What it is. Celo gave up running its own chain in March 2025 and now rides on top of Ethereum, so its protection against a future code-breaking quantum computer is whatever Ethereum and the shared software underneath it happen to have, which today is none.
What we found. When Celo moved over, it dropped the two most advanced pieces of security it had built on its own, and it has not published any plan to add quantum-safe protection back.
Why it matters. Every account brought across since the 2020 launch, including coins that have sat untouched for years, is locked with the kind of key a future quantum computer could pick open, and Celo has no published timeline for changing that.
Celo migrated from standalone L1 to Ethereum L2 on the Optimism OP Stack on 2025-03-26 (block 31056500), using EigenDA for data availability. The migration removed the L1 cBLS aggregate-signature consensus path and the Plumo SNARK ultralight-client (BLS12-377/BW6 + Pedersen+Blake2s). Post-migration, Celo inherits Ethereum's secp256k1 ECDSA / Keccak-256 / BLS12-381 primitive set via the OP Stack, every signing primitive is Shor-breakable. No Celo-Foundation PQ roadmap published.
Summary
Celo L2 (live since 2025-03-26 at block 31056500) is an Optimism OP Stack rollup using EigenDA for data availability. The L1 migration preserved all history, all accounts, all balances, but removed the chain's two most sophisticated cryptographic components: cBLS aggregate signatures and the Plumo SNARK ultralight client. Post-migration the primitive set is standard OP Stack (secp256k1 ECDSA, Keccak-256, BN254/alt_bn128 precompiles, with BLS12-381 settlement security inherited from Ethereum L1). Zero PQ primitives deployed. mainnet-traffic cap fires (5a = 0), Milestone-Discipline cap fires (5d = 0), Supply-Chain cap fires. Gate 1a-Sig and Gate 1a-KEM both FAIL. PQ posture is fully downstream of Ethereum L1 + OP Stack roadmap, no Celo-specific PQ program. QRI 29, Band 3 Planning. Migration Stage 1.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition on Celo L2
- Gate 1a, Hybrid KEM: FAIL , no PQ KEM hybrid for sequencer / RPC / EigenDA transport
- Gate 1b, Commit-to-hash: COND , no OR-composition declared
- Gate 2, Evidence reconstruction: PASS ,
- Gate 3, Primitive naming: PASS , secp256k1 ECDSA, Keccak-256, BN254, BLS12-381, secp256r1
Burn-vs-rescue policy on file
Declared option f, Undeclared. Celo Foundation / cLabs have not published a position on dormant-balance handling, classical-key sunset, or rescue mechanism. Posture defaults to Ethereum L1 (also undeclared at the protocol level). The L1 → L2 migration preserved all balances on secp256k1 EOAs, including dormant balances dating to mainnet launch in 2020-04-22.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 39 / 100
The L1 → L2 migration removed cBLS aggregate signatures (BLS12-377/BW6) and the Plumo SNARK ultralight-client construction (Bowe-Hopwood / Pedersen+Blake2s). These are no longer in production.
secp256k1 ECDSA (user transaction signing on Celo L2) · Keccak-256 (block hashing, transaction hashing, address derivation) · BN254 / alt_bn128 (pairing precompiles 0x06–0x08 at L2 EVM level) · secp256r1 / P-256 (available via EIP-7702 delegation / RIP-7212 precompile) · BLS12-381 (Ethereum L1 beacon-attestation level for posted batch settlement security, inherited) · OP Stack fault-proof system (Cannon / fault-proof program with Keccak-256 and MIPS proof system) secp256k1 ECDSA→ Shor-break (DL on secp256k1)secp256r1 / P-256→ Shor-break (DL on NIST P-256)Keccak-256→ Grover-weaken (effective 128-bit security)BN254 / alt_bn128→ Shor-break-via-pairings (BN254 family)BLS12-381→ Shor-break-via-pairings (Ethereum L1 beacon, inherited settlement)OP Stack fault-proof Keccak commitments→ Grover-weaken
Zero PQ-safe families deployed on Celo L2.
No NIST PQC-categorized primitive deployed. Classical primitives at standard 128-bit classical security.
Library provenance: celo-org/optimism (fork of ethereum-optimism/optimism), go-ethereum-derived execution client. OP Stack inherits Optimism's audit lineage (Sherlock, Spearbit, Trail of Bits). Celo L2 migration audited by clabs/Optimism teams. No Celo-L2-specific formal verification of PQ-readiness. Cryptanalytic tier: Tier 1 mature classical.
2 Quantum Recovery Exposure weight 8% 29 / 100
Ethereum-style EOA addresses; public keys revealed on first transaction (recoverable from ECDSA signature). 600K+ daily active users in the year following migration; substantial active-key surface.
Celo L1 mainnet launched 2020-04-22; ~73 months of historical balance accumulation transferred to L2. Migration preserved all history, all accounts, all balances per clabs migration documentation. Substantial dormant supply on secp256k1 EOAs migrated forward.
All historical Celo L1 ECDSA signatures (2020–2025) and all post-migration L2 signatures are post-Shor forgeable. No PQ attestation layer.
Validator P2P uses libp2p Noise (X25519); RPC uses standard TLS. EigenDA uses BLS-aggregated availability attestations (classical pairings). No PQ KEM hybrid deployed.
