What it is. Celestia is a shared filing cabinet that more than fifty other blockchains pay to store and prove their records in, and those chains trust Celestia's stamp of approval as the final word on what happened.
What we found. Celestia has cleanly delivered five network upgrades, so the team clearly knows how to ship change, but none of those upgrades touched quantum defenses, and the work to make its stamps forgery-proof against a future quantum machine has not been started, scheduled, or handed to anyone.
Why it matters. Because every dependent chain inherits whatever Celestia trusts, one day a quantum attacker who forges those old stamps could rewrite the shared history under all of them at once, and Celestia has not decided what would happen to people's holdings if that day arrives.
Celestia's structural risk is the DA-layer twist on Cosmos-stack PQ exposure. 56+ rollups across OP Stack, Arbitrum Orbit, Polygon CDK, Rollkit, Sovereign SDK, Dymint treat Celestia data-root commitments as the trust anchor for blob retrieval and rollup-state reconstruction. A CRQC adversary forging historical Celestia headers (Ed25519 forgery) compromises every downstream rollup's history reconstruction and IBC light-client trust. Celestia uses Merkle-NMT over SHA-256, NOT KZG, a structural distinction at Dim 1.
Summary
Celestia is a modular data-availability L1 built on a CometBFT consensus layer (Ed25519 validator signing, hard-coded), a Cosmos SDK account layer (secp256k1 ECDSA), and a 2D Reed-Solomon erasure-coding plus Namespaced Merkle Tree blob-commitment construction over SHA-256. Mainnet Beta launched 2023-10-31; chain has executed five protocol upgrades (Lemongrass, Ginger, Shwap, Matcha, Lotus) without contested forks. There is no PQ activity on mainnet: 0% PQC traffic, no merged PQC code, no validator PQC keys, no published CIP for hybrid signing, no foundation post on quantum readiness, no named migration lead. Architecture-execution gap of 39 reflects functional upgrade muscle paired with zero PQ deployment. The DA-layer signature shelf-life (X = 7–15y) reads structurally longer than a settlement L1 because every Celestia-DA rollup inherits Celestia's signature shelf life. Blob commitments are Merkle roots of NMT subtrees over SHA-256-hashed shares (Grover-weakened, NOT Shor-broken via pairings, Celestia explicitly chose NMT over KZG). Gate 1a-Sig FAIL, Gate 1a-KEM FAIL. QRI 23, Band 3 Planning, Migration Stage 0.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition; no CIP filed, no roadmap entry, no spec
- Gate 1a, Hybrid KEM: FAIL , CometBFT secret-connection X25519, RPC TLS classical X25519/RSA; no hybrid PQ KEM
- Gate 1b, Commit-to-hash: COND , only relevant if 1a-Sig passes via OR-composition
- Gate 2, Evidence reconstruction: PASS , every sub-score reconstructible from public artifacts within 48 hours
- Gate 3, Primitive naming: PASS , Ed25519, secp256k1 ECDSA, X25519, SHA-256, Reed-Solomon over GF(2^8), Groth16 for Blobstream EVM verifier and CIP-46 ZK Hyperlane ISM, ML-DSA / Dilithium reference for the DoraFactory external fork named with mechanism
Burn-vs-rescue policy on file
Declared option f, Undeclared. No published Celestia policy on what happens to TIA at quantum-vulnerable accounts post-CRQC. No freeze/burn proposal, no STARK rescue scheme, no rate-limit canary, no client-layer hybrid migration framework. The DA-layer analogue, what happens to historical blob attestations and their rollup-state inheritance under CRQC, is also undeclared.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 27 / 100
Inventory clearly reconstructible from celestia-app and celestia-core specs and from Cosmos SDK documentation. NMT + Merkle commitment, NOT KZG, Celestia's commitment layer does not use pairings.
Ed25519 (CometBFT validator consensus signing, priv_validator_key.json mandates Ed25519) · secp256k1 ECDSA (Cosmos SDK account signatures via crypto/keys/secp256k1, R||S form, SHA-256 message digest, addresses 20 bytes) · SHA-256 FIPS 180-4 (block hashes, NMT inner hashes, blob-commitment Merkle roots, IBC commitment hashing) · Reed-Solomon over GF(2^8) (2-dimensional erasure coding for the extended 2k×2k data square) · X25519/Ed25519 inside CometBFT p2p secret-connection handshake · Standard TLS for RPC/REST Ed25519→ Shor-break-via-DL-without-pairings (Edwards-curve EdDSA, 256-bit DL)secp256k1 ECDSA→ Shor-break-via-DL-without-pairingsSHA-256→ Grover-weaken (256→128-bit collision/preimage discount)Reed-Solomon→ classical-only (not a cryptographic primitive, does not enter Shor/Grover scope)X25519→ Shor-break-via-DL-without-pairings
0 PQ families. Two classical signature families (Edwards-curve EdDSA at consensus, Weierstrass-curve ECDSA at the account layer) plus one non-cryptographic erasure-coding family, none PQ-safe.
