What it is. Soneium is a fast network for apps and tokens, owned and operated by Sony, that records its activity onto Ethereum, and Sony decides who is even allowed to write to it.
What we found. For a company with deep research muscle, Sony has put none of it toward making this chain safe against the code-breaking computers expected in the coming years, and the only safety it can point to is a plan built by the toolkit makers that Sony has never agreed to follow here.
Why it matters. The millions of wallets and transactions on Soneium sit under tight Sony control, yet that control has not been used to lock in a defense, so holders and builders are trusting a plan that was written by someone else and adopted by no one.
Sony-backed OP Stack Optimistic rollup on Ethereum, mainnet 2025-01-14, built and operated by Sony Block Solutions Labs (Sony Group / Startale JV) with single centralized sequencer. Standard EVM/OP Stack inheritance: ECDSA secp256k1, Keccak-256, BN254, BLS12-381 KZG. Zero PQ shipped, zero PQC roadmap. Inherits OP Labs January 2026 roadmap by default Superchain mechanics; not chain-affirmed.
Summary
Soneium is a Sony-backed OP Stack Optimistic rollup on Ethereum, mainnet live 2025-01-14 (chain ID 1868), built and operated by Sony Block Solutions Labs (a Sony Group / Startale JV) with a single centralized sequencer and a 3/6 multisig controlling sequencer/batch-submitter/preconfer addresses. Cryptographic stack is the standard EVM/OP Stack inheritance: ECDSA secp256k1 user signing, Keccak-256 hashing, BN254 alt-bn128 precompiles, BLS12-381 KZG at L1 settlement, Cannon FPVM. Soneium has shipped zero post-quantum cryptography, published zero PQC roadmap of its own, and has no recorded statement from Sony Group, Sony Block Solutions Labs or Startale on quantum readiness for the chain layer. The chain participates in coordinated Superchain hardforks (Isthmus activated 2025-05-09 mainnet), which means it inherits EIP-7702 EOA delegation as architectural runway and, by default Superchain inheritance, the post-quantum roadmap announced by OP Labs in January 2026. No Soneium-specific affirmation of that inheritance has been published. Stage: 0. Raw QRI: 13. After-cap QRI: 13. Band: 2 (Acknowledged) by inheritance of OP Labs roadmap; would be Band 1 (Unaware) on chain-specific evidence alone. Confidence plus-minus 10. Key uncertainties: (a) whether Soneium will adopt OP Labs' January-2036 ECDSA flag day or diverge as Base did 2026-02-18; (b) whether CRYPTREC inclusion of ML-KEM (April 2026) will translate into Sony-side PQ pressure on Soneium; (c) Sony Group and Startale have published no chain-level PQ statement.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no hybrid signature composition AND or OR documented at Soneium chain level or via inherited OP Stack spec
- Gate 1a, Hybrid KEM: FAIL , sequencer/RPC TLS uses classical X25519/ECDH; compliance-approved-RPC restriction does not introduce hybrid-KEM transport
- Gate 1b, Commit-to-hash: COND , Gate 1a-Sig has not even declared OR-composition
- Gate 2, Evidence reconstruction: PASS , every non-voided sub-score has ≥3 public artifacts within 48-hour reconstruction window
- Gate 3, Primitive naming: PASS , primitives named: ECDSA secp256k1, Keccak-256, BN254 alt-bn128, BLS12-381 KZG
Burn-vs-rescue policy on file
Declared option f, Undeclared. Soneium has not published a chain-specific position on what happens to dormant funds at user EOAs in a quantum scenario. The OP Labs Superchain roadmap names optional migration via account abstraction (EOAs delegate via EIP-7702 to PQ smart accounts; non-delegators face transaction-rejection ≈ functional freeze) as the inherited path; Soneium has not affirmed inheritance.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 28 / 100
Soneium does not publish chain-specific cryptographic-primitives document, primitives documented via OP Stack specs at specs.optimism.io.
