INJECTIVE · L1 · STAGE 0 UNAWARE · QRI 24 v3.1.0 methodology

Injective's defining positive signal is upgrade muscle: a 2023 Cosmos-SDK + CometBFT bump and a 2025-11-11 Native EVM mainnet integration shipped without contested splits. The bridge surface (Peggy + Wormhole + IBC + Hyperlane to inEVM) is the largest cryptographic-exposure footprint not visible in the per-dim score: a post-Shor adversary acquires forge capability across four distinct trust models simultaneously.

inLinkedIn ↷Audit access ⇆Compare Verified 2026-05-01

Summary

Injective is a Cosmos-SDK L1 (CometBFT v1.0.x) for derivatives and on-chain finance, running on Ed25519 validator consensus with secp256k1 / ethsecp256k1 user signing, the latter expanded materially after the 2025-11-11 Native EVM mainnet brought EVM accounts alongside Cosmos-side accounts and CosmWasm. Bridge surface includes IBC, Peggy (Injective ↔ Ethereum), Wormhole (19-Guardian secp256k1 multisig), and Hyperlane to inEVM. Every primitive in active use is Shor-break or Grover-weaken; no PQC primitive is deployed. Mainnet PQC traffic 0%, no merged PQC code, no published PQ milestones, no Foundation position. Architecture-Execution Gap of 44 (Dim 4 renormalized 59 vs Dim 5 15) reflects functional upgrade muscle (Cosmos-SDK + CometBFT migration in 2023, multi-module governance proposals 2024–2025, Native EVM integration 2025-11-11) paired with zero PQ deployment. Validator-set cap of 60 (active set ~50–60) with single-client implementation (injectived). Gate 1a-Sig FAIL, Gate 1a-KEM FAIL. QRI 24, Band 3 Planning, Migration Stage 0. The band is structurally generated by Dim 4 upgrade-muscle, not by any PQ plan.

What the gates say

Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition AND or OR on any signing surface
Gate 1a, Hybrid KEM: FAIL , validator gossip and bridge transport use classical X25519/ECDH/RSA TLS; no hybrid KEM declared
Gate 1b, Commit-to-hash: COND , no OR-composition declared; Gate 1a-Sig already FAIL
Gate 2, Evidence reconstruction: PASS , every sub-score has ≥3 URLs; reachable in <48h via cited public artifacts
Gate 3, Primitive naming: PASS , Ed25519, ECDSA secp256k1, ethsecp256k1, SHA-256, Keccak-256 named with mechanism

Burn-vs-rescue policy on file

Declared option f, Undeclared. Injective Foundation has not published a position on freezing, rescuing, rate-limiting, or migrating quantum-vulnerable balances.

Seven dimensions

Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.

1 Cryptographic Exposure weight 15% 30 / 100

1a · primitive inventory 12 / 20

Injective publicly identifies itself as a Cosmos-SDK chain forked at v0.50.x with CometBFT v1.0.x. Hash primitives are inherited from upstream and not separately documented in Injective's docs site.

Primitives: Ed25519 (CometBFT validator consensus signing; pubkey type /cosmos.crypto.ed25519.PubKey) · secp256k1 ECDSA (Cosmos-SDK transaction signing) · ethsecp256k1 (Injective EVM accounts post-2025-11-11; EIP-712 typed data) · SHA-256 (Cosmos-side state hashing) · Keccak-256 (EVM-side hashing)

1b · shor grover pq tag 10 / 20

Tags:

Ed25519 → Shor-break-via-DL-without-pairings
ECDSA secp256k1 → Shor-break-via-DL-without-pairings
ethsecp256k1 (EIP-191/EIP-712 personal-sign) → Shor-break-via-DL-without-pairings
SHA-256 → Grover-weaken-128bit
Keccak-256 → Grover-weaken-128bit

1c · family diversity 0 / 20

Zero PQ-safe families deployed. All active cryptography is classical elliptic-curve plus SHA-2/Keccak.

1d · nist security category 0 / 20

VOID (0 by Gate 3 logic). No NIST PQC primitives (ML-DSA, ML-KEM, SLH-DSA, FN-DSA) in the codebase.

1e · implementation quality 8 / 20

Standard Cosmos-SDK and go-ethereum libraries. Library provenance: InjectiveLabs forks of cosmos-sdk v0.50.14, cometbft v1.0.1, go-ethereum v1.16.3 (all classical, no liboqs/PQCA dependency). Stateless across stack. Cryptanalytic tier 1.

2 Quantum Recovery Exposure weight 10% 20 / 100

Forge subtotal: 15/75 Decrypt subtotal: 5/25

2a · active key exposure 4 / 25

Cosmos-side accounts and Injective EVM accounts both reveal user public keys on first outgoing transaction. Injective's exchange module is order-book based with continuous derivatives activity, meaning effectively every active address has a revealed pubkey. INJ market cap and on-chain TVL across spot, perpetuals, and DeFi modules sit on Shor-break primitives.