Ed25519 ≈ 128-bit classical / 0-bit post-Shor; secp256k1 ECDSA ≈ 128-bit classical / 0-bit post-Shor; SHA-256 ≈ 128-bit post-Grover; X25519 ≈ 128-bit classical / 0-bit post-Shor. No NIST PQC category mapped because no NIST PQC primitive is in scope.
CometBFT consensus has a TLA+ specification and machine-checked safety proofs; Informal Systems applies Quint specification language, Apalache model checker, and Atomkraft E2E testing in its Celestia audits. Constant-time: Go crypto/ed25519 is constant-time. Library provenance: in-tree under celestiaorg/celestia-app, celestiaorg/celestia-core, celestiaorg/celestia-node, celestiaorg/nmt, celestiaorg/rsmt2d. Stateless. Cryptanalytic tier 1 (mature classical EC + SHA-2). Audits performed by Informal Systems and OtterSec on celestia-app, op-stack integration, Blobstream X, and SP1 Blobstream.
2 Quantum Recovery Exposure weight 10% 22 / 100
celestia1... accounts derive from a secp256k1 pubkey hash; pubkey is published on-chain on first outbound tx. Validator Ed25519 consensus pubkeys are public by construction. The DA-layer specificity: Celestia is the consensus authority for blob attestations consumed by 56+ rollups, so Forge of validator Ed25519 keys does not just compromise TIA, it lets an attacker forge historical Celestia headers that downstream rollups treat as canonical for state-root reconstruction and IBC light-client trust.
Mainnet Beta launched 2023-10-31; chain is ~30 months old at evaluation. Foundation Delegation Program directs Foundation stake to ~50 of the 100 validator slots, meaning a structural fraction of TIA stake sits in delegated-but-cold wallets whose pubkeys are revealed on-chain via delegation transactions. Initial $55M Series B (2022-10) plus $100M Bain-led round (2024-09) brought total funding to $155M; investor and team allocations vest on multi-year schedules.
Celestia's structurally heaviest sub-score and the reason a DA L1 is qualitatively different from a settlement L1. Every historical Ed25519 validator vote and every secp256k1 account signature is forgeable after CRQC. Celestia validators sign data-root commitments (the Merkle root of NMT-rooted erasure-coded blobs) for every block. 56+ downstream rollups using Celestia DA across OP Stack, Arbitrum Orbit, Polygon CDK, and custom frameworks use those validator-signed commitments as the trust anchor. A CRQC adversary can forge a valid Celestia header against any rollup or IBC light client trusting historical Celestia validator-set state.
CometBFT p2p secret-connection uses X25519 ECDH for transport encryption between validators (Shor-vulnerable). RPC/REST endpoints (top providers Celestia official RPC, Numia, Lavender.Five, BlockPI, Ankr) use standard TLS with classical X25519/RSA/ECDH key agreement. No hybrid PQ KEM deployed.
3 Metadata, Anonymity & Confidentiality weight 13% 21 / 100
Fully transparent ledger; celestia1... addresses pseudonymous; PayForBlobs transactions publish blob namespace, size, fee, signer pubkey, and the Merkle commitment to the blob shares. Blob payload contents are determined by the rollup that posted them and may themselves be encrypted by the rollup, but the rollup-identity-to-blob-namespace mapping is trivially observable.
Top public RPC endpoints concentrated among a handful of operators (Celestia official rpc.celestia.pops.one, Numia, Lavender.Five, BlockPI, Ankr); Mocha testnet and Arabica devnet RPCs run by core team and select infra partners. Mempool gossip observable to any validator-grade node. Foundation Delegation Program concentrates ~50% of delegated foundation stake among 50 validators.
IBC channels link Celestia to ~10+ Cosmos zones with ICS-20 fungible-token transfers (TIA flows trivially traceable). Blobstream / SP1 Blobstream relays Celestia data-root commitments to Ethereum, Arbitrum, and Base on an hourly cadence, producing a permanent on-chain correlation surface. Lotus upgrade (v4, 2025-07-28) integrated Hyperlane as a Cosmos SDK module, adding a second persistent cross-chain correlation surface.