ECDSA secp256k1 (EOA signing) · Keccak-256 (hashing/RLP/Merkle-Patricia) · BN254 alt-bn128 precompiles (pairing-based proof verification) · BLS12-381 KZG point-evaluation (Ethereum L1 batch settlement, post-Pectra/Isthmus) · Cannon FPVM (MIPS R3000 + Keccak-256 binary Merkle tree) ECDSA secp256k1→ Shor-break-via-DL-without-pairingsKeccak-256→ Grover-weaken (256→128-bit preimage)BN254 alt-bn128 (pairing)→ Shor-break-via-pairingsBLS12-381 KZG point-evaluation→ Shor-break-via-pairings (inherited at L1 settlement)X25519/ECDH on RPC TLS→ Shor-break-via-DL
0 PQ families deployed. Classical-only: ECC + Keccak.
No NIST FIPS 203/204/205 PQC primitive deployed.
Soneium runs op-geth and op-node, which have audit history at OP Labs level. No chain-specific Soneium audit of cryptographic stack published. No formal verification of cryptographic primitives. Tier 1 ECC, Tier 2 Keccak.
2 Quantum Recovery Exposure weight 8% 25 / 100
Standard EVM EOA model. Soneium reports >500M transactions and >5M active wallets since mainnet launch (Startale public statement); active EOAs reveal secp256k1 pubkeys at first spend.
Cold EOAs that never spent retain Keccak-of-pubkey hash protection. Risk activates only post-spend or post-EIP-7702-delegation.
Historical ECDSA signatures on Soneium's chain history are forgeable post-Shor; sequencer batch-poster signatures and L1 state-root output proposer signatures equally so.
Public RPC endpoints (rpc.soneium.org, Alchemy, Infura) terminate TLS using classical X25519/P-256 ECDHE + AES-GCM. Compliance-approved RPC endpoints only (mainnet effective 2025-10-28) centralizes RPC authentication. No documented hybrid PQ KEM transport.
3 Metadata, Anonymity & Confidentiality weight 8% 18 / 100
Transparent EVM. Pseudonymous addresses; full graph publicly indexable via soneium.blockscout.com. Sunnyside Labs Privacy Boost announced 2026-04-28 (hybrid ZK+TEE), not yet shipped on mainnet at evidence cutoff.
Top-3 RPC concentration severe, Soneium operates compliance-approved sequencer-write-path RPC. Compliance-approved-RPC restriction (mainnet 2025-10-28) further concentrates auth-bearing traffic. Single centralized sequencer = full mempool observability.
Standard OP Stack canonical bridge plus LayerZero, Stargate V2, Symbiosis, brid.gg. Source/destination pairing observable to passive observers.
No native privacy layer at evidence cutoff. Baseline EVM. Privacy Boost (Sunnyside Labs) will introduce shielded ZK-enabled flows; until shipping this is hypothetical for Soneium specifically.
None at protocol level.
4 Migration Architecture weight 15% 58 / 100
Soneium inherits OP Stack hardfork mechanics. Coordinated Isthmus hardfork activated on Soneium Minato (2025-04-17) and Soneium Mainnet (2025-05-09) as part of first Superchain-wide upgrade. EIP-7702 EOA delegation live.
ERC-4337 supported; EIP-7702 live via Isthmus. Startale ships EIP-7702 developer guide (Startale Cloud Services / SCS). The Startale App targets account-abstraction onboarding. No PQ verifier shipped at smart-account layer.
Mainnet only ~16 months old at evidence cutoff. Has shipped at least one Superchain-wide hardfork (Isthmus, May 2025) cleanly. Compliance write-restriction rolled out testnet (2025-09-24) → mainnet (2025-10-28) on schedule.
No Soneium-specific hybrid composition declared. Inherits OP Labs January 2026 PQ-scheme-not-yet-decided ambiguity. EIP-7702 enables hybrid at smart-account layer in principle, with Startale SCS as candidate execution surface; no spec, no testnet integration.
N/A by default, no stateful hash schemes (XMSS, LMS) in scope.
N/A, Soneium has single Sony-Block-Solutions-Labs-operated sequencer (NC=1); no BFT-with-BLS-aggregation in Soneium's own consensus.
5 Deployment Execution weight 22% 14 / 100
Zero PQC signing on Soneium mainnet. Full ECDSA. No PQ KEM in TLS.
Soneium runs op-geth and op-node. No ML-DSA, ML-KEM, SLH-DSA, Falcon, XMSS, or SPHINCS+ implementation. No Soneium-specific client fork ships PQ code.
