Standard Ethereum/OP-Stack primitives plus World-ID-specific primitives. The World ID 4.0 protocol, whose core contracts and OPRF key registry hold bytecode on World Chain mainnet chain 480 since 2026-02-25, pins ark-groth16 0.5 over ark-bn254 0.5, a Poseidon2 implementation, a Baby Jubjub curve implementation and an EdDSA-over-Baby-Jubjub signer, and a threshold OPRF library. Its own specification states that an authenticator holds two keys: an on-chain secp256k1 key represented as an Ethereum address for contract operations, and an off-chain Baby Jubjub key that signs requests for zero-knowledge proofs. Nullifiers are produced by a verifiable threshold OPRF across a multi-party node set. Sequencer and RPC transport is standard TLS via the cloud host. Proposed, not on mainnet (Draft WIPs in the chain's own repository, 2026-05 to 2026-07): an Ed25519 precompile (RFC 8032 pure Ed25519, edwards25519, empty context, cofactored verification per ZIP-215); a multi-lane fault-proof system with an SP1 zkVM validity lane (FRI-based STARK compressed to a Groth16 or PLONK SNARK for on-chain verification), an AWS Nitro Enclave TEE attestation lane, and a Security Council threshold-signature lane, running on an alphanet; and a WLD-staked attestation overlay signing with BLS12-381 aggregated through EIP-2537 precompiles, with an Ed25519 P2P key per validator. None is a post-quantum primitive; mainnet remains on the inventory above.

Tags cover primitives in the live mainnet and live identity path. Proposed-only primitives, not tagged above because not deployed: the SP1 STARK lane would be post-quantum-safe with a Grover caveat at the proving layer, but its on-chain Groth16 or PLONK wrapper is Shor-break-via-pairings, so the deployed trust root would remain classical; the Ed25519 precompile is Shor-break-via-DL; the BLS12-381 attestation overlay is Shor-break-via-pairings; AWS Nitro attestation documents are COSE_Sign1 structures whose signatures are elliptic-curve and therefore Shor-break-via-DL, and the Security Council lane is an ECDSA threshold signature or multisig action, also Shor-break-via-DL. The one post-quantum primitive anywhere in the operator's live estate is the Kyber768 half of the hybrid Oblivious HTTP key config, which the shipped client discards; see the kem_hybrid gate.

Zero post-quantum families deployed in any chain signing, settlement or proving path. Pre-cap state. The single hybrid Kyber768 key config on identity-API transport is server-published, client-disabled and off the chain path, so it establishes no deployed family here.

No primitive maps to NIST PQC categories 1-5. Classical levels are not uniform across the stack and the card does not claim they are: ECDSA secp256k1 sits at the ~128-bit classical level, BLS12-381 at the '120+ bits' level that EIP-2537 (Final) cites as its motivation, and BN254, which carries every World ID Groth16 proof, at the 80-bit level that the same Final EIP attributes to the existing BN254 precompile. The proving curve is therefore the weakest classical link before any quantum consideration.

Maintained first-party Rust implementations: semaphore-rs and signup-sequencer for the Semaphore path, and the world-id-protocol workspace for World ID 4.0, all unarchived and actively pushed within the last six weeks. Execution client is a pinned revision of a reth fork. Three dated third-party audit artifacts are committed in the World ID protocol repository itself and are reconstructable: a Least Authority audit of the Circom circuits (2026-01-26, covering circuits extracted from an external OPRF service repository at a pinned commit, with file hashes verified against the source on copy), and two Nethermind contract audits (2026-02-24 contracts, 2026-06-26 registry verifier v2). No World-Chain-specific formal verification of the execution client or the fault-proof VM was found. Primitive-maturity tiers: Groth16 (Tier 3), BLS12-381 (Tier 1-2), ECDSA secp256k1 (Tier 1), Poseidon and Poseidon2 (Tier 4), threshold verifiable OPRF as instantiated here (Tier 4, recent construction with a single audited implementation). A 2023 Least Authority Worldcoin Protocol cryptography audit is sometimes cited; no such report could be located on the auditor's own publication index or at any candidate path, so it is not cited; the three in-repository audits above are.