2b · cold key exposure 5 / 25

Injective mainnet went live 2021-11-08. Long-dormant balances (validator self-stake, foundation treasury, early INJ holders, vesting wallets) have ~4.5 years of accumulation under classical signatures. INJ is a staking-required asset, so cold-key opacity is partial at best.

2c · sig long term validity 6 / 25

Derivatives orders settle quickly and become historical, but settlement records (and the signatures that authorized them) live on chain forever. Withdrawal and bridge-out signatures (Peggy MsgSendToEth, Wormhole VAA initiator signatures) are particularly sensitive because a forged historical signature could be replayed against the bridge module's state.

2d · encryption confidentiality hndl 5 / 25

Validator-to-validator gossip in CometBFT uses authenticated encryption over X25519 / Ed25519 handshake (Noise-style protocol via tendermint/p2p); RPC and JSON-RPC endpoints to indexers, archive nodes use standard TLS with classical ECDHE + ECDSA/RSA certificates. Bridge relayer traffic (Peggo orchestrator, Wormhole guardian gossip) likewise uses classical TLS.

3 Metadata, Anonymity & Confidentiality weight 13% 23 / 100

3a · tx graph visibility 6 / 20

Injective is pseudonymous and transparent. Spot, derivatives, and exchange-module orders are visible on chain (FBA conceals orders within the auction interval but published once the auction clears). No native shielding or hidden-tx scheme.

3b · rpc mempool concentration 7 / 20

Top-3 RPC concentration: Injective Labs RPC, validator-operated public endpoints (Polkachu, NodesHub, Imperator). Mempool gossip observability: standard CometBFT mempool, fully observable. Validator metadata retention policy: undeclared by Injective Foundation.

3c · cross chain bridge correlation 4 / 20

Injective routes value across IBC (to/from Cosmos chains), Peggy (to/from Ethereum, lock-and-mint with INJ-side burn), Wormhole (to/from Solana, EVM L1s, L2s, Aptos, Algorand, BNB Chain). Hyperlane bridge to inEVM adds a fourth cross-domain link. High correlation surface.

3d · retroactive de anonymization 6 / 20

Pseudonymous chain, low marginal retroactive privacy risk from Shor, but bridge-traffic correlation across IBC + Wormhole + Peggy lets a post-Shor adversary tie historical Injective addresses to counterparties on other chains by recovering keys from any side.

3e · mixnet shuffle 0 / 20

No mixnet, no shuffle, no commit-reveal anonymity primitive at chain level. FBA conceals orders but is a market-design feature, not a metadata-anonymity feature.

4 Migration Architecture weight 10% 59 / 100

4a · crypto agility 9 / 15

Cosmos-SDK chains have governance-driven hard-fork upgrade paths and modular keepers. Injective has demonstrated this: Cosmos-SDK upgrade from v0.45.x to v0.47.x in v1.11 (June 2023), continued through v0.50.x by 2025, plus a CometBFT v0.37 → v1.0.1 jump. The Native EVM mainnet integration (2025-11-11) added a second VM via on-chain governance and a binary upgrade. No documented in-place algorithm hot-swap.

4b · aa key rotation 8 / 20

CosmWasm allows app-level custom signature verification; Injective EVM supports ERC-4337 account abstraction patterns inherited from the EVM stack. Cosmos accounts support pubkey rotation via key replacement messages. No native protocol-level AA spec equivalent to EIP-7702 is documented for Injective. PQC client-layer migration path is architecturally possible but not deployed.

4c · hard fork track record 11 / 15

Multiple coordinated mainnet upgrades since 2021, including v1.11 (Cosmos-SDK + CometBFT major upgrade, June 2023), the December 2025 hard fork that enhanced EVM support, and the Native EVM mainnet on 2025-11-11. No contested forks observed.

4d · hybrid deployment readiness 4 / 15

Architecturally, a CosmWasm contract or a custom AnteHandler could enforce a hybrid signature path; nothing about this is announced or specified by Injective Labs / Injective Foundation. No hybrid composition declared for any signing surface.

4e · stateful hash state management 15 / 15

Not applicable. No stateful-hash signature scheme in active use. Default 15 per scorecard rule for chains using stateless schemes.

4f · bft aggregation path 0 / 0

N/A, Injective uses CometBFT's default Ed25519 validator signing (single, non-aggregating signatures per validator per vote). No BLS aggregation path in the consensus signing layer. Per scorecard rule, 4f is N/A for chains using non-aggregating signatures at consensus.

5 Deployment Execution weight 22% 15 / 100

5a · mainnet pqc traffic pct 0 / 25

0% of Injective mainnet signing traffic is post-quantum. No PQC primitive is in active use on the chain.

5b · pqc code in consensus client 0 / 15

Zero LOC of PQC primitive code merged in injective-core or in the InjectiveLabs forks of cosmos-sdk and cometbft. Dependency tree contains no liboqs / PQCA / OQS Go bindings.

5c · validator pqc key adoption 0 / 15

0% of Injective's active validator set (~50–60 validators per mainnet parameter cap) uses any PQC consensus key. Validator pubkey type is /cosmos.crypto.ed25519.PubKey.