Celestia at the protocol layer does not publish encrypted payload data, ZK-shielded transactions, or DL-based ring signatures at the consensus level. Confidentiality risk from Shor on its curves is limited to long-term cryptographic identity correlation rather than payload decryption, payloads are public blobs by design.
None at protocol level. No mixnet, no commit-reveal shuffle, no on-chain anonymity primitive in celestia-app or celestia-core.
4 Migration Architecture weight 10% 54 / 100
CometBFT's priv_validator_key.json schema and cometbft init --key-type flag support multiple validator-key types in principle; Tendermint historically supported only Ed25519 validator keys, and that constraint persists in celestia-core. Cosmos SDK crypto/keys is modular at the account layer. CIP-40 (part of Matcha) extended the privval interface for arbitrary-message signing, useful for any future multi-key validator path, though not itself a PQ migration.
x/authz (delegated authorization) and x/feegrant (fee delegation) are inherited from Cosmos SDK. Cosmos SDK ADR-016 specifies validator consensus key rotation; the Olympus (v0.52) Cosmos SDK release introduced consensus-key-rotation. No native account abstraction comparable to ERC-4337 / EIP-7702 / Starknet AA. No documented client-layer PQ migration path. No CIP for hybrid signing.
Coordinated upgrades sustained: Lemongrass (v1, mainnet 2024-09), Ginger (Arabica activation 2024-11-05), Shwap (data-syncing protocol upgrade, 2024-Q4), Matcha (v6, mainnet 2025-11-24, 128MB block target, inflation 5%→2.5% via CIP-41, IBC/Hyperlane token-filter removal, privval interface extension), Lotus (v4, mainnet 2025-07-28, Hyperlane integration). All upgrades executed without contested forks. CIP process formalized via celestiaorg/CIPs repo.
No Celestia CIP for a hybrid Ed25519+PQ scheme. CometBFT inherited from Tendermint hard-codes Ed25519 at the consensus layer; a hybrid validator-key path requires either upstream CometBFT changes or a Celestia-specific fork. DoraFactory's external tendermint-pqc and cosmos-pqc repositories demonstrate a Dilithium drop-in (not hybrid) on a research fork. The Matcha CIP-40 privval interface extension for arbitrary-message signing is the closest live primitive that could host a hybrid signer, although not designed for this purpose.
N/A by default, no stateful hash scheme in scope; stateless schemes score full per v3.1 rubric.
N/A, Celestia consensus uses CometBFT default Ed25519 non-aggregating signatures per celestia-core spec. The Tendermint BLS-aggregation feature request was closed as not planned in the upstream CometBFT lineage. BLS is not in Celestia's consensus path. SP1 Blobstream uses Groth16-pairing inside the EVM verifier on the Ethereum side, but that is an EVM-side primitive, not Celestia consensus.
5 Deployment Execution weight 22% 15 / 100
0% of Celestia validator votes, account signatures, blob commitments, or Blobstream attestations on Celestia mainnet are produced under any PQ primitive.
No PQC scheme merged into celestiaorg/celestia-core (the CometBFT fork) main branch. No PQC scheme merged into celestiaorg/celestia-app main crypto/keys. No CIP filed proposing PQC merge. DoraFactory tendermint-pqc and cosmos-pqc exist as external research repositories targeting upstream Tendermint/Cosmos SDK, not Celestia's celestia-core.
All 100 active Celestia validators use Ed25519 consensus keys per CometBFT default. No validator has registered a PQC consensus key (the schema does not allow it without a celestia-core change).
VOIDED to 0 per v3.1 rule (5a = 0). The public Celestia roadmap blog post and the CIP repository contain no PQ-specific dated milestones, no flag-day, no sunset date, no PQ-validator-key registration deadline.
Announced PQC trailing-12-month from Celestia Foundation / Celestia Labs / Celestia blog: 0 official communications. Shipped PQC: 0. No washing detected.
No PQ deployment, no published bytes-per-block analysis under any PQ scheme for Celestia. Particularly live concern given block-size scaling toward 128MB (Matcha) and the 1GB roadmap target, multiplier numbers under ML-DSA-44 (~38× raw) or SLH-DSA-128s (~110–125× raw) would interact with block-time and propagation-reactor design. Undisclosed.
6 Supply Chain Vendor Readiness weight 22% 8 / 100
Top-3 wallets for Celestia accounts: Keplr, Leap, Cosmostation (Ledger HW supported via these wallets for cold storage). None publishes a Cosmos-account PQC roadmap. Ledger has internal PQC research but no shipped PQ-signing for Cosmos accounts.
