What it is. This network runs on top of Ethereum, and the math it uses to prove its transactions is already of a kind that future quantum computers cannot easily break.
What we found. The proving side is future-safe, but the part that lets people sign and move their own money still relies on today's breakable keys, and almost nobody has switched to a safer option even though every account here can do so on its own without waiting for a network-wide change.
Why it matters. A holder's money rests on the weaker, unswitched side, so the safe proving layer does not protect anyone's coins until they or their wallet provider actually adopt a quantum-safe way to sign.
Starknet is the cleanest 'structurally PQ-advantaged' rollup-L2 in the wave: ~100% of the proof layer is FRI-based (PQ-safe-by-family) since the S-two prover went live on mainnet 2025-11-03, and native account abstraction makes signature-scheme migration per-account rather than hard-fork. ~0% of user signatures are PQ, the proof-layer/signature-layer asymmetry is structural.
Summary
Starknet QRI 35 (Band 4 Architected), Migration Stage 1. The S-two prover (Circle STARK over the M31 Mersenne field, FRI-based) went live on Starknet mainnet 2025-11-03 replacing Stone, proof-layer is structurally PQ-safe by family. Native account abstraction from genesis means signature-scheme migration is per-account contract logic, not protocol fork; S2morrow demonstrates Falcon-512 PQ-signed accounts working end-to-end across Devnet/Sepolia/Mainnet target environments. The headline asymmetry: ~100% of the proof layer is FRI-based (PQ-safe-by-family); ~0% of user signatures are PQ. Sequencer is centralized today (3 Starkware-operated nodes in v0.14.0 Grinta rotation since 2025-09-01); validator-set decentralization targeted Q1 2026 (Staking v3) and 2026 (Staking v4). Mainnet-Traffic cap binds (5a < 1% on user-signature path). Architecture-Execution Gap cap fires (Dim 4 = 73, Dim 5 = 28, gap = 45). Both Gates 1a-Sig and 1a-KEM FAIL. Migration Stage 1 due to milestone discipline + supply-chain absence; no foundation-confirmed dated PQ deployment.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition at default account level; AA permits any combination per account contract, but none is the protocol-level default
- Gate 1a, Hybrid KEM: FAIL , no hybrid KEM in RPC TLS or sequencer transport; standard X25519/ECDHE-P256/RSA
- Gate 1b, Commit-to-hash: COND , Gate 1a-Sig has not declared OR-composition
- Gate 2, Evidence reconstruction: PASS , every sub-score reconstructible from cited public artifacts
- Gate 3, Primitive naming: PASS , every primitive named with mechanism, ECDSA-over-STARK-curve, Pedersen-over-STARK-curve, Circle-STARK-with-FRI-over-M31, Poseidon, Keccak-256
Burn-vs-rescue policy on file
Declared option e, Optional migration via per-account AA. Native AA makes per-account migration the default substrate: every account holder can swap signature scheme at their own discretion once a PQ verifier is published. No declared protocol-level burn/freeze of unmigrated balances. No declared rate-limit canary. No declared STARK-rescue analogue (Starknet itself is the STARK rescue surface other chains contemplate).
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 61 / 100
Starknet publicly names every active primitive.
ECDSA over the STARK curve (default user signatures) · ECDSA over secp256k1 / secp256r1 / multisig (configurable per account contract via native account abstraction) · Pedersen hash over STARK curve (legacy in storage tries / state commitments) · Poseidon (Cairo-native, ZK-friendly) · STARK prime felt252 = 2^251 + 17·2^192 + 1 · S-two (Circle STARK over M31 Mersenne prime field, since 2025-11-03, replacing Stone) · Blake2 as in-prover hash (per third-party catalog) · Keccak-256 (EVM-interop) Proof layer is structurally PQ-safe (FRI-based STARK, hash bound). User-signature layer and Pedersen-based commitments are Shor-vulnerable.
STARK-curve ECDSA→ Shor-break-via-DL-without-pairingssecp256k1 ECDSA→ Shor-break-via-DL-without-pairingssecp256r1 ECDSA→ Shor-break-via-DL-without-pairingsPedersen hash (over STARK curve)→ Shor-break-via-DL-without-pairings (DL binding compromised; collision resistance Grover-weakened)Poseidon→ Grover-weaken (research-grade tier-4 hash)Keccak-256→ Grover-weakenS-two / Circle STARK with FRI→ PQ-safe (FRI-based, hash-bound; Grover-weakened only)Stone (legacy STARK, retired 2025-11-03)→ PQ-safe (FRI, hash-bound)
Hash-based count = 1 deployed. No lattice / code / isogeny family at signature layer in mainnet production. S2morrow (lattice-Falcon) demo and BTQ Falcon-on-Starknet verification exist but neither is the default account scheme. Diversity Cap (lowered to 60 in v3.1) does not fire here because there is no second family deployed at 5b/5c, credit for hash-based proof layer caps at 10 (hash-only).
