LayerZero's Aerie announcement, as it currently exists in the public record, consists of a handful of claims and no measurements at all. No signature size. No batch threshold. No verifier cost, no gas figure, no repository, no paper, no audit scope, no testnet address. Trade coverage describes the system as delivering "efficient signature aggregation" that "may accelerate adoption" and "could enhance scalability and accessibility." Four adjectives, three hedges, zero integers. For a proposal whose entire value proposition is a ratio โ bytes in, bytes out โ the missing ratio is not a formatting oversight. It is the entire argument.
I have sat on the other side of this desk long enough to recognize the silhouette. In late 2017 I reviewed an ERC-20 launch called EtherGem โ a junior analyst contract, nothing glamorous โ and found three arithmetic overflow paths in its voting mechanism with a few hundred lines of Python. I filed them with the team. The token ran 400% anyway. Three months later the same overflow paths were the drain vector. Code compiles, but context reveals the exploit. The lesson was never "audit more," which is what everyone says. It was that a claim without a number cannot be audited at all, and the absence of measurement is itself a finding.
Start with the physical problem, because unlike the announcement, it has dimensions. An ECDSA signature on secp256k1 is roughly 64 bytes in compact form. A BIP-340 Schnorr signature is 64 bytes. A BLS12-381 signature is 48 bytes and, crucially, an aggregate of ten thousand of them is also 48 bytes. Post-quantum signatures do not behave like this. ML-DSA-65 โ FIPS 204, derived from Dilithium3 โ produces a 3,293-byte signature against a 1,952-byte public key. Falcon-512 lands near 666 bytes with an 897-byte key, at the cost of floating-point sampling routines that are notoriously difficult to implement in constant time. SLH-DSA-128s โ FIPS 205, the SPHINCS+ lineage โ runs about 7,856 bytes per signature against a 32-byte public key. That is a 50x to 120x expansion over the curves we actually deploy today.
On a single chain, 3.3 kilobytes per signature is an annoyance: block space is expensive but finite, and you amortize. In a cross-chain messaging layer, it is structural. Verification is replicated. A message attested once on Ethereum is re-verified on Arbitrum, on Base, on Optimism, on Polygon, on BNB Chain, on every endpoint in the mesh, and each of those verifications consumes calldata, compute, and storage on a chain that charges for all three independently. LayerZero V2 made this worse by design and by intent โ the Decentralized Verifier Network model deliberately lets each application configure multiple independent verifiers, which is the correct security decision and also a multiplication of attestation payload by DVN count. Two DVNs and a post-quantum attestation is not a 50x cost increase. It is 100x, before the executor moves a single byte.
That is the backdrop against which "efficient signature aggregation" is being sold. To be fair to LayerZero, the direction is not stupid. The team that shipped endpoints to well over a hundred chains and launched ZRO in June 2024 through a proof-of-donation mechanism โ roughly $0.10 per token to Protocol Guild, some $18 million raised โ is not a team that struggles with distribution. The competitive set is Wormhole's nineteen-guardian network, Chainlink's CCIP DON, Axelar's proof-of-stake validator set. All four are competing over the same shrinking pool of bridge fees in a market that has spent eighteen months repricing risk downward. In that environment, a security upgrade that raises marginal cost per message is not a marketing win. It is a liability until proven otherwise.
So let's do the work the announcement did not.
The reason BLS aggregation works is algebraic, not engineering. BLS lives on a pairing-friendly curve where the signature is a single group element and verification is a bilinear map; sum the group elements and you have an aggregate whose verification is one pairing check regardless of participant count. That property is a gift of the curve's structure. Post-quantum schemes do not have it, and the reason is not that nobody has tried.
ML-DSA is a Fiat-Shamir-with-aborts construction over module lattices. A signature is a pair (z, c) where c is a challenge derived from hashing the message and a commitment, and z is a short vector of polynomials over Z_q with q = 8,380,417. Verification recomputes Az minus ct, checks that the result matches the commitment under the hash, and checks the norm bound on z. There is no homomorphism here. Two valid ML-DSA signatures do not combine into a third valid signature, and no amount of clever engineering will make them, because the norm bound that provides the security is exactly what breaks under addition. SLH-DSA is worse for aggregation purposes: it is hash chains and Merkle trees all the way down, deliberately stripped of algebraic structure precisely so that it survives the collapse of every structured assumption. That is the point of it. It is also the reason you cannot add two of them together.
Which leaves three real routes, and the choice between them is the entire technical content of Aerie, and none of it was published. Route one is a lattice-native multisignature โ a threshold or aggregate ML-DSA variant. These exist in the literature and are not fantasy, but they are research-grade, their security proofs are subtle in ways that have burned people before, and I am not aware of a production deployment carrying meaningful value. Route two is recursive proof compression: verify the N signatures inside a succinct proof system and post the proof instead of the signatures. Route three is Merkle batching with a challenge window, which compresses nothing but amortizes the number of on-chain verifications.
Here is where the pitch runs into a wall, and it is the wall I would want a technical lead to address before anything else.
Recursive proof compression and post-quantum security are in direct tension, because the dominant proof systems are themselves broken by the same quantum algorithm they claim to defend against. Groth16 and PLONK over BN254 or BLS12-381 rest their soundness on the discrete logarithm problem and, in the Groth16 case, on a trusted setup. Shor's algorithm breaks discrete log. An aggregator that wraps ten thousand ML-DSA signatures in a Groth16 proof has produced an artifact whose unforgeability depends on exactly the assumption those ML-DSA signatures were chosen to avoid. The quantum vulnerability did not disappear. It migrated upward, consolidated into a single point of failure, and in the trusted-setup case acquired a second one. This is not a subtle observation and it is not hypothetical; it is the first question any cryptographer would ask, and the trade coverage contains no answer to it.
