographic world computer:
vitalik.eth.limo/general/202…
My attempt to express in somewhat concise terms the true meaning of basically everything planned to happen to Ethereum starting from the fork after Hegota. It's really not just a blockchain anymore. It's a hybrid architecture that combines together blockchains and modern cryptography, to enable much more powerful properties.
FOCIL, EIP-8288, Lean consensus, state management, formal verification, advanced mempool improvements (including privacy), and the longer-term specter of obfuscation all mentioned.
It's an underappreciated triumph of Ethereum client developers that PeerDAS has now been running for nearly a year with basically no problems.
PeerDAS was a complex task: it's the first large-scale instance of a blockchain that achieves consensus on the availability of data without needing any single node to download the entire block. Decentralized consensus without replication.
And yet, it worked.
Testing out some of the mobile offline local knowledge apps that people have been trying to build
(see here poidh.xyz/mainnet/bounty/31 )
Definitely getting much better than the one I tried to build myself 2 months ago. But also still much slower and less effective at difficult questions than the models that can run on a laptop.
It's weakest at specialized travel-related queries (eg. my eval is "Tell me the best vegan restaurants in [city I am currently in]", unfortunately none of these performed well on that)
Looking forward to seeing these continue to improve! I hope we can soon get to the point where you can comfortably look up any facts about the world that you care about without needing to access the internet at all.
