Today we’re sharing two new papers from LayerZero researcher Giuseppe Vitto on Poseidon, one of the most widely used hash functions in zero-knowledge proving systems, including protocols the Ethereum Foundation has been evaluating for future use in post-quantum signature aggregation. This research identifies structural weaknesses in Poseidon, resulting in the ability, under certain circumstances, to control the output of the hash function.
This research tackles challenges posed by the Ethereum Foundation’s Poseidon Cryptanalysis Initiative, established to pressure-test the security assumptions behind Poseidon. The findings were submitted to the initiative; the Ethereum Foundation has since announced moving away from Poseidon to more secure alternatives.
You can read the full text of both papers, Top Gun and Slipway.
What the research shows — a technical overview
Poseidon is built from full and partial rounds: full rounds apply a nonlinear S-box to every coordinate of the internal state, while partial rounds apply it to only one, reducing the cost of representing the function inside a proof circuit. A mixing matrix spreads information across the state between nonlinear layers, while successive rounds generally make the equations an attacker must solve more complex.
The result is not a break of Poseidon as deployed in any specific system today, but rather a demonstration that the criteria currently used to vet Poseidon parameters do not fully capture these classes of structural weaknesses.
The research effort in detail
Giuseppe’s earlier work, co-authored with Ethereum Foundation researcher Antonio Sanso and other collaborators, developed increasingly powerful methods for evaluating Poseidon’s security.
The first paper, Graeffe-Based Attacks, was accepted at CRYPTO 2026, one of the leading conferences in cryptography. The paper accelerated the polynomial root-finding step in algebraic attacks on Poseidon and Poseidon2, demonstrating orders-of-magnitude improvements in practical attack speed against reduced-round challenges.
The second paper, Top Gun, took the next step: making those equations simpler in the first place. Its technique, “degree annihilation”, selects families of inputs that make the highest-degree terms cancel, reducing the contribution of certain rounds to algebraic complexity. It combines this reduction with Graeffe-based solving and demonstrates attacks on reduced-round challenges. The framework works with a fixed mixing matrix, making it directly relevant to evaluating production parameters, although its effectiveness depends on the particular configuration.
The third paper, Slipway, studies what happens when the mixing matrix can instead be chosen to fit already-fixed round constants. Its construction guides selected inputs through the initial full rounds into “finite subspace trails,” where consecutive partial rounds add no algebraic degree. For this input family, a change of variable removes the degree growth associated with four initial full rounds, while fourteen subsequent partial rounds add no further degree. This makes the remaining equations tractable enough to find an input whose first two coordinates are zero and whose full hash output also begins with two zeros, while the custom matrix passes the prescribed checks.
Together, these results advance the understanding of Poseidon’s security from faster equation solving to techniques that reduce its algebraic complexity. Top Gun provides tools for assessing fixed parameter sets, while Slipway shows how dependencies between custom matrices and round constants can escape existing checks.
Research for all of crypto
As trillions of dollars in value flow into blockchain ecosystems, LayerZero Research is focused on evaluating the primitives the industry relies on today and building the ones it’ll need tomorrow. This same instinct led us to build Akita on lattices (rather than hashes) for post-quantum proving, and informs our work across the rest of the Zero stack.