Commit-Reveal Post-Quantum Authorization for EVM Accounts: The Binding-Completeness Problem under Account Abstraction, and a Front-Running Game

A cryptographically relevant quantum computer would break the elliptic-curve signatures authorizing transactions on every major blockchain, and standardized post-quantum signatures are expensive to verify on-chain. This manuscript gives the first rigorous systems treatment of hash-based commit-reveal authorization, a signatureless alternative whose security rests on hash preimage resistance (only dented by Grover, not broken by Shor). We build it as a real EVM account; prove a front-running theft bound (beta^a under i.i.d. builders, with a matching Markov-builder bound for realistic block-production concentration); measure it against production post-quantum verifiers and two years of real Ethereum fee data; and carry it into account abstraction, where we identify and systematize the binding-completeness problem (moving authorization into a signatureless account-abstraction transaction enlarges rather than shrinks the trust the account must discharge), with a taxonomy of six account-draining failures, each with a proof-of-concept and a fix. We deploy the account under native account abstraction on the public zkSync Era Sepolia network as an on-chain existence proof with no ECDSA on the authorization path. All artifacts (contracts, tooling, simulator, benchmark harnesses, on-chain receipts, and the base-fee dataset) are open source and drift-checked in continuous integration at https://github.com/amarshat/quantum-commit-authorization