{ "chain_slug": "zcash", "name": "Zcash", "scorecard_profile": "privacy-L2", "evaluated_at": "2026-04-17", "evaluator": "layerqu-v2-scoring-agent-5", "v1_reference": "chainscreen-v1-archive", "dimensions": { "1_cryptographic_exposure": { "weight": 0.15, "score": 38, "sub_scores": { "1a_primitive_inventory": { "score": 13, "primitives_named": [ "ECDSA secp256k1 (transparent addresses)", "JubJub (Sapling shielded addrs)", "Pallas/Vesta (Orchard shielded, Halo 2)", "Halo 2 (recursion-friendly PLONK)", "Pedersen hashing (shielded commitment)", "SHA-256 (transparent)" ], "evidence": [ "v1:chainscreen-v1-archive/data/chains/zcash.json" ], "note": "Shielded pools use Pallas/Vesta via Halo 2 (no trusted setup); transparent addresses use ECDSA." }, "1b_shor_grover_pq_tag": { "score": 8, "tags": { "ECDSA secp256k1": "Shor-break", "JubJub": "Shor-break (EC)", "Pallas/Vesta": "Shor-break (EC)", "Halo 2": "Shor-break (discrete log)" }, "evidence": [] }, "1c_algorithm_family_diversity": { "score": 3, "families_represented": 0, "families": [], "note": "Multiple EC families but all classical." }, "1d_nist_security_category": { "score": 6, "mappings": { "Pallas": "128-bit classical", "ECDSA": "128-bit classical" }, "evidence": [] }, "1e_implementation_quality": { "score": 8, "formal_verification": "zcashd + zebrad; multiple implementations; Halo 2 audited by Trail of Bits", "constant_time": "standard", "libraries": [ "zcashd", "zebrad", "librustzcash" ], "evidence": [] } }, "total_artifacts": 2 }, "2_hndl_exposure": { "weight": 0.1, "score": 18, "sub_scores": { "2a_active_key_exposure": { "score": 5, "note": "Shielded users rely on privacy guarantee; pubkeys not necessarily exposed for shielded-only users." }, "2b_cold_key_exposure": { "score": 4, "note": "~9 years mainnet; shielded + transparent pools both long-lived." }, "2c_signature_longterm_validity": { "score": 5, "note": "Transparent ECDSA sigs historically forgeable post-Shor." }, "2d_encryption_confidentiality": { "score": 4, "note": "Standard TLS + in-viewing-key encryption; no PQ KEM." } }, "total_artifacts": 1 }, "3_metadata_privacy_exposure": { "weight": 0.25, "score": 25, "sub_scores": { "3a_tx_graph_visibility": { "score": 5, "note": "Shielded pool hides tx graph today BUT only because proofs are unbreakable under classical assumptions." }, "3b_rpc_mempool_concentration": { "score": 6, "note": "zcashd + zebrad node operators; Electric Coin Company (ECC) and ZF as primary." }, "3c_cross_chain_bridge_correlation": { "score": 6, "note": "Shielded pool isolates from bridge correlation; shielded-to-transparent hops leak metadata." }, "3d_retroactive_deanon_risk": { "score": 8, "note": "CRITICAL: Halo 2 (Pallas/Vesta) is discrete-log-based and Shor-breakable. A capable quantum adversary in the future could RETROACTIVELY DE-ANONYMIZE every shielded Zcash transaction back to genesis by reconstructing proofs and linking notes. This is the strongest retroactive-deanon risk in the evaluated privacy-L2 category because the privacy guarantee itself is crypto-conditional. This is the single most significant structural finding in the LayerQu batch." } }, "total_artifacts": 2 }, "4_migration_architecture": { "weight": 0.15, "score": 35, "sub_scores": { "4a_crypto_agility": { "score": 10, "note": "Multi-pool architecture (Sprout-Sapling-Orchard) demonstrates historical cryptosystem migration capacity. New pool addition is the migration primitive." }, "4b_account_abstraction_key_rotation": { "score": 8, "note": "Viewing keys + spending keys architecture; shielded key rotation possible via new pool." }, "4c_hard_fork_track_record": { "score": 9, "note": "NU1-NU5 network upgrades executed (Sprout, Sapling, Blossom, Heartwood, Canopy, NU5). ECC-led coordination." }, "4d_hybrid_deployment_readiness": { "score": 8, "note": "No PQ shielded-proof roadmap ratified. Research (lattice-based SNARKs, STARK-over-Pallas variants) referenced but not shipped. **ECC dev team resigned Jan 2026** — significant coordination disruption." } }, "total_artifacts": 2 }, "5_deployment_execution": { "weight": 0.18, "score": 5, "sub_scores": { "5a_mainnet_pqc_pct": { "score": 0, "mainnet_pqc_pct": 0, "evidence": [], "note": "Zero PQC on mainnet. Halo 2 is classical zk-SNARK." }, "5b_pqc_code_in_client": { "score": 1, "note": "No PQ code in zcashd/zebrad mainnet branches; research discussions only." }, "5c_validator_pqc_adoption": { "score": 0, "note": "Zero PQ miners (PoW)." }, "5d_published_milestones_count": { "score": 2, "count": 1, "note": "Milestone: forum discussion of post-quantum Zcash (2024-2025); no