STARK-curve ECDSA ≈ 125-bit classical / 0-bit PQ for signatures; Pedersen ≈ ~125-bit classical (DL-bound on STARK curve); Poseidon ≈ 128-bit classical hash, research-tier; S-two FRI ≈ 128-bit hash-bound conjectured PQ. No NIST-standardized PQ primitive is mainnet-active in user-signature path. Proof layer aligns with hash-based PQ assumptions but is not a NIST-certified primitive.
Cairo verification toolchain exists (Lean-based and Cairo-native auditing tools, third-party audits of Stone and S-two referenced); constant_time: standard for Stark-curve ECDSA implementations; library_provenance: scure-starknet (paulmillr, audited); statefulness: stateless schemes throughout; cryptanalytic_tier: tier-1 ECDSA, tier-2 Keccak/Blake2, tier-4 Poseidon (research-grade ZK hash), Pedersen tier-1 by hardness (DL) but binding broken by Shor.
2 Quantum Recovery Exposure weight 8% 51 / 100
Every account is a contract; signing key is held by the account-contract owner. Native AA permits per-account key rotation, social recovery, and signer-scheme upgrade, so active-key Forge exposure is structurally lower than EOA chains. But the default scheme is STARK-curve ECDSA, public key recoverable from any signed transaction. ~$573M TVL (Apr 2026, includes ~$214M BTC) sits at addresses whose owners' signing pubkeys are revealed on first spend.
Chain age ~3.5 years (testnet 2021, mainnet alpha 2021-11; STRK token 2024-02). Smaller dormant-coin surface than L1s. AA gives dormant accounts a re-key path ONCE owners act, but unmoved accounts whose keys are now lost remain Shor-vulnerable.
Historical STARK-curve ECDSA signatures are post-Shor forgeable. Inclusion-validity is, however, settled by FRI-based STARK proofs (PQ-safe), so historical state-transition integrity is independent of Shor-breaking the signature curve. Re-org via signature forgery is moot once a block is L1-final (Ethereum settlement).
RPC and validator/sequencer transports use standard TLS 1.3 (X25519, ECDHE-secp256r1, RSA cert chains). No hybrid PQ KEM in deployed RPC stack. StarkGate L1↔L2 messaging is plaintext on-chain; bridge does not introduce PQ-relevant encryption surface. Sequencer gossip is centralized today (Starkware-operated).
3 Metadata, Anonymity & Confidentiality weight 8% 27 / 100
Pseudonymous, transparent ledger; full tx graph visible via L2 explorers (Voyager, Starkscan) and by inspection of L1 blob/calldata.
Top-3 RPC providers (Alchemy, Infura, Blast API) concentrate >70% of inbound traffic. Mempool gossip observability, sequencer mempool visible to Starkware-operated nodes. Validator metadata retention policy not publicly declared.
StarkGate canonical bridge correlates L1↔L2 addresses by message-passing contract. Third-party bridges (Orbiter, LayerSwap) compound source-dest correlation across chains.
No mainnet shielded pool. Retroactive de-anon under Shor is limited to: (i) recovery of STARK-curve / secp256k1 private keys from public keys, allowing historical address-to-owner attribution if any off-chain identity link existed; (ii) Pedersen commitment binding broken (relevant for application-layer commitments, not transaction privacy). Tx graph itself is already public.
No structural mix layer. No on-chain commit-reveal scheme as a default. Privacy efforts on Starknet are application-layer prototypes; no mainnet privacy-default.
4 Migration Architecture weight 15% 73 / 100
Native AA from genesis means signature-scheme migration is per-account contract logic, not protocol fork. New signature verifier (e.g., Falcon-512, ML-DSA) ships as a library/contract; account contracts opt in. S2morrow (Falcon-512) demonstrates this end-to-end without protocol change. Protocol-level hash agility (Pedersen→Poseidon) is more constrained because Pedersen commitments are baked into state-trie binding.
Strongest AA in the evaluated set. Every account is a smart contract since day one; per-account signature scheme, per-account rotation, multisig, social recovery deployed on mainnet by Argent X and Braavos for years. S2morrow demonstrates Falcon-512 PQ-signed account-contract working in browser across Devnet/Sepolia/Mainnet target environments. No client-layer PQC integrated path declared at sequencer/prover level.
Multiple coordinated upgrades: Cairo v1 migration (Regenesis, 2023-2024), v0.13 series, v0.14.0 Grinta (2025-09-01) introducing distributed sequencer and consensus, S-two prover swap (2025-11-03). No contested forks.
Architecturally trivial via AA, an account contract can require AND-composed STARK-curve + Falcon signatures, or OR-composed with commit-to-hash. No mainnet hybrid signature scheme is the default account class today. Foundation roadmap mentions 'quantum-resistant cryptography' in Phase 4 without dates or composition spec.
No stateful-hash scheme (XMSS/LMS) in scope. Stateless schemes (Stark-curve ECDSA, Falcon, Poseidon) throughout.
