What it is. Solana is a fast, fully public chain whose own team said in April 2026 that no change to its security is needed yet or likely for a while.
What we found. Every Solana account leaves its full identifying key out in the open the moment it is used, so a future quantum computer could forge spending from any wallet, even ones that have sat untouched for years.
Why it matters. No holder can hide behind an unused address, and the only protection actually running so far is a tiny optional add-on, so anyone holding for the long term is betting the real defense arrives before the threat does.
Anza and Firedancer have independently selected Falcon (FN-DSA, lattice) as the future post-quantum signature scheme, with initial implementations in both clients' GitHub repositories, but no protocol-level PQ has shipped. Every Solana address is an Ed25519 public key with no hash wrapper, so 100% of accounts expose their public key on first use. The September-2025-approved Alpenglow upgrade introduces BLS12-381 aggregate consensus signatures via Votor, bringing Solana into 4f scope where its PQ-safe aggregation path is undeclared.
Summary
Solana scores QRI 26 (Band 3 Planning), Migration Stage 1. The Solana Foundation's 2026-04-27 quantum-readiness post confirms Anza and Firedancer have independently selected Falcon (FN-DSA, lattice) as the future post-quantum signature scheme, with initial implementations in both clients' GitHub repositories. No protocol-level PQ has shipped. The September-2025-approved Alpenglow upgrade (SIMD-0326) introduces BLS12-381 aggregate consensus signatures via Votor; this brings Solana into Dim 4 4f scope where its PQ-safe aggregation path is undeclared. Account-level exposure is structurally severe: every Solana address is an Ed25519 public key with no hash wrapper, so 100% of accounts expose their public key on first use. Mainnet-Traffic cap binds (5a near 0% mainnet PQC traffic). Milestone-Discipline cap binds (5d voided to 0). Supply-Chain cap binds (all four vendor tiles lacking PQC roadmaps). announcement-to-shipped ratio is ~4/1 (announcements vs shipped), triggering the cap-65 threshold, non-binding because raw QRI sits at 26. The Blueshift Winternitz Vault, third-party, opt-in, hash-based, mainnet for 2+ years, is the only deployed PQ artifact and provides a small but real shipped-under-named-primitive datapoint.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition; Falcon roadmap is parallel-introduction-then-migration, not co-signing
- Gate 1a, Hybrid KEM: FAIL , validator gossip and RPC TLS continue to use classical X25519 / RSA / ECDH; no hybrid PQ KEM declared
- Gate 1b, Commit-to-hash: COND , no OR-composition declared
- Gate 2, Evidence reconstruction: PASS , every sub-score reconstructible from listed public artifacts within 48 hours
- Gate 3, Primitive naming: PASS , every sub-score names specific primitives, Ed25519, BLS12-381, SHA-256, Keccak-256, Falcon, Winternitz/WOTS-Keccak-256, ML-DSA, SLH-DSA
Burn-vs-rescue policy on file
Declared option f, Undeclared. Foundation roadmap states migration of existing wallets in phase 3 but does not specify a freeze, rescue, hybrid client-layer, or rate-limit canary policy for accounts that fail to migrate.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 15% 36 / 100
Inventory well-documented and specific.
Ed25519 (EdDSA over Curve25519), all account / transaction / off-chain message signing · SHA-256, Proof-of-History (PoH) hash sequence · Keccak-256, syscall used by programs · BLS12-381 aggregate signatures, consensus voting via approved Alpenglow upgrade (SIMD-0326), with SHA-256 as companion hash · Proof-of-History (cryptographic primitive, not signature scheme; consensus-critical) Every signature-bearing primitive in the live stack and approved successor stack is Shor-vulnerable. No PQ-safe primitive is in protocol use.
Ed25519→ Shor-break-via-DL-without-pairingsBLS12-381 (Alpenglow/Votor)→ Shor-break-via-pairingsSHA-256 (PoH and Alpenglow hash)→ Grover-weakenKeccak-256→ Grover-weaken
Families in active core protocol: 0 PQ families (Ed25519/BLS12-381 both classical-DL/pairing). The Solana Winternitz Vault deploys hash-based family on mainnet as opt-in third-party Solana program, not native, not core, app-level only. Anza and Firedancer have published initial lattice (Falcon) implementations in their GitHub repositories as of January 2026; not deployed. Counting only protocol-level live PQ families, total is 0. We score 5 to credit the opt-in hash-based program without inflating to 'hash-only mainnet'.
Ed25519 → 128-bit classical, 0 NIST-PQC category; BLS12-381 → ~128-bit classical, 0 NIST-PQC; SHA-256 → ~128-bit post-quantum (Grover-weaken). No NIST PQC scheme is mapped at protocol level. Falcon (FN-DSA) is referenced in client implementations but not deployed.