5d · published dated milestones 0 / 10

VOIDED to 0 per v3.1 rule because 5a = 0. No public Injective Foundation post-quantum roadmap, no dated PQ milestones, no governance proposal addressing PQ migration.

5e · pqc washing delta 15 / 15

Zero announced PQC, zero shipped PQC. Ratio 0/0 → no washing tag. The chain is silent on PQ rather than overstated.

5f · signature footprint multiplier 0 / 20

Undisclosed (no PQ scheme selected, no on-chain footprint analysis from Injective Foundation). Per rubric, undisclosed = 0.

6 Supply Chain Vendor Readiness weight 22% 10 / 100

6a · wallet 3 / 25

Top-3 Injective wallets: Keplr (Cosmos-native, dominant), Leap (Cosmos-native), MetaMask (used after Native EVM launch for Injective EVM accounts). Ledger and Trezor as hardware. None has a published PQC roadmap covering Injective signing surfaces; Ledger's PQ work focuses on its OS roadmap, not deployed in production.

6b · bridge 2 / 25

Injective's three primary bridge tiles: Peggy (INJ ↔ Ethereum, validator-orchestrated multisig with secp256k1 ECDSA on the Ethereum side), Wormhole (19-Guardian secp256k1 multisig, 13-of-19 quorum, classical), IBC (light-client verification, Tendermint/CometBFT proofs). Hyperlane operates the inEVM warp routes with ECDSA validator signatures. Zero PQC roadmap published by any of these top-3 bridges.

6c · custodian 2 / 25

Top institutional custodians for INJ include Coinbase Custody, BitGo, Fireblocks. None has a deployed MPC-PQ product covering INJ as of evidence cutoff; Fireblocks has discussed PQC research, not deployed.

6d · rpc hsm tee infra 3 / 25

Top-3 RPC providers for Injective: Injective Labs RPC, Polkachu, NodesHub (plus Imperator, Allnodes for validator infra). HSMs in Injective validator stack: Horcrux (CometBFT remote signer), Ledger HSM-class devices, AWS KMS for cloud-hosted validators, none with deployed PQ key types for Ed25519-replacement. TEE attestation chains not specifically documented for Injective validator operation.

7 Governance & Coordination weight 8% 36 / 100

7a · validator stake distribution 8 / 20

Validator-set cap of 60 (some sources cite an active set of ~50). Stake distribution moderately concentrated; staking-explorer listings show Zellic and similar validators with multi-million INJ self-stake plus delegations. Single-client diversity: Injective runs injectived, a single canonical client.

7b · upgrade cadence under pressure 14 / 20

Track record of coordinated mainnet upgrades. v1.11 Cosmos-SDK + CometBFT migration in 2023, multi-module governance proposals in 2024–2025, 2025-11-11 Native EVM mainnet (the largest architecture change), December 2025 follow-up hard fork. Coordination across ~50–60 validators has been demonstrated repeatedly without contested forks.

7c · named coordination lead 6 / 20

Injective Labs is the named technical lead (Eric Chen, Albert Chon as co-founders). Injective Foundation operates governance, treasury, and validator coordination. No named PQC working group, no published PQC mandate, no named lead for a post-quantum migration.

7d · adversarial coordination precedent 8 / 20

Injective has executed coordinated upgrades, parameter changes (token supply parameter governance proposal #472 in January 2025), and burn-auction adjustments. No precedent for coordinating a cryptographic migration under adversarial pressure.

7e · canary tripwire mechanism 0 / 20

No consensus-embedded canary, no rate-limited spending rule, no honeypot, no automated post-Shor response mechanism.

X + Y vs Z, when does the math turn against you?

v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?

X, signature shelf life

5–12 years (short-lived derivative orders narrow lower bound; long-held INJ staking, treasury, and bridge-out signatures whose recoverable value extends across the chain's full operating life)

Y, migration time

8–13 years (Cosmos-SDK + CometBFT upstream PQ effort is research-stage; Injective inherits whatever upstream ships, then must coordinate an EVM-side hybrid plus bridge migrations across IBC, Peggy, Wormhole, Hyperlane)

Z10 (10% CRQC year)

2030

Z25 (25% CRQC year)

2035

Verdict

X+Y range 13–25 years (2039–2051), Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)

Z-compliance

Outside compliance window for both 2030 and 2035 NIST IR 8547 milestones

Source-disagreement disclosure

v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.

Validator-set cap

Sources diverge between an 'active set of 50' and a 'limit of 60 validators'. Most likely: a 60-validator parameter cap with the active set fluctuating around 50–60. Disclosed; does not affect any sub-score.

Pseudo-PQC adjacency

'MEV-resistant' and 'FBA' are sometimes conflated with confidentiality in third-party explainers. They are economic-design features of the exchange module, not cryptographic confidentiality features. The scorecard treats them as such.

Delta-QRI under alternative weighting

Under a profile that double-weights Dim 6 (vendor concentration) and halves Dim 4 (architecture credit), Injective's QRI would fall by ~3 points (≈21). Migration Stage and band tier do not change.