Anchor Vault combines Lamport one-time signatures with an ERC-4337 smart account.
Anchor wallets
Anchor Vault packages Lamport signing into a Chrome extension with ERC-4337 account abstraction. The original web wallet remains available for accounts on the Lamport contract.
Primary walletUse Lamport one-time signatures—or optional one-time ECDSA—through an ERC-4337 smart account. UserOperations are submitted through a bundler and EntryPoint.
Web applicationThe original browser interface for the Lamport-gated EVM contract. A connected EOA submits each call while the contract verifies the Lamport signature for the requested operation.
Wallet comparison
Compare account models, signing options, and transaction paths.
| Model | Anchor Vault | Web Wallet |
|---|---|---|
| Interface | Chrome extension | Web application |
| Account model | ERC-4337 smart account | Lamport-gated EVM contract |
| Authorization | Lamport or one-time ECDSA | Lamport one-time signatures |
| Transaction path | UserOperation via bundler and EntryPoint | EOA submits a contract call |
| Network gas | Paid through the smart-account flow | Paid by the connected EOA |
| Separate user EOA | Not required | Required |
How Lamport signatures work
A Lamport signature is built from random secrets and hash functions. The wallet reveals one secret from every pair, the contract checks those values, and the account advances to the next key.
For a 256-bit operation digest, the wallet creates 256 pairs of random 256-bit values: 512 secret values in total.
Each secret is hashed. The contract records a commitment to the resulting public key, without learning the secret values.
A 0 bit reveals the first value in its pair; a 1 bit reveals the second. Those 256 revealed values are the signature.
The contract hashes the revealed values, checks them against the committed public key, executes the operation, and retires that one-time key.
A four-bit example
Alice holds two random secrets for every digest position. Bob knows only their hashes. Four positions make each selection visible.
The digest is 1011. Anchor uses a 256-bit digest; the four-bit version simply makes every selection visible.
1s₁,₀Stays privates₁,₁RevealAlice reveals s₁,₁and keeps s₁,₀ private.
0s₂,₀Reveals₂,₁Stays privateAlice reveals s₂,₀and keeps s₂,₁ private.
1s₃,₀Stays privates₃,₁RevealAlice reveals s₃,₁and keeps s₃,₀ private.
1s₄,₀Stays privates₄,₁RevealAlice reveals s₄,₁and keeps s₄,₀ private.
s₁,₁ · s₂,₀ · s₃,₁ · s₄,₁1011.He hashes every value Alice revealed, then checks the public-key hash selected by the same digest bit.
H(s₁,₁)matches public-key slot (1, 1)H(s₂,₀)matches public-key slot (2, 0)H(s₃,₁)matches public-key slot (3, 1)H(s₄,₁)matches public-key slot (4, 1)A Lamport signature reveals half of one private key, so that key is used once. After an accepted operation, Anchor advances to the next key.
The long-term cryptographic choice
ECC falls to Shor. Lattice cryptography is a credible post-quantum route with more to assume. Lamport returns signing to random secrets and one-way hashes.
At cryptographic scale, Shor’s algorithm recovers elliptic-curve private keys in polynomial time. ECDSA is not a durable foundation for assets held across the quantum transition.
Lattice signatures are built to withstand quantum attacks, but their security rests on structured lattice problems and precise parameter choices. They are credible post-quantum cryptography with a broader assumption set.
Lamport signing depends on random secrets, one-time key discipline, and hash preimage resistance. Shor does not attack that foundation. That is why Anchor’s Lamport path is built for assets meant to remain in a vault for decades.
Grover cuts the exponent for generic hash search in half; it does not produce Shor’s polynomial-time collapse. For a 256-bit preimage target, that leaves roughly 2¹²⁸ quantum work.
Whitepaper · January 2023
William D. Doyle and Pierre-Luc Dallaire-Demers set out LAMB’s one-time-key model for blockchain accounts and its applications to digital assets and identity.
Frequently asked questions
Details on Lamport keys, account abstraction, fees, backups, and the two wallet interfaces.
Anchor Vault handles network fees through its ERC-4337 smart account, so users do not maintain a separate gas EOA. The bundler and EntryPoint complete the blockchain transaction flow.
No. MetaMask or another EOA relays transactions and pays gas. Moving assets from the Anchor contract still requires the Lamport authorization checked by that contract.
A signature reveals one secret from each pair. Reusing the key on another digest can reveal both secrets in some positions, giving an attacker material they can combine into a forged signature.
No. It provides hash-based authorization at the smart-account layer. Consensus keys, infrastructure, browsers, devices, token contracts, and any ECDSA path retain their own security assumptions.
Keep the newest web-wallet file after every operation. Anchor Vault exports also contain one-time-key counters, so backups must remain current. Pauli Group cannot recover lost keys or passwords.
The current extension applies a one-time US$35 software fee to its first pre-deployment operation. Network fees are handled separately through the ERC-4337 flow.
Lamport key state advances as you use the wallet. Save the latest wallet export offline, verify the domain and destination, and confirm a new setup with a small transfer.
Anchor Vault for Chrome
Install the extension to use Lamport one-time signatures with an ERC-4337 smart account.