Ed25519 implementations in Agave (ed25519-dalek, Rust) and Firedancer (C/C++) are constant-time per upstream library convention; no machine-checked formal verification of validator-client signing path published; Keccak-256 syscall well-tested in production; BLS12-381 introduced via Alpenglow inherits standard production libraries; no published cryptanalytic-tier audit chain specific to Solana clients. Cryptanalytic maturity tier 1 (classical ECC + SHA-2).
2 Quantum Recovery Exposure weight 10% 20 / 100
100% of Solana accounts use the Ed25519 public key directly as the 32-byte address (no hash wrapper). Every account that has ever received or sent funds has its full public key on-chain by definition. There is no P2PKH-equivalent protection. Full TVL is post-Shor forgeable.
Same exposure profile as 2a, there is no architectural distinction between 'moved' and 'unmoved' coins; the public key is the address whether the account has signed once or never. Lost / dormant SOL is fully exposed.
Solana transactions are typically single-purpose authorizations rather than long-lived contractual artifacts. Historical signature replay does not create new spend authority because nonce/recent-blockhash binding expires. Long-term forgery risk concentrates on key-not-rotated accounts (very common) rather than on stored signatures.
Validator gossip (UDP-based Turbine, Gossip), QUIC (TLS 1.3) for transaction submission, and HTTPS RPC endpoints at top providers all use classical X25519 / RSA / ECDH key exchange. No hybrid PQ KEM declared in the validator stack or RPC layer. No mempool encryption of public-mempool content (mempool is public). HNDL surface is bounded but undeclared.
3 Metadata, Anonymity & Confidentiality weight 13% 34 / 100
Pseudonymous, fully transparent. Every transaction, account, and program interaction is publicly readable from any RPC node or block explorer. No protocol-level shielding.
RPC layer is concentrated among Helius, QuickNode, Triton One. No public per-provider stake-weighted percentages are foundation-published. Mempool is observable via leader-schedule TPU forwarding (no encrypted mempool). Validator metadata retention policies are not protocol-mandated.
Wormhole, deBridge, and the legacy Portal flow expose source-to-destination transactions in the clear. Passive observers can link cross-chain flows trivially because both sides are public.
Because the chain is already pseudonymous-transparent, a Shor break does not expose meaningfully more than is already public. Retroactive privacy regression is small relative to chains with on-chain encrypted state.
No protocol-level mixnet, shuffle, or commit-reveal at consensus. Application-layer privacy tools (Light Protocol compressed accounts, Elusiv historically, defunct since 2024) do not score here for protocol-level credit.
4 Migration Architecture weight 10% 36 / 100
Ed25519 is hard-coded in the protocol; adding a new signature type requires a SIMD + validator-client upgrade + feature gate. Alpenglow (SIMD-0326, approved September 2025 governance vote) demonstrates the chain can change consensus signatures (Ed25519 votes → BLS12-381 aggregates), establishing one production-track example of signature-scheme switch. No general-purpose signature-algorithm switch primitive at the account layer.
Solana has no native account abstraction in the EIP-7702 sense. Program-Derived Addresses (PDAs) provide program-controlled signing but do not provide arbitrary user-key rotation under a stable address. New signature schemes for users would require a new address format. Client-layer Falcon implementations in Anza and Firedancer GitHub repos are research-stage, not deployed.
Coordinated upgrades via feature gates and SIMDs in last 3 years. History of network outages 2022-2023 is operational, not governance. Recent governance has been tractable (Alpenglow approved by stake-weighted referendum).
Transaction size constraints (raised toward 4,096 bytes per recent SIMD work) accommodate larger signatures. No published hybrid-envelope spec. Phantom and Ledger reportedly host developer builds with dual Ed25519 + Dilithium keypairs (referenced in third-party coverage), but no foundation-confirmed dual-signature wallet path on mainnet.
Falcon (announced target) is stateless (full credit by default per v3.1 rule). The Winternitz Vault is stateful one-time but app-level and out of consensus scope.
Solana under Alpenglow (SIMD-0326, approved September 2025) introduces BLS12-381 aggregate consensus signatures via Votor. This brings Solana into Dim 4 4f scope. No PQ-safe successor for the aggregation path is declared (no hash-based + SNARK pathway, no MPC consensus alternative, no staged-PQ-checkpoint declaration). The Falcon roadmap (announced 2026-04-27) addresses account-level signing, not consensus aggregation.
5 Deployment Execution weight 22% 19 / 100
Mainnet PQC %: <0.1%. The Solana Winternitz Vault (Blueshift) is deployed on mainnet as an opt-in third-party program; Google Quantum AI cited it in 2025 as an example of a deployed quantum-resistant primitive on a major chain. Volume is a tiny fraction of Solana's tx flow. No protocol-level PQC traffic.
Anza and Firedancer have committed initial Falcon implementations to GitHub since at least 2026-01-27. Code is present but not enabled, not behind a live feature gate, not running in mainnet consensus.