Single Sony Block Solutions Labs sequencer; standard secp256k1 keys. No validator set on Soneium proper.
VOIDED per v3.1 because 5a = 0. Inherited Optimism Superchain roadmap names January 2036 ECDSA EOA transactions deprecated but Soneium has not affirmed inheritance with a Soneium-specific milestone.
Trailing-12-month PQC announcement count from Soneium-controlled channels: 0. Shipped PQ on Soneium mainnet: 0. Cleanest possible washing posture. Corporate parents (Sony Group, Sony Block Solutions Labs, Startale) have similarly issued no chain-PQ statement.
No PQ signature deployed; no mainnet bytes-per-block multiplier observable.
6 Supply Chain Vendor Readiness weight 25% 10 / 100
Top-3 by Soneium usage: MetaMask, Rabby, Startale App (which embeds Coinbase Smart Wallet patterns). None has shipped PQ signing in production for Soneium. Trezor Safe 7 ships ML-DSA-44 device attestation but only at firmware-integrity layer.
Top-3: OP Stack canonical bridge (L1StandardBridge), LayerZero, Stargate V2/Symbiosis. LayerZero has published quantum-durability intent; no shipped PQC DVN configuration on Soneium.
Top-3 by Soneium AUM-relevance: Coinbase Custody, Fireblocks, BitGo. Coinbase Custody has most-developed public PQC posture (announced quantum-proof institutional custody product targeting late 2026, ML-DSA in MPC research direction); not shipped.
Top-3 RPC: rpc.soneium.org (Sony Block Solutions Labs operated), Alchemy, dRPC/Infura. AWS KMS shipped ML-DSA-44/65/87 (FIPS 204) signing 2025-06. Sony Group operates significant in-house HSM capacity but no Soneium-specific PQ HSM documented. Sunnyside Labs Privacy Boost uses TEE+ZK hybrid, but underlying TEE attestation chains remain classical.
7 Governance & Coordination weight 10% 30 / 100
Single Sony Block Solutions Labs-operated sequencer (NC=1). Permissioned dispute game. 3/6 multisig manages updates. Compliance write-restriction (mainnet 2025-10-28) further centralizes. No validator set.
Mainnet ~16 months old. One Superchain-wide coordinated hardfork participated cleanly (Isthmus, May 2025). Compliance write-restriction rollout executed on schedule. No adversarial-pressure hardfork yet.
Sony Block Solutions Labs (Singapore JV: 90% Sony Group / 10% Startale) is the named operator. Sota Watanabe (Startale Group CEO, Astar Network founder) publicly identified as director. Sony Group Corporation is corporate-parent backer. No designated PQ lead or PQ working group.
No precedent yet for coordinated cryptographic-primitive change under active attacker. Compliance write-restriction was regulatory-pressure response, not adversarial-cryptography.
No PQC tripwire, honeypot, or rate-limited spending rule declared at chain level.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y midpoint ~2043, Outside risk window (vs Z25 2035); Crisis Zone (vs Z10 2030)
Z-compliance
Outside compliance window for NIST 2035; on the line for Japan 2035
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Soneium's documentation contains no PQC statements; primary inheritance signal is the Optimism / OP Labs January 2026 Superchain post-quantum roadmap. Whether a non-OP-Labs Superchain participant inherits the roadmap by default Superchain mechanics or only by chain-team affirmation is currently ambiguous. Base's 2026-02-18 separation announcement explicitly opted out, demonstrating the option to diverge. Soneium has neither affirmed nor opted out at evidence cutoff.
Compliance write-restriction (mainnet 2025-10-28) further centralizes write authorization to approved RPC endpoints only. This is the strongest L2 chain-team censorship-policy precedent in the v3.1.0 cohort.
Delta-QRI under alternative weighting
+4, alternative-weighting that prioritizes Dim 4 (architecture) over Dim 5 (deployment) would lift Soneium's QRI to ~17 (still within Band 2 Acknowledged).
Announcement-to-shipped ratio
Announced: 0. Shipped: 0. Ratio: 0.
Tag: none, Soneium has not over-promised at chain level. Sony Group has substantial PQC-relevant R&D capacity but none has translated to a chain-PQ statement for Soneium.
Peers in the rollup-L2 profile
9 chains closest to Soneium by Stage then QRI.