COSMOS HUB · L1 · STAGE 0 UNAWARE · QRI 23 v3.1.0 methodology

In plain terms

What it is. Cosmos Hub sits at the center of a network of 40-plus other chains that trust its records, and right now it has no plan to protect any of that against a future quantum computer.

What we found. The team ships coordinated upgrades reliably, even emergency ones under pressure, but nobody owns the quantum problem, there is no published timeline, and no quantum-safe protection is running today.

Why it matters. Because so many connected chains rely on the Hub's history, a future quantum attacker who can fake its old records could damage trust well beyond Cosmos itself, and the technical ability to upgrade fast counts for little until someone is actually assigned to start.

Cosmos Hub uses Ed25519 non-aggregating signatures at consensus per CometBFT default; the Tendermint BLS-aggregation feature request was closed as not planned. IBC light-client checkpoint trust extends signature validity downstream across ~40+ connected zones, making 2c (sig long-term validity) more consequential than for a non-IBC L1.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Cosmos Hub scores QRI 23, Band 3 Planning, Migration Stage 0. Validator consensus signing uses Ed25519 (CometBFT default per priv_validator_key.json and cometbft init); Cosmos SDK account signatures use secp256k1 ECDSA (R||S lower-S form, SHA-256 digest); SHA-256 (block hashing, IBC commitment hashing); X25519/Ed25519 for CometBFT p2p secret connection handshake; standard TLS for RPC/REST. Inventory clear and reconstructible from CometBFT and Cosmos SDK docs/code. No PQ-safe primitive in active use. ADR-016 specifies validator consensus key rotation; the Olympus (v0.52) release introduced consensus-key-rotation as a major feature plus the new x/accounts module. No native account abstraction comparable to ERC-4337. The Tendermint BLS-aggregation feature request (tendermint/tendermint#1319, opened 2018-03-16) was closed as not planned, Cosmos Hub uses non-aggregating Ed25519 at consensus, so 4f is N/A. DoraFactory's external cosmos-pqc and tendermint-pqc repos demonstrate Dilithium drop-in replacement (not hybrid) on a research fork, not in canonical client. mainnet-traffic cap binds at 5a=0%. Hub upgrade execution (Dim 4c, 7b) is genuinely strong; the bottleneck is upstream: no ADR, no PQ migration lead, no published timeline.

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition AND or OR on Cosmos Hub; no ADR, no roadmap, no spec
Gate 1a, Hybrid KEM: FAIL , CometBFT secret-connection X25519, RPC TLS classical X25519/RSA; no hybrid PQ KEM deployed
Gate 1b, Commit-to-hash: COND , only relevant if 1a-Sig passes via OR-composition
Gate 2, Evidence reconstruction: PASS , every sub-score reconstructible from public artifacts within 48 hours
Gate 3, Primitive naming: PASS , primitives named at every sub-score

Burn-vs-rescue policy on file

Declared option f, Undeclared. No published Cosmos Hub policy on what happens to ATOM at quantum-vulnerable accounts post-CRQC. No freeze/burn proposal, no STARK rescue scheme, no rate-limit canary, no client-layer hybrid migration framework.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 28 / 100

1a · primitive inventory 14 / 20

Inventory clear and reconstructible from CometBFT and Cosmos SDK docs/code.

Primitives: Ed25519 (CometBFT validator consensus signing, default per priv_validator_key.json and cometbft init) · secp256k1 ECDSA (Cosmos SDK account signatures, R||S lower-S form, SHA-256 message digest) · SHA-256 (block hashing, IBC commitment hashing) · X25519/Ed25519 (CometBFT p2p secret connection handshake) · Standard TLS for RPC/REST

1b · shor grover pq tag 6 / 20

No PQ-safe primitive in active use.

Tags:

Ed25519 → Shor-break-via-DL-without-pairings
secp256k1 ECDSA → Shor-break-via-DL-without-pairings
SHA-256 → Grover-weaken (256→128-bit)

1c · family diversity 0 / 20

0 PQ families. Two classical families (Edwards-curve EdDSA, Weierstrass-curve ECDSA), but neither PQ-safe; the diversity rubric counts PQ families.

1d · nist security category 2 / 20

Ed25519 ≈ 128-bit classical / 0-bit post-Shor; secp256k1 ECDSA ≈ 128-bit classical / 0-bit post-Shor; SHA-256 ≈ 128-bit post-Grover. No NIST PQC category mapped because no NIST PQC primitive in scope.

1e · implementation quality 6 / 20

CometBFT consensus has a TLA+ specification and machine-checked safety proofs; the underlying Ed25519 / secp256k1 libraries are standard Go implementations without machine-checked PQ-relevant proofs. Standard Go crypto/ed25519 is constant-time; secp256k1 uses btcec/dcrec, known constant-time. Tier 1 (mature classical EC + SHA-2). No PQ implementation.

