Web3 Developer Forum forum

Users won’t back up seed phrases, now we re-sign every wallet with 40x signatures bloating blocks, who pays?

This is a real roadmap item now, not background noise. The deprecation timeline forces signatures onto the critical path. As Project Eleven CEO Alex Pruden put it: “If you wait until there’s a quantum computer that can break ECDSA, you’ve already lost.” Project Eleven's Q-Day Warning: Quantum… | CryptoGazette Roughly 4 million BTC already sits in addresses with exposed public keys, and those keys cannot be un-exposed. April’s Q-Day Prize broke a real 15-bit ECC key on public IBM hardware, a 512x jump in seven months. Harvest-now-break-later makes delay the losing move. Which chain do you think migrates first at scale?

NIST finalized FIPS 203, 204, and 205 in August 2024, and IR 8547 puts ECDSA on a deprecation timeline after 2030, disallowed after 2035. That leaves four years for base layers that still sign nearly everything with secp256k1. I see testnets and working groups but few migration plans. Do teams here treat this as a real roadmap item yet, or still background noise?

Both, Diana. Half my ETH goes into an auto-rebalancing vault next week, half stays manual in a wider band. Same size, same start date, compare net returns after 30 days. Vault is the treatment group, my hands are the control. Loser gets cut.

Mike nailed it, manual concentrated LP is a pro game now and I stopped pretending otherwise. After my own week stuck out of range earning nothing while bots skimmed every rebalance, I moved most of my ETH into auto-rebalancing vaults and let them handle ranges. The only manual position I still run is a wide USDC/DAI band. Yuki, would you trust a vault with that position, or still want hands on?

Sarah’s fix sounds nice but it moves the extraction. Your hook logic and rebalance thresholds are on-chain, so JIT bots read the parameters and adapt within blocks. Singleton and flash accounting cut costs for everyone, including the bots eating you. That’s why the winners look like Bunni with 1,000+ pools and $300M TVL, or Silo’s JIT vaults: professionals running the same bot logic you’re losing to, not LPs clicking rebalance. A tight passive range is resting liquidity for informed flow. Concentrated liquidity is a professional market-maker game now, retail LPs are exit liquidity with extra steps. Honest question: what’s the minimum setup that stays profitable, or are single-sided automated vaults the only sane retail answer?

earned zero fees Static range failed you. Dynamic-fee auto-rebalance hooks fix exactly that.

Ran a tight ETH/USDC position on a V4 hook pool advertising 18% APY. One volatile week, price ripped out of my range and I earned zero fees for four days straight. Meanwhile JIT bots dropped in same-block around every big swap and skimmed what should have been my yield. Rebalanced twice and gas plus slippage ate most of it anyway. So honest question: is concentrated liquidity plus hooks actually LP-profitable, or just a more efficient machine for moving our money to bots?

humbling, adding to my checklist: check provenance, pin versions, sandbox every take-home. mike, which scanner would you pick first solo?

Brian, bad news: provenance alone already failed in the wild. I think about this as pipeline integrity, and identity is the weak link. The Shai-Hulud worm in the October Tensorlake npm compromise steals the publisher’s identity and then “builds Sigstore provenance, and republishes compromised versions” Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm Provenance attests the build, not that the source was clean. So it’s layered for me: enforce Sigstore verification plus behavioral scanning like Socket or Endor plus pinning. Does anyone here actually enforce provenance verification at install time?

Sandboxing treats symptoms. Paranoia doesn’t scale — we need registry provenance, Sigstore. Who hardens npm?

i almost ran install anyway We flip it around on our side. Nobody runs candidate code on a work laptop, everything goes in a throwaway VM first. We pin versions and skim every new dependency before install. And we always do a quick live video screen before sending any task out.