Every quantum-safe plan for Ethereum leans on hash functions staying secure. Which hash to use is still being decided.
The idea: When elliptic curves fall, hashes are what's left: hash-based signatures, Merkle trees and STARK proofs all come down to "nobody can find collisions or second preimages". That's the most battle-tested bet in cryptography, but each plan has to pick a hash, and the proof-friendly ones like Poseidon are much younger than SHA-2 or SHA-3.
Why it matters: Hashes are the most battle-tested assumption, which is why the roadmap leans on them.
On the map: collision + second-preimage resistance of a hash still being chosen: SHA-2 / SHA-3 / BLAKE (leanVM), Poseidon (leanSig prototype)
Every post-quantum plan on this map rests on hash security: collision and second-preimage resistance of whichever hash is chosen. leanVM currently uses BLAKE2s as a placeholder[1] and considers SHA-2, SHA-3 and BLAKE3. The leanSig prototype uses Poseidon[2]. The binary tree's hash is undecided[3].
Choosing a well-studied hash makes the assumption conservative. Choosing a proof-friendly one like Poseidon makes proofs faster but rests on younger cryptanalysis. It is the main open design choice behind the post-quantum roadmap.
If any of these breaks, this breaks too.
If this breaks, these break with it.