2 Quantum Recovery Exposure weight 10% 21 / 100

Forge subtotal: 16/75 Decrypt subtotal: 5/25

2a · active key exposure 5 / 25

cosmos1… accounts derive from secp256k1 pubkey hash (RIPEMD-160(SHA-256(compressed pubkey))). Pubkey is published on-chain on first outbound tx, so any account that has ever signed has its pubkey publicly recorded, Shor-forgeable post-CRQC.

2b · cold key exposure 6 / 25

Accounts that have never signed retain pubkey-hash protection; accounts that signed once retain exposed pubkeys indefinitely. Cosmos Hub mainnet has been live since March 2019, so a non-trivial fraction of cold supply has revealed pubkeys at some point.

2c · sig long term validity 5 / 25

Every historical Ed25519 validator vote and secp256k1 account signature is forgeable after CRQC. IBC light-client checkpoints rely on Ed25519 validator-set signatures: a CRQC adversary can forge a valid-looking historical Cosmos Hub header against any Tendermint light client trusting historical validator-sets.

2d · encryption confidentiality hndl 5 / 25

CometBFT p2p secret connection uses X25519 ECDH key agreement for transport encryption between validators (Shor-vulnerable). RPC/REST endpoints use standard TLS (classical X25519 / RSA / ECDH). No hybrid PQ KEM deployed. Validator gossip and mempool transport sit fully in classical-DH HNDL scope.

3 Metadata, Anonymity & Confidentiality weight 13% 21 / 100

3a · tx graph visibility 5 / 20

Fully transparent ledger; cosmos1… addresses pseudonymous; IBC packet receipts make cross-chain flow trivially linkable to any passive observer.

3b · rpc mempool concentration 5 / 20

Top public RPC endpoints concentrated among a handful of operators (Polkachu, Strangelove, Imperator, Lavender.Five, Notional, Stake.Systems, Stakewolle). Mempool gossip observable to any validator-grade node; no validator-metadata-retention policy declared at protocol level.

3c · cross chain bridge correlation 3 / 20

IBC channels make flows between Hub and ~40+ connected zones directly linkable; Skip Protocol / Stride / Neutron flow analysis is straightforward. Gravity Bridge (Cosmos↔Ethereum) and Axelar add EVM-side correlation.

3d · retroactive de anonymization 8 / 20

Cosmos Hub does not publish encrypted payload data, ZK-shielded transactions, or DL-based ring signatures. Confidentiality risk from Shor on its curves is limited to long-term cryptographic identity correlation rather than payload decryption.

3e · mixnet shuffle 0 / 20

None at protocol level.

4 Migration Architecture weight 10% 56 / 100

4a · crypto agility 6 / 15

CometBFT supports --key-type flag to choose validator consensus key type at init (Ed25519 default; secp256k1 selectable). Cosmos SDK crypto/keys package is modular; new schemes added historically (sr25519 added, secp256r1 added). However, no production instance of a validator-consensus-key-type swap on Cosmos Hub mainnet within 5 years; the agility is architectural, not demonstrated.

4b · aa key rotation 8 / 20

ADR-016 specifies validator consensus key rotation; the Olympus (v0.52) release introduced consensus-key-rotation as a major feature plus the new x/accounts module. x/authz (delegated authorization) and x/feegrant (fee delegation) are live. No native account abstraction comparable to ERC-4337 / EIP-7702 / Starknet AA. No documented client-layer PQ migration path.

4c · hard fork track record 11 / 15

Coordinated upgrades v17 (2024-Q3), v18, v19, v19.2 emergency upgrade, v20 (2024-10), via on-chain governance with ~2-week voting. Strong execution cadence. Contested ATOM 2.0 proposal (2022) was rejected on-chain, a successful adversarial-coordination data point in itself.

4d · hybrid deployment readiness 5 / 15

cometbft init --key-type supports multiple consensus key types in principle, so a hybrid validator key (parallel keys per validator, both verified at consensus) is architecturally constructible. No spec proposal or ADR for a hybrid Ed25519+PQ scheme on Cosmos Hub. DoraFactory's external cosmos-pqc and tendermint-pqc repos demonstrate Dilithium drop-in replacement (not hybrid) on a research fork.

4e · stateful hash state management 15 / 15

N/A by default, no stateful hash scheme in scope; stateless schemes score full per v3.1 rubric.

4f · bft aggregation path 0 / 20

N/A. Cosmos Hub uses Ed25519 non-aggregating signatures at consensus per CometBFT default. The Tendermint BLS-aggregation feature request (tendermint/tendermint#1319, opened 2018-03-16) was closed as not planned. BLS is not in the Cosmos Hub consensus path.

5 Deployment Execution weight 22% 13 / 100

5a · mainnet pqc traffic pct 0 / 25

0% of validator votes or account signatures on Cosmos Hub mainnet under a PQC primitive.

