9.5M L2 gas per Falcon-512 verification — that's 2x garaga ECDSA but 65% cheaper than secp256r1 syscall, which makes the quantum safety premium surprisingly tolerable at current L2 fee levels. The actual unlock here is account abstraction letting signature logic live in the contract rather than the protocol layer — every other chain needs a hard fork or coordinated EIP to swap signature schemes, while Starknet users just redeploy their wallet contract. Compare that to Ethereum L1 where even adding secp256r1 via EIP-7212 was a multi-year governance slog for a non-PQ curve, and you start to see why Cairo's smart wallet model might be the only realistic path to per-user quantum migration before Q-day actually matters.

Top comment by @Benthic