deliverable." }, "5e_pqc_washing_delta": { "score": 2, "ratio": 0.5, "note": "Low: honest silence, some research talk." } }, "total_artifacts": 1 }, "6_supply_chain_vendor_readiness": { "weight": 0.1, "score": 10, "sub_scores": { "6a_wallet": { "score": 2, "top3": [ "Zashi (ECC)", "YWallet", "Ledger (transparent only)" ], "pqc_roadmap_count": 0, "evidence": [] }, "6b_bridge": { "score": 2, "top3": [ "zIBC (research)", "limited", "none mainstream" ], "pqc_roadmap_count": 0, "evidence": [] }, "6c_custodian": { "score": 3, "top3": [ "Coinbase (transparent)", "Kraken", "Binance" ], "pqc_roadmap_count": 0, "evidence": [] }, "6d_rpc_hsm": { "score": 3, "top3": [ "ZF nodes", "zcashd operators", "limited" ], "pqc_roadmap_count": 0, "evidence": [] } }, "total_artifacts": 1 }, "7_governance_coordination": { "weight": 0.07, "score": 35, "sub_scores": { "7a_validator_stake_distribution": { "score": 10, "note": "PoW mining; F2Pool, Binance Pool dominate." }, "7b_upgrade_cadence_under_pressure": { "score": 9, "note": "Network upgrade cadence historically smooth; next NU uncertain post-ECC resignation." }, "7c_named_coordination_lead": { "score": 8, "note": "Named: Zooko Wilcox (former ECC), ECC (depleted), Zcash Foundation, ZCG. Lead team resigned Jan 2026 = coordination capacity compromised." }, "7d_adversarial_coordination_precedent": { "score": 8, "note": "Dev fund governance disputes; ECC dev team resignation Jan 2026 = adversarial internal precedent." } }, "total_artifacts": 2 } }, "gates": { "hybrid_deployment": "FAIL", "evidence_reconstruction": "PASS", "primitive_naming": "PASS" }, "caps_applied": [ "mosca_cap_60 (5a=0)", "sutor_cap_50", "preskill_cap_40 (ECC dev team resignation disrupts coordination)" ], "qri": { "raw": 18, "after_caps": 14, "ci_plus_minus": 6, "band": 1, "band_name": "Aware-Only" }, "migration_stage": 1, "mosca_inequality": { "X_signature_shelf_life_years": "FOREVER (retroactive shielded de-anon — privacy commitments must hold indefinitely)", "Y_migration_time_years_range": "5-10 (ECC team disruption adds 2-3y)", "Z_10pct_year": 2036, "Z_50pct_year": 2041, "danger_zone_at_50pct": true }, "four_scenario_grid": { "quantum_never": { "value_preserved_pct": 100, "privacy_preserved_pct": 100 }, "arrives_suddenly_pre_migration": { "value_preserved_pct": 15, "privacy_preserved_pct": 0 }, "arrives_slowly_post_migration": { "value_preserved_pct": 55, "privacy_preserved_pct": 10 }, "arrives_slowly_mid_migration": { "value_preserved_pct": 30, "privacy_preserved_pct": 5 } }, "burn_vs_rescue_policy": "none-ratified; shielded de-anon cannot be prevented retroactively — only forward-looking pools can gain PQ privacy", "pqc_washing_ratio": 0.5, "vendor_tile_summary": { "wallet": { "top3": [ "Zashi (ECC)", "YWallet", "Ledger (transparent only)" ], "pqc_roadmap_count": 0 }, "bridge": { "top3": [ "zIBC (research)", "limited", "none mainstream" ], "pqc_roadmap_count": 0 }, "custodian": { "top3": [ "Coinbase (transparent)", "Kraken", "Binance" ], "pqc_roadmap_count": 0 }, "rpc_hsm": { "top3": [ "ZF nodes", "zcashd operators", "limited" ], "pqc_roadmap_count": 0 } }, "narrative_summary": "Zcash faces the most severe retroactive de-anonymization risk in the evaluated set. Halo 2 shielded proofs are discrete-log-based (Pallas/Vesta) — fully Shor-breakable. A quantum adversary in 2040+ could retroactively de-anonymize every shielded transaction back to 2016 genesis, linking notes and reconstructing transaction graphs. Privacy commitments that users made assuming 'anonymous forever' have a crypto expiration date. Compounding: ECC dev team resigned Jan 2026, eroding the coordination capacity that would execute a PQ shielded-proof migration. A lattice-based or STARK-based shielded proof would need to be designed, audited, deployed, and migrated to — a multi-year project with uncertain leadership.", "evaluator_notes": "Stage 1. Single most important PQ finding in LayerQu batch: privacy-coin users face FUTURE privacy loss today from quantum adversaries that do not yet exist. X horizon = forever (not merely shelf-life of sigs). Preskill cap applied for leadership disruption. Privacy-L2 scorecard weights elevate metadata/privacy dim (0.25) vs L1 (0.13), appropriately surfacing this risk.", "narrative_voiced": "Zcash users bought anonymous-forever and got anonymous-until-someone-builds-a-big-enough-quantum-computer. Halo 2 proofs over Pallas and Vesta are discrete-log, which means every shielded transaction back to 2016 genesis is a retroactive de-anonymization target. The ECC dev team resigning in January 2026 is the second problem." }