Default accounts use Ethereum-style ECDSA secp256k1; the public key is recoverable from any spend via ecrecover, so every account that has ever transacted is in the exposed set permanently. Activity is heavy and sustained: L2BEAT records roughly 1.06 million operations in the past day and about 1.37 billion cumulative operations, so the exposed-key set grows continuously rather than asymptotically. PBH gives verified humans prioritised blockspace, which raises transaction frequency for exactly the population the chain is built around. The batch submitter is a single EOA that signs every batch publication to Ethereum L1, and its key is therefore permanently exposed and high-value.

Mainnet launched 2024-10-17, so roughly 22 months of history. Cold and dormant exposure is moderate given that short history, but it accumulates monotonically because every address that has spent once has revealed its public key and cannot un-reveal it. LayerQu has no verified current count of distinct World Chain addresses or of balance sitting on revealed-public-key addresses, and does not assert one. A '15M+ user base' figure is sometimes cited but is not carried: it traces to the 2024-10-17 launch announcement, where it refers to '15M World ID holders and World App users' across '160 countries' at that date, not to a count of on-chain wallets and not to any current period.

Every historical ECDSA secp256k1 transaction signature on World Chain since 2024-10-17 is forgeable post-Shor. Every Groth16 World ID inclusion proof loses soundness once BN254's pairing groups fall, because Groth16 is computationally sound only: a discrete-log break lets an adversary produce accepting proofs for false statements, so historical proofs retain no binding force. World ID 4.0 authenticator signatures are EdDSA over Baby Jubjub and fall to the same discrete-log break. Batch signatures published to Ethereum L1 are forgeable on both ECDSA secp256k1 at the submitter and BLS12-381 at L1 finality.

Sequencer and RPC transport is classical TLS via the cloud host, so recorded chain-facing traffic is harvest-now-decrypt-later exposed. AMPC iris-code shares are fragmented across third-party institutional nodes, which is information-theoretically secure against a passive adversary who sees strictly fewer shares than the threshold; the channels carrying those shares between capture devices, nodes and operator infrastructure are classical TLS and are HNDL-vulnerable for captured traffic. One point of credit, and only one, reflects a verified deployed partial mitigation on a different channel: World ID's production Oblivious HTTP key endpoints in three regions publish an HPKE key config at kem_id 0x0030 carrying an X25519-plus-Kyber768 hybrid public key alongside a classical DHKEM(X25519, HKDF-SHA256) config, so an Oblivious HTTP client that supports the hybrid codepoint gets forward-looking protection on identity-API traffic today. The credit is capped at one point because the operator's own shipped client filters the hybrid config out and negotiates X25519 only, because the codepoint is a pre-standardization Kyber768 draft rather than ML-KEM-768 per FIPS 203, and because the channel is identity-API relay traffic rather than chain, sequencer or AMPC-share transport.

Pseudonymous transparent ledger. World ID provides anonymity for the verification action, not for the transaction graph: in World ID 4.0 the OPRF nodes compute the keyed hash on a blinded input and by the protocol's own specification 'cannot learn which user is actually performing a request', but the resulting on-chain transactions remain fully visible and linkable. PBH integration marks World-ID-priority transactions with a distinguishable signal while the World ID proof itself remains zero-knowledge.

Single centralized sequencer; L2BEAT states 'The system has a centralized operator' and records that no entity other than that operator can propose blocks, and flags that MEV can be extracted if the operator frontruns users. Dominant RPC is the same vendor that hosts the chain, so mempool visibility and RPC visibility concentrate in one party. Validator metadata retention is undeclared. PBH's Rollup-Boost integration adds an external block-production path and additional metadata exposure for World-ID-priority transactions.

Standard L2-to-L1 canonical bridge to Ethereum, which exposes source-to-destination linkability classically. World Chain holds a mainnet config entry in the Superchain registry and shares the SuperchainConfig contract and Optimism Security Council per its L1 permissions, so Superchain-scoped interoperability applies; L2BEAT records live cross-chain volume and multiple interop protocols in use. Base, OP Mainnet and Blast are sometimes named as interoperable counterparties: OP Mainnet holds a registry config entry, but neither Base nor Blast appears in the Superchain registry's mainnet configs, so no named counterparty list is asserted here.

