Our @projecteleven research paper, CUTS (Chained Uniform-sum Tree Signatures) just went live on ePrint. Hash-based signatures have become the leading post-quantum signature candidate for Bitcoin and Ethereum, because of their conservative security assumptions that reduce to the security of cryptographic hash functions. The catch is that the stateless versions of these schemes (e.g. SLH-DSA) score poorly in terms of performance (signature size/signing time). CUTS starts from our main criticism of prior stateful signature proposals (see: xitter.cf/projecteleven/status/2…). TL;DR state tracking is difficult, and a single state error, like a restored backup or two devices loaded from the same seed, creates a new vulnerability that can let anyone forge. CUTS isn't a complete signature scheme; it's a new building block that slots into one. But the paper's analysis reaches well beyond CUTS: it gives an exact way to measure how much security a hash-based key loses when it signs more than once, and it works across a whole class of schemes, including Winternitz keys and FORS (the few-time component inside SLH-DSA). Before this paper, that question was mostly answered one scheme at a time, ad hoc; now designers get a proven number instead of an estimate. Applied to semi-stateful schemes CUTS makes the failure mode far more forgiving by degrading *gracefully* versus *catastrophically*. It can be applied in two ways: * As a drop-in for SHRINCS's one-time key. The CUTS+C 48-cheap parameter set produces signatures of the same length, 530 bytes against 530, and verifies in slightly fewer calls. If a key accidentally signs twice, its proven security exponent stays at 41.2 bits or more, compared with 27.3 for the WOTS+C key SHRINCS uses. In other words, the same accident does less damage. * As a key that is secure after two signatures, outright. The CUTS 128-smallest set keeps a proven two-use bound of 128.6 bits with 1,424-byte signatures. That is shorter than the FORS component of SLH-DSA-128s at 2,928 bytes, and roughly a quarter of the 5,777-byte stateless fallback SHRINCS relies on whenever state is uncertain. We argued that most consumer wallets would never implement SHRINCS's stateful path safely, and that its fallback would become the default. CUTS therefore offers a practical middle path: signatures far smaller than the fallback, with no requirement that the wallet track state perfectly across every backup and device. The cost is key generation. The 530-byte set takes 10,231 tree calls per key, compared with 513 for WOTS+C. That cost is paid once per key, off-chain, and it doesn't touch block space. Bitcoin shouldn't have to choose between compact signatures and a design that forgives operational mistakes. CUTS is our contribution to closing that gap: hash-based security, built for the backups, restores, and failovers that real custody involves. Original paper: eprint.iacr.org/2026/2455.pd… One note: the security proofs in the paper are classical, a quantum random-oracle proof is still open, and instantiating CUTS inside an actual scheme would require further analysis. We may have more on that front soon :) The reference implementation, test vectors, and the scripts behind every table will be released at github.com/p-11/cuts, and we welcome review.