The alternative is hash-based recursion โ FRI, STARKs, transparent setups, collision-resistant hashing as the only hardness assumption. That is genuinely post-quantum-plausible, and it is almost certainly where a serious effort would land. It is also expensive in a way that inverts the value proposition at realistic batch sizes. Verifying a single ML-DSA signature inside an arithmetic circuit means implementing number-theoretic transforms over a 23-bit prime field, plus the rejection-sampling loop, plus the norm checks. That is not a small circuit; it is tens of thousands of constraints per signature with the NTT dominating, and STARK proof sizes for circuits of this class run from tens of kilobytes into the hundreds while prover time is measured in seconds to minutes per batch on commodity hardware.
Run the arithmetic. At N = 1, the raw payload is 3.3 KB and the aggregate is strictly worse. At N = 100, the raw payload is about 329 KB; a STARK attesting to a hundred lattice verifications plausibly lands in the same order of magnitude once proof size and public inputs are counted, and the prover has consumed a minute of CPU that somebody has to pay for. At N = 10,000 the crossover is real โ roughly 33 MB of raw payload against a proof in the low hundreds of kilobytes โ but now the prover runs for hours and the aggregation window has introduced a latency and liveness surface that did not previously exist. Somewhere on that curve there is a number that decides whether Aerie is a breakthrough or a rounding error. It is the single most important figure in the proposal. It was not published.
There is a second cost that gets lost in the aggregation framing, and it is where the marketing claim actually inverts. The stated benefit is scalability and accessibility. But post-quantum attestation does not only cost the destination chain; it costs every relayer, every DVN operator, every indexer, and every light client that wants to verify the message path independently. A mobile wallet that can check a 48-byte BLS aggregate today cannot check a 3.3 KB ML-DSA signature plus a public key on a phone without a measurable battery and bandwidth penalty. Raising the verification floor is a scalability improvement for the protocol's block space and an accessibility regression for everyone at the edge of the network. Both can be true. Only one was in the announcement.
What would settle this is not a whitepaper of adjectives. It is one table: N in rows of 1, 100, 1,000, 10,000; columns for aggregate byte size, on-chain verification gas, prover wall-clock seconds, and the underlying primitive with a named security reduction. Add the NIST designation โ FIPS 204, FIPS 205, or FN-DSA, which is still in draft โ because naming your standard costs nothing and buys enormous credibility. Add the audit scope, naming the proof system and the circuit specifically, because "audited" against a Circom circuit and "audited" against a lattice implementation are not the same sentence. Code compiles, but context reveals the exploit โ and the context here is which assumption the aggregate actually rests on.
Now the part where the skeptics, including me, are probably wrong.
The strongest argument against my own position is the timeline, and it cuts against the reflexive "quantum isn't imminent" dismissal. NIST's IR 8547 draft puts deprecation of RSA-2048 and the elliptic curves at 2030 and disallowance at 2035. CNSA 2.0 asks national security systems to be fully migrated by 2033. Those are not research horizons; they are procurement deadlines, and they are close enough that a protocol deploying immutable endpoint contracts across a hundred-plus chains in 2026 is not early. It is barely on schedule. Migration of a cross-chain messaging layer is not a code change. It is a coordination event across every integrator, every DVN operator, every bridge that reads the endpoint, and coordination events of that size have historically taken longer than the cryptography.
The second point the bulls have right is subtler and almost nobody makes it. Harvest-now-decrypt-later is usually discussed in terms of encryption โ capture the ciphertext today, decrypt it when the machine arrives. Signatures get dismissed because a forged signature tomorrow does not retroactively change yesterday's state. But public chains archive everything, permanently, and that includes every attestation ever signed. A cross-chain message signed in 2026 under a quantum-vulnerable scheme is a message whose authenticity can be forged in 2040 by anyone holding a cryptographically relevant quantum computer, and the historical record of it will still be sitting on a hundred chains. Whether that matters depends entirely on whether any future system ever treats historical attestation as evidence โ and in a market that has spent four years building fraud proofs, challenge windows, and retrospective slashing, the answer is uncomfortably likely to be yes. Post-quantum readiness in a messaging layer is not only about future messages.
The third concession: publishing nothing may be rational. A team mid-research on an unproven construction has every incentive to say "efficient aggregation" and nothing else, because the alternative is publishing a crossover table that shows the thing does not pay for itself below N = 500. Silence is a defensible strategy for a research program and an indefensible one for a product announcement. LayerZero did the latter.
So here is the accountability ask, and it is deliberately narrow. Publish the crossover point. Not the roadmap, not the partnership list, not the phrase "efficient aggregation" in a second language. One table, four rows, four columns, primitive named, security reduction stated. It is a week of work for a team that has already done the work, and it converts a press release into a benchmark the entire cross-chain sector will be measured against for the next decade.
That is the actual prize, and it is larger than the token. The first protocol to publish a reproducible post-quantum benchmark for cross-chain attestation does not merely win an argument โ it writes the comparison that every competitor, every auditor, and every institutional procurement committee will use for years. Wormhole, CCIP, and Axelar will all be graded against whoever publishes first. LayerZero has the distribution to be first and has, so far, chosen to be quotable instead.
The compression paradox is not a fatal flaw. It is a design constraint that any honest post-quantum aggregation scheme has to pay, and paying it deliberately is a legitimate strategy. What is not legitimate is asking the market to price a ratio nobody has been shown. Until the number exists, Aerie is a direction, not a deliverable โ and in a bear market where the marginal bridge fee is the only revenue line that matters, a direction does not secure a message.