Shor against BN254 breaks Groth16 binding, so a quantum attacker could forge World ID inclusion proofs. The Merkle structure itself (Poseidon over the BN254 scalar field, Poseidon2 in the 4.0 workspace) survives as a data structure; what fails is the SNARK's binding to it. Retroactive de-anonymization of World ID actions requires both forging a proof and matching off-chain action metadata, so exposure is partial. In World ID 4.0 an additional dependency applies: nullifier unlinkability rests on the secrecy of the threshold OPRF key held across the OPRF node set, so a quantum break of the OPRF group plus recorded blinded requests would bear directly on nullifier linkability. AMPC shares remain information-theoretically secure against a passive sub-threshold adversary; the orchestration around them is classical.

No on-chain mixer, no native commit-reveal shuffle, no integrated mixnet at protocol level.

OP Stack inheritance brings Ethereum-derived agility. EIP-7702 is Final and live on Ethereum since the Pectra upgrade, which activated on mainnet 2025-05-07 at epoch 364,032 and which also shipped EIP-2537 BLS12-381 precompiles; both are inheritable into OP Stack L2s. Execution client is a pinned revision of a reth fork, modern and modular. A chain-specific Draft spec exists (WIP-1001, created 2026-03-27): a predeploy-managed native account type with a new EIP-2718 transaction envelope of type 0x1D, whose admin signer and session verifiers are pluggable EIP-1271 contracts, with the stated design principle of 'not defining signer-specific authentication as native execution paths. Signature schemes, proof systems, recovery policies, and spending policies are fully programmable.' Every reusable precompile it enumerates is classical: ecrecover, sha256, ripemd160, identity, modexp, bn254 add, bn254 scalar multiplication, bn254 pairing, secp256r1 verify per RIP-7212, EdDSA verify, BLS12-381 verify. It names no post-quantum verifier. Its reference implementation was merged in May 2026 (envelope, mempool validation and spec-alignment PRs merged 2026-05-18 to 2026-05-21) and removed again over 2026-05-27 by three removal PRs covering tests, contracts and code; the tracking issue closed 2026-05-25. A withdrawn-code Draft is a design document, not an architectural primitive in the client, so no credit moves.

ERC-4337 is supported in production: the chain's rollup-as-a-service provider states it operates the ERC-4337 bundler powering World App, and that PBH 'fully integrates with ERC-4337, allowing developers to submit user operations with PBH proofs for top-of-block inclusion'. EIP-7702 is inheritable from Ethereum. No documented client-layer post-quantum path. WIP-1001 (Draft, 2026-03-27) proposes native account abstraction with a key ring bounded by MAX_SESSION_VERIFIERS = 20 active EIP-1271 session verifier instances per account, and admin-authorized key-ring replacement as the single mutation path; Draft only, implementation withdrawn from the repository 2026-05-27, no post-quantum verifier named, not credited. World ID 4.0 adds a separate authenticator-rotation surface on-chain (authenticators can be added and removed, with a recovery-agent mechanism), but its authenticator keys are secp256k1 and Baby Jubjub, both classical.

Mainnet 2024-10-17. Inherits OP Stack hard forks; Isthmus hardfork handling is present in the chain's own chainspec and proof code (hardfork and chainspec modules, kona host and proof range modules). PBH mainnet launch in 2025, integrating Flashbots Rollup-Boost co-developed with Tools for Humanity, was a substantive coordinated upgrade. An OP Contracts v5.2 upgrade migrating PermissionedDisputeGame to a shared implementation was executed 2026-05-18 by the chain operator's multisig. Fault-dispute games still run in permissioned mode (Cannon, game type 1, exactly two permissioned addresses as proposer and challenger); the multi-lane proof-system upgrade (WIP-1005 and WIP-1006, both Draft) runs on an alphanet, not mainnet. Release cadence in 2026 has been roughly monthly from February (v1.10.1 2026-02-18, v1.11.3 2026-03-14, v2.2.0 2026-05-06, v2.3.0 2026-06-17, v2.4.0 2026-07-03, v2.4.2 2026-08-14), after a gap from 2025-11-25. These are the chain's own monorepo workspace versions; reth is pinned by git revision rather than by upstream minor version, so the cadence is the chain's own and not a reflection of upstream reth releases. Roughly 22 months operational.

