What it is. Optimism wrote the clearest plan of any network like it for moving off the math a future quantum computer could break, and it picked a hard cut-off date in 2036.
What we found. That plan is still only words: no code is built, the method to protect accounts has not even been chosen, and the community vote that has to approve it has not happened.
Why it matters. If you hold funds here and miss the 2036 deadline, your money does not get stolen or destroyed, but you can no longer move it until you switch your account over, and the date itself could slip later.
OP Labs published the highest-quality PQ communication of any rollup-L2 to date, a January 2026 roadmap naming a January 2036 ECDSA EOA flag day with EIP-7702 as the migration vector. Zero PQ code shipped; PQ algorithm not yet selected; no governance vote recorded; the bicameral Token House / Citizens' House structure is well-suited to a contested PQ migration vote that has not yet happened.
Summary
Optimism scores QRI 28 (Band 3 Planning), Migration Stage 1. The Jan 2026 OP Labs roadmap names January 2036 as the ECDSA EOA deprecation flag day, with EIP-7702 as the migration vector enabling EOA-to-smart-account delegation without address change. EIP-7702 went live in OP Stack via Isthmus (Mainnet 2025-05-09). No PQ algorithm is selected, no hybrid composition is declared, and the roadmap is 'subject to governance approval' with no Token House or Citizens' House vote recorded as of 2026-05-01. The Architecture-Execution Gap is large (48 points: Dim 4 60 vs Dim 5 12), the dominant pattern across the rollup-L2 cohort. Sequencer is centralized (single Optimism Foundation operator, Nakamoto coefficient 1 at sequencing). Mainnet-Traffic cap binds (5a=0%). Architecture-Execution Gap cap fires. Milestone-Discipline cap fires (5d voided). Supply-Chain cap fires (4 of 4 vendor tiles missing PQC roadmap). Gates 1a-Sig and 1a-KEM both FAIL. The bicameral governance structure (Token House + Citizens' House) is genuinely well-suited to a contested PQ migration vote, no comparable mechanism exists at any other rollup-L2.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no hybrid signature composition documented in OP Stack spec or roadmap; PQ scheme 'not yet decided'
- Gate 1a, Hybrid KEM: FAIL , sequencer/RPC TLS uses classical X25519/ECDH; no hybrid-KEM transport declared
- Gate 1b, Commit-to-hash: COND , Gate 1a-Sig has not declared OR-composition; nothing to commit-to-hash
- Gate 2, Evidence reconstruction: PASS , every sub-score has ≥ 3 public artifacts available within 48-hour reconstruction window
- Gate 3, Primitive naming: PASS , primitives named at sub-score level, ECDSA secp256k1, Keccak-256, BN254 alt-bn128, BLS12-381 KZG; PQ side voided rather than abstracted because OP Labs has explicitly not selected
Burn-vs-rescue policy on file
Declared option e, Optional migration via account abstraction. The Jan 2026 OP Labs post states ECDSA EOA transactions will be deprecated by January 2036, with users delegating via EIP-7702 to PQ smart contract accounts. No freeze, no STARK-rescue, no rate-limit, no automatic conversion. Funds in EOAs whose holders do not delegate by 2036 face transaction-rejection (functional freeze) but no protocol-level burn or rescue.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 36 / 100
OP Mainnet inherits Ethereum execution-layer primitives. Spec-named at primitive level for execution path; consensus path for the sequencer-set is centralized (single sequencer) and not specified at primitive granularity beyond 'ECDSA'.
ECDSA secp256k1 (EOAs) · Keccak-256 (state hashing) · BN254 alt-bn128 precompiles (L1 verification of pairing-based proofs) · Cannon FPVM: MIPS R3000 + Keccak-256 binary Merkle tree (depth 27, 32-byte leaves) · BLS12-381 KZG point-evaluation (blob verification at L1 settlement) · ECDSA secp256k1 (sequencer batch signing) ECDSA secp256k1→ Shor-break-via-DL-without-pairingsKeccak-256→ Grover-weaken (256→128)BN254 (alt-bn128 pairing)→ Shor-break-via-pairingsBLS12-381 KZG point-evaluation→ Shor-break-via-pairings (inherited at L1)
0 PQ families deployed. Classical-only: ECC (secp256k1 + BN254 + BLS12-381) + Keccak. Diversity Cap N/A only because no lattice deployed at all; the cap doesn't fire because no PQ family is deployed at 5b/5c.