0% of stake operates a PQC validator key. All validator votes are Ed25519 today; under Alpenglow, BLS12-381.
The 2026-04-27 Solana Foundation post outlines a three-phase plan but publishes no dated milestones and explicitly states 'no change is required today or likely anytime soon.' Per v3.1 rule 5d is voided to 0 because 5a = ~0.
Trailing 12-month announcement count (foundation post + two-team Falcon convergence + Project Eleven testnet partnership + Winternitz Vault citation by Google Quantum AI ≈ 4 announced items). Shipped on mainnet under named primitive: 1 (Winternitz Vault, opt-in, low volume). Ratio ≈ 4/1. Above the 1.5 threshold (10pt deduction); below the 2.0 threshold (QRI cap 65).
Ed25519 signatures are 64 bytes. Falcon-512 signatures are ~666 bytes (~10× Ed25519); Falcon public keys are 897 bytes (~28× Ed25519 public key). ML-DSA at 2,560-byte signatures (~40× Ed25519) and SLH-DSA at 7,856 bytes (~123× Ed25519). Project Eleven testnet experiments reportedly observed PQ signatures '20-40× heavier' than current signatures. Reference falls into 5-10× band for Falcon-only; 10-38× for ML-DSA. Score 10 (5-10× midband) anchored to the announced primary candidate Falcon.
6 Supply Chain Vendor Readiness weight 22% 11 / 100
Top-3: Phantom, Solflare, Backpack. Third-party coverage cites Phantom and Ledger 'developer builds' with dual Ed25519 + Dilithium keypairs; not foundation-confirmed and not on the official Phantom roadmap page. Solflare and Backpack: no published PQC roadmap. Ledger has stated PQC research interest but no production Solana Falcon support.
Top-3: Wormhole, deBridge, Portal/Allbridge. No published PQC roadmaps from any. Bridge classical-ECDSA / Ed25519 signing is unchanged.
Top-3 by visible Solana flow: Coinbase Custody, Fireblocks, BitGo. Fireblocks has published PQC research material; no production PQC custody for Solana. Coinbase Custody and BitGo: no Solana-specific PQC roadmap.
Top-3 RPC: Helius, QuickNode, Triton One, no PQC roadmaps. HSM vendors (Ledger HSM, Thales) and TEE attestation chains used in MEV / oracle paths: no Solana-specific PQC declarations.
7 Governance & Coordination weight 8% 46 / 100
Nakamoto coefficient ≈ 20 (held stable through 2025-2026 per third-party trackers). Client diversity has improved: Agave/Jito-Agave family, Frankendancer (Firedancer networking + Agave runtime), full Firedancer (C/C++) live mainnet December 2025, Sig (Zig, Syndica, reads-optimized). Largest single client family (Agave-derived Jito) commands a large share, concentration risk persists.
Recovered from 2022-2023 outages, executed feature gates routinely, and ratified Alpenglow via stake-weighted referendum in September 2025.
Solana Foundation + Anza (the Solana Labs successor entity) + Firedancer (Jump Crypto) co-coordinate. The 2026-04-27 quantum-readiness post is foundation-published with both teams aligned on Falcon. No single named PQC working-group lead with a published mandate.
Post-FTX recovery (2022) and validator-coordination across multiple outages demonstrate pressure-response. No PQC-specific adversarial coordination test.
No published canary, honeypot, or rate-limited spending rule for quantum compromise. Project Eleven Q-Day prize is an industry-wide bounty, not a Solana-embedded tripwire.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y reaches 2034–2041, Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)
Z-compliance
Outside compliance window, median migration completion (~2037) past both NIST 2030 and 2035 milestones
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
One outlet reported '~90% network slowdown' with PQ signatures; another reported 'no major performance trade-offs.' We score 5f using specific byte-size figures rather than either outlet's headline claim.
Phantom and Ledger 'developer builds' with dual Ed25519 + Dilithium keypairs cited in third-party coverage; not foundation-confirmed via official Phantom or Ledger roadmap pages. Treated as unverified for 6a.
Elevating Dim 6 supply-chain to 25% (rollup-L2-style) and reducing Dim 1 to 12% would shift weighted sum down to ~24, band stays 3 (Planning). The score is robust to weighting choice within profile-defined ranges.
Delta-QRI under alternative weighting
Under alternative weighting (Dim 6 → 25%, Dim 1 → 12%), QRI shifts to ~24; band stays 3.
Announcement-to-shipped ratio
Announced: 4. Shipped: 1. Ratio: 4.
Tag: >2.0, QRI cap 65 fires (non-binding because raw QRI 26 sits below cap). Includes deployed Winternitz Vault as 1 shipped under named primitive.
Peers in the L1 profile
9 chains closest to Solana by Stage then QRI.