OP Stack shared with Ethereum and other registry chains. The upstream OP Labs Superchain post-quantum roadmap (2026-01-14, re-verified verbatim at its primary source) documents the intended migration mechanism: EOAs delegate to post-quantum smart-contract accounts via EIP-7702, and 'The L2 sequencer and batch submitter will transition off ECDSA signatures to post-quantum signatures.' It states 'The specific post-quantum signature scheme is not yet decided' and 'We don't yet know whether the NIST-standardized lattice-based signatures are the best long-term choice'. It plans to 'Run overlapping support for ECDSA and post-quantum paths during the migration window', which is dual-path coexistence during a transition and not a declared AND or OR hybrid composition over a single authentication decision. It is announced only: no hybrid-signature specification exists and no PR in the OP Stack specs repository references post-quantum signatures as of 2026-08-20. The chain's own WIP-1001 Draft would make a classical-plus-post-quantum pair an installable verifier rather than a scheme replacement, but it names no post-quantum verifier and its code was withdrawn. Dim 4 scores architectural primitives present in the client, not claims about future capability, so the score is unchanged. The PBH bundler design could in principle accept hybrid-signature transactions if account-abstraction wallets deployed them; no World Chain-specific proposal exists.

No stateful hash-based signature schemes deployed or proposed, so no one-time-key state-management hazard exists. Default 15/15.

Rollup-based: the sequencer aggregates transactions and settles to Ethereum L1, so the BFT-aggregation surface is Ethereum L1 finality (BLS aggregate signatures over BLS12-381). No World Chain-specific post-quantum aggregation path is declared, and the chain inherits Ethereum's aggregation question without a separate commitment. WIP-1008 (Draft, created 2026-07-13) proposes a WLD-staked validator overlay of up to 128 active validators whose attestations are BLS12-381 signatures, verified in aggregate through EIP-2537 precompiles, forming a certificate at a 2/3-of-active-stake quorum, with an Ed25519 P2P key per validator. If activated it would bring 4f into scope at the L2 layer with no post-quantum aggregation path declared; the proposal does not mention one. Draft only; 0 stands.

0% of sequencer signing, account signing, batch settlement, World ID Groth16 proving or World ID nullifier generation runs on a post-quantum primitive. The one post-quantum key material anywhere in the operator's production estate is the Kyber768 half of an Oblivious HTTP key config on identity-API transport, which is not chain traffic, is not a signature, and is filtered out by the operator's own client, so it contributes no mainnet post-quantum traffic on any reading.

The execution client (a pinned reth fork) and the OP Stack contain no merged post-quantum primitive. The World ID stack uses Groth16 over pairing curves, Baby Jubjub EdDSA and a group-based threshold OPRF; no FRI-based or post-quantum proof-system code runs on mainnet. GitHub code search across the worldcoin organization on 2026-08-20 returns zero results for post-quantum, ML-DSA, Dilithium, SPHINCS, Falcon and SLH-DSA. It returns non-zero results for Kyber (1), ML-KEM (2) and XMSS (2); each was opened and none is a post-quantum primitive in a consensus, execution, signing or proving path. The XMSS hits are base64 substrings inside sha512 integrity digests in two JavaScript lockfiles. The ML-KEM hits are the ml-kem 0.3.0-rc.1 Rust crate reaching one Cargo.lock transitively as a dependency of an SSH library pulled in by a test-container harness, annotated in that repository's own dependency-policy file as dev-only and not affecting usage. The Kyber hit is a CI workflow whose sole function is to strip Kyber HPKE key configs out of fetched Oblivious HTTP key material. The SP1 zkVM fault-proof lane in the monorepo (FRI-based STARK, compressed to a Groth16 or PLONK SNARK for on-chain verification) is alphanet-only, is not a signature or KEM primitive, and terminates in a pairing-based on-chain verifier.

Single centralized sequencer, a single batch-submitter EOA, and exactly two permissioned addresses in the dispute game; 0 post-quantum consensus keys among them. The proposed staked validator overlay would use BLS12-381 and Ed25519 keys, both classical, and is Draft only.