None (no PQC primitives in production; PQC algorithm 'not yet decided' per OP Labs Jan 2026 roadmap post).
op-geth and op-node clients audited by Sherlock, OpenZeppelin, Trail of Bits; Cannon and fault-proof contracts audited by Spearbit, Cantina, Code4rena (the audits that surfaced bugs leading to the August 2024 permissioned revert). Constant-time: standard library (geth crypto). No formal verification of cryptographic primitives. Cryptanalytic tier: classical/established (tier 1 ECC, tier 2 Keccak).
2 Quantum Recovery Exposure weight 8% 31 / 100
Same EVM EOA model as Ethereum mainnet, pubkeys revealed only at first spend, but EIP-7702 delegations and ERC-4337 UserOps reveal authorizing pubkeys broadly. Significant TVL on EOAs.
Cold EOAs that have never spent retain pubkey hash protection (P2PKH analogue: Keccak of pubkey is the address). Risk activates only post-spend or post-7702-delegation.
Historical ECDSA signatures on the chain are forgeable post-Shor; Optimism's data-availability commitments and L1 batch-posting signatures could be replayed in adversarial historical-fork constructions.
Sequencer-to-Ethereum batch submission and RPC endpoints (Alchemy, Infura, QuickNode) terminate TLS using classical X25519/ECDH and RSA. No declared hybrid-KEM transport.
3 Metadata, Anonymity & Confidentiality weight 8% 25 / 100
Transparent EVM. Pseudonymous addresses; full graph linkable.
(i) Top-3 RPC concentration (Alchemy/Infura/QuickNode) >70% by request volume; (ii) single centralized sequencer = full mempool observability for the sequencer operator; (iii) validator metadata retention policy undeclared.
Standard OP Stack canonical bridge plus heavy use of LayerZero, Across, Hop. Source/dest correlation observable to passive observers.
No native privacy layer; baseline EVM. Shor on secp256k1 exposes signed-history attribution but no encrypted payloads to retroactively decrypt at L2.
None at protocol level.
4 Migration Architecture weight 15% 60 / 100
OP Stack ships hardforks via Security Council coordination + Token House governance; 8 named hardforks shipped (Bedrock, Canyon, Delta, Ecotone, Fjord, Granite, Holocene, Isthmus) with documented activation timestamps. Algorithm switch without user re-keying is the explicit design intent of the Jan-2026 roadmap.
EIP-7702 live in OP Stack via Isthmus hardfork (Sepolia 2025-04-17, Mainnet 2025-05-09, aligned with Ethereum Pectra). ERC-4337 broadly supported. The roadmap explicitly leverages 7702 to delegate EOA authority to PQC smart contract accounts without forcing address change. AA + documented client path; deployed AA volume non-trivial but not yet PQ-routed.
8 coordinated hardforks shipped 2023-2025 with no contested outcomes. The August 2024 permissioned-revert (post-Granite audit findings) was orderly and Security-Council-led.
OP Labs roadmap names 'the specific post-quantum signature scheme is not yet decided', no hybrid composition (AND or OR) declared, no commit-to-hash pattern documented. EIP-7702 enables hybrid at the smart-account layer in principle, but no spec lives.
N/A by default, no stateful hash schemes (XMSS, LMS) in scope; OP Labs has not committed to any specific PQ scheme. Full default credit per v3.1 rules for chains not deploying stateful hash.
Sequencer is a single Optimism Foundation-operated entity (Nakamoto coefficient 1 at consensus layer); no BFT-with-BLS-aggregation in OP Mainnet's own consensus. OP Mainnet inherits Ethereum L1 settlement which uses BLS12-381 aggregation, and the OP Labs roadmap explicitly calls for Ethereum validators to 'move away from BLS signatures and KZG commitments to post-quantum algorithms'. 4f voided here (Optimism's own consensus does not aggregate); the L1 dependency is captured in Dim 6 supply-chain inheritance. Score 0 reflects: voided/N/A at L2 but PQ-consensus inheritance from Ethereum is undeclared at OP Mainnet's own surface.
5 Deployment Execution weight 22% 12 / 100
Zero PQC signing on OP Mainnet today. Full ECDSA.
No PQC code merged in op-geth, op-node, op-batcher, op-proposer, or Cannon. Confirmed via repo scan.
Single sequencer; no PQC keys.