5b · pqc code in consensus client 1 / 15

No PQC scheme merged into cometbft/cometbft main, no PQC scheme merged into cosmos/cosmos-sdk main crypto/keys. DoraFactory tendermint-pqc (Dilithium fork) and cosmos-pqc (Cosmos SDK fork using liboqs-go for Dilithium) exist as external research repos, not in canonical client.

5c · validator pqc key adoption 0 / 15

All ~180 active Cosmos Hub validators use Ed25519 consensus keys per default. No validator has registered a PQC consensus key.

5d · published dated milestones 0 / 10

VOIDED to 0 per v3.1 rule (5a = 0). No dated, enforcement-mechanism-backed PQC milestones for Cosmos Hub mainnet.

5e · pqc washing delta 12 / 15

Announced PQC trailing-12-mo from Cosmos Hub / Interchain Foundation / Informal / Hypha: ~0 official communications. Shipped PQC: 0. Ratio undefined / low. No washing detected (no claims to deflate).

5f · signature footprint multiplier 0 / 20

No PQ deployment, no published bytes-per-block analysis under any PQ scheme for Cosmos Hub.

6 Supply Chain Vendor Readiness weight 22% 8 / 100

6a · wallet 2 / 25

Top-3 in-ecosystem wallets: Keplr, Leap, Ledger HW. None publish a PQC roadmap. Ledger HW has internal PQC research at Ledger Donjon but no shipped PQ-signing for Cosmos accounts.

6b · bridge 2 / 25

Top-3 bridges in Cosmos Hub flow: IBC (light-client model, Ed25519 verification), Axelar (BLS + Ed25519, classical), Gravity Bridge (Ethereum↔Cosmos, secp256k1 + Ed25519). None publish a PQC roadmap. IBC v2 / IBC Eureka work targets ZK-Tendermint-light-client over SP1, that is succinctness, not PQ; the Ed25519 verification stays.

6c · custodian 2 / 25

Top-3 institutional custodians supporting ATOM: Coinbase Custody, BitGo, Anchorage. None publish a Cosmos-specific PQC roadmap. None have MPC-PQ in production for ATOM signing.

6d · rpc hsm tee infra 2 / 25

Top RPC providers: Polkachu, Strangelove, Imperator, Lavender.Five, Notional. None publish PQ-enabled RPC TLS. HSMs used by validators: standard YubiHSM2 / Ledger / Thales / AWS KMS, no PQ signing for Ed25519/secp256k1 in production.

7 Governance & Coordination weight 8% 46 / 100

7a · validator stake distribution 10 / 20

~180 active validators. Reported Nakamoto coefficient in the 6-7 range historically (per Chorus One / Messari analyses), with top-7-or-so controlling 33% threshold. Client diversity weak: nearly universal CometBFT (no second consensus client).

7b · upgrade cadence under pressure 14 / 20

v19.2 emergency upgrade (2024) executed under time pressure. Standard cadence v17/v18/v19/v20 sustained through 2024.

7c · named coordination lead 12 / 20

Interchain Foundation (foundation), Interchain Inc / Interchain Labs (engineering), Informal Systems (CometBFT, Hub stewardship), Hypha Worker Co-op (testnet + mainnet ops, Proposal 985 ratified Hypha for 2025). Clear named ownership. No named PQC migration lead for Cosmos Hub.

7d · adversarial coordination precedent 10 / 20

ATOM 2.0 (Proposal 82, 2022) rejected on-chain demonstrates governance functions under contested high-stakes proposals. No precedent of a coordinated cryptographic-primitive change while under attacker pressure.

7e · canary tripwire mechanism 0 / 20

No canary, honeypot, rate-limited spending rule, or cryptographic tripwire on Cosmos Hub.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

5–15 years, historical Ed25519 validator votes and secp256k1 account signatures sit on-chain indefinitely; IBC light-client checkpoint trust extends sig validity downstream across ~40+ connected zones

Y, migration time

5–10 years to Stage 5, given current Stage 0, a hybrid ADR + CometBFT main-branch merge + 180-validator coordinated rotation + IBC light-client compatibility update + ~40+ consumer/connected-zone alignment is multi-year minimum

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y > 2035, Outside risk window vs Z25; X+Y > 2030, Crisis Zone vs Z10

Z-compliance

Outside compliance window, ATOM faces the 2035 disallowance for any classical PK still in active validator-key or account-signing scope

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

External research forks

DoraFactory tendermint-pqc and cosmos-pqc external research forks demonstrate Dilithium drop-in for the Tendermint validator-key path. They are NOT the Cosmos Hub canonical implementation and not endorsed by ICF / Informal / Hypha. Card scores Hub itself, not external forks.

Appchain heterogeneity

Babylon uses BLS internally for its Bitcoin-checkpoint multisig path (still classical, not PQ). Some Skip Protocol / sequencer-side variants use BLS aggregation. Cosmos Hub itself uses Ed25519 default per CometBFT, not BLS.