Starknet's v0.14.0 introduced a 3f+1 distributed-sequencer consensus (CometBFT-derived). Validator signatures in this consensus path are documented as ECDSA / Ed25519 family (not BLS aggregation). No PQ aggregation path spec'd. Spec exists for the consensus layer; PQ migration of consensus signatures is not declared.
5 Deployment Execution weight 22% 28 / 100
Mainnet PQC %: estimated <1% of user signatures; ~100% of proof-layer artifacts are FRI-based (PQ-safe by family). v3.1.0 5a is defined on user-signature traffic; Starknet's structural FRI proof-layer is PQ-safe but is not a 'signature.' Conservative score reflects no mainnet PQ signature default.
S-two (Circle STARK, FRI-based, PQ-safe-by-family) is the production prover since 2025-11-03, that is shipped PQ-safe code in the proof path. No ML-DSA / Falcon / SLH-DSA verifier in any default account class. S2morrow Cairo verifier is publicly available (97.8% Cairo) but is research code by labelling.
Sequencer is operated by Starkware (3 sequencers in rotation as of v0.14.0, all Starkware-run). Decentralized sequencer-validator set targeted for 2026 (Staking v3/v4). No PQ keys in current sequencer signing path.
VOIDED to 0 per v3.1 (5a effectively zero in user-signature path). Count of enforcement-mechanism-backed milestones with PQ dates: 0 (roadmap mentions 'quantum-resistant cryptography' in Phase 4 with no dates).
Announced PQ-related claims trailing 12mo: ~10-15 (S-two-is-PQ-safe blog posts, 'Starknet has the answer,' BTCFi quantum framing, S2morrow demo coverage). Shipped PQ on user-signature path: 0. Shipped PQ on proof path: 1 (S-two production). Estimated ratio ≈1.5×; below the >1.5 deduction threshold borderline.
VOIDED (undisclosed at production-signature level, no PQ scheme is the default; S2morrow Falcon-512 measured at 9.5M L2 gas, 62 felts calldata, 65% savings vs secp256r1 in the demo, but this is not the production signing footprint).
6 Supply Chain Vendor Readiness weight 25% 0 / 100
Argent X (Ready), Braavos, Ledger (via wallet integrations). PQC roadmap published by named top-3 vendor: 0. Braavos and Argent describe themselves as 'smart contract wallets' with future-proof signature swap; neither has shipped a PQ default or published a dated PQ roadmap.
StarkGate (canonical), Orbiter, LayerSwap. PQC roadmap: 0.
Coinbase Custody, BitGo, Anchorage. None has published Starknet-asset-specific PQ roadmap.
Alchemy, Infura, Blast API top-3 RPC. None ships PQC-enabled RPC TLS. HSM/TEE provenance for sequencer keys not publicly disclosed.
7 Governance & Coordination weight 10% 40 / 100
Sequencer set = 3 nodes, all Starkware-operated. Nakamoto coefficient at sequencer layer = 1. STRK-staking validator set exists for attestation but does not yet sign blocks at consensus quorum (Staking v3 targeted Q1 2026).
Cairo v1 migration, Regenesis, v0.14.0 Grinta, S-two swap all coordinated without contested fork. Demonstrated upgrade capacity is high.
Starknet Foundation (executive director public, board public); Starkware (Eli Ben-Sasson founder). No named PQ-migration working group with published mandate. Roadmap names Phase 4 quantum but no lead.
STRK launch 2024 had governance turbulence (airdrop disputes); no demonstrated coordinated cryptographic change under live attacker pressure.
No canary, honeypot, or rate-limit tripwire embedded in consensus declared.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y reaches 2034–2048, Crisis Zone (vs Z10 2030); Outside risk window at central case (vs Z25 2035)
Z-compliance
Outside compliance window, median X+Y (~2040) > 2035 NIST disallowance
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Foundation framing emphasizes proof-layer PQ-safe-by-construction. An alternative-weighting view that treats user-signature path as primary (since user funds depend on it) would score the deployment dimension lower; under user-signature-only definition of 5a/5b, delta-QRI ≈ -7 → QRI ~28 (Band 3 Planning).
Stwo / S-two prover went live on Starknet mainnet 2025-11-03, replacing Stone. It is Circle STARK over the M31 Mersenne field, FRI-based; third-party catalogs (L2BEAT) list Blake2 as the in-prover hash. Foundation S-two announcement does not explicitly name the hash function in the public blog post, caveat.
Delta-QRI under alternative weighting
Under user-signature-only definition, QRI drops to ~28 (Band 3); central case 35 (Band 4).
Announcement-to-shipped ratio
Announced: 13. Shipped: 1. Ratio: 1.5.
Tag: borderline (~1.5×), no automatic deduction; close to threshold. Depends on whether one counts proof-layer FRI as 'shipped PQC'. Under strict signature-only definition, ratio would be much higher.
Peers in the rollup-L2 profile
9 chains closest to Starknet by Stage then QRI.