VOIDED per v3.1 because 5a = 0. Pre-void value would have been ~6/10: Karl Floersch's Jan 2026 post names 'By January 2036: ECDSA-signed EOA transactions will be deprecated' as a single dated milestone with enforcement-mechanism (hard fork). However v3.1 voids 5d when no PQC has shipped.
Announced PQC mentions trailing 12 months: 1 (the Jan 2026 roadmap post + ~3 derivative tweets/news echoes; counted as 1 announcement event). Shipped PQC bytes signed under named primitive on mainnet: 0. OP Labs explicitly framed the announcement as a 10-year roadmap with no immediate shipping claim, which is honest. Modest deduction for any-announcement-zero-deploy gap.
No PQ scheme selected; no published bytes-per-block analysis. Undisclosed → 0 per scoring rule.
6 Supply Chain Vendor Readiness weight 25% 12 / 100
Top-3 by OP Mainnet usage: MetaMask, Coinbase Wallet, Rabby. None has shipped PQC signing in production firmware/extension. Coinbase has published a PQ research direction (ML-DSA in MPC); not yet shipped.
Top-3: OP Stack canonical bridge, LayerZero, Across. LayerZero has stated PQ-readiness intent; no shipped PQC. Across and the canonical bridge: no public PQC roadmap.
Top-3 by OP Mainnet AUM: Coinbase Custody, Fireblocks, BitGo. Coinbase has published the most explicit MPC-PQ research direction. Fireblocks and BitGo: no shipped PQC roadmap for OP Mainnet keys. Cross-tile weak-link cap applied (worst tile = 6d at 2; best capped to ~3).
Top-3 RPC: Alchemy, Infura, QuickNode. No published PQC TLS/transport roadmap. HSMs (Thales, AWS KMS) not OP-Mainnet-specific PQ-ready. TEE attestation (Intel TDX/SGX, AWS Nitro): no PQ roadmap declared.
7 Governance & Coordination weight 10% 51 / 100
Single Optimism Foundation-operated sequencer (Nakamoto coefficient 1 at sequencing). Permissionless fault-proof challengers exist (Stage 1 since June 2024) but consensus liveness depends on one operator.
8 coordinated hardforks shipped on schedule (Bedrock through Isthmus, 2023-2025). The August 2024 audit-driven revert + Granite hardfork was executed cleanly under pressure.
Optimism Foundation + OP Labs (Karl Floersch named on Jan 2026 PQ roadmap post); Security Council exists as multisig with publicly listed members; bicameral Token House (OP holders) + Citizens' House (one-person-one-vote) is the named governance structure with mandate published in the OP Operating Manual.
2022 Wintermute white-hat bridge incident handled cleanly. August 2024 Granite audit-driven revert was an adversarial-pressure-equivalent (vulnerabilities found, no exploit). No precedent yet for a coordinated cryptographic-primitive change under active attacker.
No PQC tripwire, honeypot, or rate-limited spending rule declared.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y midpoint ≈ 2043, Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)
Z-compliance
Outside compliance window, NIST IR 8547 disallows quantum-vulnerable PK by 2035; OP Mainnet's announced 2036 ECDSA flag day is one year past NIST disallowance and, with governance-pending status, likely later
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
OP Labs' January 2026 roadmap commits to a January 2036 ECDSA EOA flag day but is 'subject to governance approval'. No Token House or Citizens' House vote on the PQ roadmap has been recorded on vote.optimism.io as of 2026-05-01, distinct from the (separately) ratified buyback proposal that closed January 28, 2026.
An L2-specific weighting that prioritizes Dim 4 (architecture) over Dim 5 (deployment), recognizing rollups can ship PQ proofs faster than L1 because the settlement primitive can be replaced independently of consensus, would lift Optimism's QRI by approximately +5 to ~33, placing it in low Band 4 Architected. The published v3.1 weighting (Dim 5 = 22%, Dim 6 = 25%) penalizes architecture-without-deployment more heavily, producing the Band 3 result.
Delta-QRI under alternative weighting
Under the L2-architecture-weighted alternative, QRI lifts +5 to ~33 (low Band 4).
Announcement-to-shipped ratio
Announced: 1. Shipped: 0. Ratio: 1.
Tag: none, OP Labs framed the announcement honestly as a 10-year future commitment, not active ship; no narrative-only inflation
Peers in the rollup-L2 profile
9 chains closest to Optimism by Stage then QRI.