3 Metadata, Anonymity & Confidentiality weight 8% 20 / 100
Pseudonymous transparent EVM ledger. Public addresses, public balances, public state. No native shielded transactions.
Top RPC: Forno (Celo Foundation public endpoint), Infura, Alchemy, Ankr. OP Stack mempool is sequencer-mediated (centralized sequencer at clabs/Celo Foundation). Validator metadata retention undeclared.
Native bridging with Ethereum (OP Stack canonical bridge). Superchain interop with Base, Optimism, Zora, additional linkability surface across OP Stack chains. Wormhole, Squid, and other external bridges available.
Shor on secp256k1 reconstructs every Celo L1 + L2 historical signature, exposing pre-migration L1 transaction history (with full state migration, all of it forwarded to L2).
No on-chain mixer, no commit-reveal shuffle, no integrated mixnet on Celo L2.
4 Migration Architecture weight 15% 41 / 100
Inherits Ethereum/OP Stack crypto-agility surface: EIP-7702 (Set Code for EOAs, live since Pectra 2025-05-07) provides delegation-based path to alternative signature schemes; RIP-7212 P-256 precompile available. No Celo-specific PQ-agility spec.
EIP-7702 + ERC-4337 inherited from Ethereum mainline. No Celo-specific PQ AA path; no documented PQ client-layer migration plan.
Celo L1 → L2 migration (2025-03-26) is itself a major coordinated transition with full state migration, no contested forks. Previous L1 hardforks (Espresso, Donut, Gingerbread) shipped on schedule. Now bound to OP Stack release cadence.
No documented hybrid (AND/OR) signature composition for any signing event on Celo L2. No spec, no testnet pilot.
No stateful hash scheme deployed. Default 15/15 per v3.1 rule.
Celo L2 settlement security relies on Ethereum L1 BLS12-381 beacon attestations (Shor-break-via-pairings). Ethereum's leanXMSS+SNARK direction is research-stage and not yet a Celo-side path. Celo L2 itself does not run a BFT aggregation; sequencer model. No Celo-L2-specific PQ aggregation declaration.
5 Deployment Execution weight 22% 32 / 100
Zero. No PQC primitive in mainnet signing traffic on Celo L2.
No PQ primitive in celo-org/optimism execution client or sequencer binary.
OP Stack rollup operates on a sequencer model with a single sequencer (clabs/Celo Foundation); Ethereum L1 validators run BLS12-381 (Shor-break-via-pairings). Zero PQ key adoption in either layer.
5a = 0 → 5d voided. No dated PQC milestone published by Celo Foundation or clabs.
Announced PQC: zero. Shipped PQC: zero. No washing, narrative-honest absence.
No PQ signatures deployed → no footprint multiplier impact today.
6 Supply Chain Vendor Readiness weight 25% 13 / 100
Top wallets: Valora (Celo-native mobile), MiniPay (Opera-Celo partnership), MetaMask, WalletConnect-compatible wallets, Ledger HW. None has a published Celo-specific PQC roadmap.
OP Stack canonical bridge (PQ status follows Ethereum L1 + OP collective), Wormhole, Squid, LayerZero. No PQC roadmap on any.
Coinbase Custody, BitGo, Anchorage, Fireblocks (all support Celo). No Celo-specific PQC migration timetable from any custodian.
Forno (foundation public endpoint), Infura, Alchemy, Ankr. EigenDA for data availability (BLS classical attestations). No PQC roadmap on any infra tile.
7 Governance & Coordination weight 10% 44 / 100
Post-migration: single sequencer (clabs/Celo Foundation) with planned decentralization through OP Superchain governance. Pre-decentralized-sequencer state. Settlement-side decentralization inherited from Ethereum L1 validators.
Successful L1 → L2 migration with full state preservation is a strong coordination signal. Now bound to Optimism release cadence (Granite, Holocene, Isthmus). No contested forks.
Celo Foundation + cLabs (Rene Reinsberg, Marek Olszewski as co-founders publicly named). Optimism Collective governance shared via Superchain.
L1 → L2 migration was scheduled, not adversarial. No exploit-driven hard fork in Celo's history.
No published rate-limit canary, no cryptographic tripwire, no Hourglass-equivalent.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y reaches 2034–2043, fully Outside risk window (vs Z25 2035) and Crisis Zone (vs Z10 2030)
Z-compliance
Outside NIST 2030 deprecation window (secp256k1 ECDSA default, BLS12-381 inherited from Ethereum L1)
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
An alternative-weighting view would treat Celo's pre-migration L1 (cBLS aggregate signatures + Plumo SNARK ultralight client over BLS12-377/BW6) as a quantum-readiness asset, given the chain previously demonstrated capability to deploy advanced pairing-based cryptography. LayerQu reads the L2 migration as having removed those assets, Plumo and cBLS aggregate are no longer in production on Celo L2. The principle is that what is not in mainnet does not protect mainnet.
Delta-QRI under alternative weighting
Under alternative weighting, +2 to +3 → QRI ≈ 32. mainnet-traffic cap still binds at 60.
Announcement-to-shipped ratio
Announced: 0. Shipped: 0. Ratio: 0.
Tag: none, narrative-honest absence; Celo Foundation makes no PQC claims to wash
Peers in the rollup-L2 profile
9 chains closest to Celo by Stage then QRI.