Top-3 bridges in Celestia flow: Blobstream / SP1 Blobstream (Ed25519 verification via Groth16 SNARK in the EVM verifier; pairing-based and Shor-vulnerable on the EVM side), IBC (light-client model, Ed25519 verification, classical), Hyperlane (Lotus-integrated, classical secp256k1/Ed25519 ISM by default). None publishes a PQC roadmap. SP1 Blobstream's 'succinctness' is not 'post-quantum.'
Top-3 institutional custodians supporting TIA: Coinbase Custody, Anchorage Digital (federally chartered, supports Celestia delegation directly from vaults), Kraken (custody + staking). None publishes a Celestia-specific PQC roadmap. None has MPC-PQ in production for TIA signing.
Top RPC providers for Celestia: Celestia official RPC, Numia, Lavender.Five, BlockPI, Ankr. None publishes PQ-enabled RPC TLS. HSMs typically used by validators: Horcrux (Strangelove threshold-signing), YubiHSM2, Ledger HW, AWS KMS via celestiaorg/aws-kms-keyring. None offer PQ signing for Ed25519/secp256k1 in production. TEE attestation chains not in Celestia's validator stack.
7 Governance & Coordination weight 8% 39 / 100
100 active validators (the active set is hard-capped at 100 highest-staked). Reported Nakamoto coefficient = 8 per Nakaflow real-time tracker (2026-04-29), top-8 validators control ≥33% stake. Foundation Delegation Program directs Foundation stake to 50 of the 100 slots. Client diversity weak: nearly universal celestia-app / celestia-core (no second consensus client).
Lemongrass, Ginger, Shwap, Matcha, Lotus all executed in the 2024–2025 cadence. Matcha included emergency patches for two network issues (claim-rewards-after-stake-move, broken ICA functionality). The CIP process is formalized in celestiaorg/CIPs and CIP-42 was the umbrella for Matcha's six numbered CIPs. No precedent of a contested fork.
Celestia Labs (engineering): Mustafa Al-Bassam (CEO, also Chair of Celestia Foundation board), Ismail Khoffi (CTO, former Tendermint engineer), John Adler (board, former ConsenSys L2 researcher). Celestia Foundation (Liechtenstein-domiciled, governing council of four). Clear named ownership of the protocol, foundation, and roadmap. No named PQC migration lead, no Celestia Foundation post, no CIP author, no roadmap entry assigning ownership of a quantum-readiness track.
Chain has been live ~30 months; no precedent of a coordinated cryptographic-primitive change while under attacker pressure. CIP-41 (inflation reduction 5%→2.5% in Matcha) and the Proof-of-Governance research thread demonstrate governance functions on contested economic questions, but neither has the security-emergency profile.
No canary, honeypot, rate-limited spending rule, or cryptographic tripwire on Celestia.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y > 2035, Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)
Z-compliance
Outside compliance window, Liechtenstein domicile of Celestia Foundation places it under Switzerland-influenced regulatory orbit and EU NIS2 visibility through Liechtenstein's EEA membership
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
External research briefs occasionally list KZG commitments on BLS12-381 as a Celestia primitive. This is incorrect for Celestia. Celestia's blob commitments are Merkle roots of NMT subtrees over SHA-256-hashed shares of erasure-coded blobs, not KZG polynomial commitments. Celestia documentation is explicit: Avail, EigenDA, and Ethereum EIP-4844 use KZG; Celestia uses Merkle + fraud-proof verification. Celestia's commitment layer is Grover-weakened, not Shor-broken via pairings.
SP1 Blobstream's EVM-side verifier uses Groth16 (pairing-based, Shor-exposed) to verify Ed25519 signatures inside an SP1 zkVM proof. The Celestia-side primitives stay Ed25519, the pairing exposure is on the EVM bridge surface, not on Celestia consensus. Lives under Dim 6 6b, not Dim 1.
DoraFactory tendermint-pqc and cosmos-pqc external research forks demonstrate Dilithium drop-in on the Tendermint validator-key path. They are not Celestia's canonical implementation and not endorsed by Celestia Foundation or Celestia Labs.
Delta-QRI under alternative weighting
Under a profile that weighted Dim 5 at 30% (instead of 22%) and Dim 6 at 30% (instead of 22%), QRI would fall to ≈19 and Band would remain 2–3.
Announcement-to-shipped ratio
Announced: 0. Shipped: 0. Ratio: 0.
Tag: none, no washing, no public claim to deflate
Peers in the L1 profile
9 chains closest to Celestia by Stage then QRI.