VOIDED to 0 per v3.1 rule (5a = 0). The upstream OP Labs Superchain post-quantum roadmap (published 2026-01-14, re-verified verbatim) carries one dated enforcement milestone, 'By January 2036: ECDSA-signed EOA transactions will be deprecated. Every ECDSA EOA must have delegated its key management to a post-quantum smart contract account', qualified as 'subject to governance approval'. It is an OP Labs publication that does not name World Chain in its primary text, names no post-quantum signature scheme, carries no interim dated testnet milestone, and has no shipped World Chain code behind it. World Chain's own eight Draft WIPs and the World ID protocol's four Draft WIPs contain no post-quantum milestone. With 5a = 0 the sub-score is voided regardless of the milestone being citable.

World Foundation's own AMPC page (first published 2025-09-04, updated 2026-05-08) describes the setup as 'quantum secure multi-party computation' in its single quantum-related sentence, naming no algorithm, no key size and no parameter set anywhere on the page; industry commentary extends this to a 'quantum-resistant identity protocol' on the basis of AMPC plus zero-knowledge proofs plus fragmented biometric storage. AMPC and zero-knowledge proofs protect iris-code privacy classically, but the on-chain stack is fully Shor-vulnerable. Conservative -2 deduction for the framing gap; not at the >1.5 ratio cap. The upstream OP Labs roadmap is framed as a 10-year plan with the scheme undecided and is not counted toward the deduction. The deduction is held at -2 rather than deepened because the same operator ships an unadvertised post-quantum hybrid key configuration on its identity relay, which is the opposite of overselling, and because the AMPC page makes no explicit claim about the chain's signatures.

Undisclosed. No post-quantum scheme has been selected at either the chain or the upstream Superchain level, so no signature-size, verification-cost or throughput impact has been published or can be derived.

World App is the dominant first-party wallet and its account-abstraction path runs through the chain host's ERC-4337 bundler; the wallet SDK and its supporting repositories are actively maintained. EVM-compatible third-party wallets are supported. No wallet in this set has published a World-Chain-specific post-quantum roadmap. One directly relevant negative signal sits in the first-party wallet SDK itself: it encountered a post-quantum hybrid HPKE key configuration on its own identity relay and shipped a maintained filter to strip it, documenting the reason as a library-support limitation rather than a migration plan.

Standard L2-to-L1 canonical bridge to Ethereum, plus Superchain-scoped interoperability under a shared SuperchainConfig contract. No bridge operator, canonical or third-party, has published a World-Chain-specific post-quantum migration timetable. LayerQu does not name specific third-party bridge counterparties here because no primary source enumerating them for this chain was reconstructable.

Named tier-1 custody coverage for WLD rests only on secondary explainer pages that could not be re-verified, and under LayerQu's reconstruct-in-48-hours rule an unreconstructable roster earns no credit, so no custodian is named here. What remains verified is the negative finding: no custodian has published a World Chain-specific post-quantum migration timetable, and no custody-side key-rotation or post-quantum signing commitment touching this chain was found. Residual credit reflects only that WLD is a widely listed asset with institutional handling in practice.

RPC is dominated by the same vendor that hosts the sequencer, with third-party and public endpoints alongside. Key custody for the chain's in-development proof services moved onto a cloud KMS in the 2026-08-12 release, which added KMS-backed transaction signers to both the SP1 and Nitro proof workers; cloud KMS signing is classical and its vendor has published no post-quantum attestation-chain roadmap that covers this path. TEEs: the AMPC layer for iris-code processing relies on third-party node fragmentation and publishes no TEE attestation chain as part of a consensus path; the proposed fault-proof upgrade adds an AWS Nitro Enclave attestation lane (COSE_Sign1 attestation documents with PCR allow-lists) on an alphanet, with no post-quantum attestation chain named by any vendor. No post-quantum roadmap exists on any infrastructure tile. A vendor-published availability figure is not evidence of cryptographic migration readiness and carries no weight here, and the same tracker that lists this infrastructure also records a 4h54m gap in state updates on 2026-08-17 against a roughly hourly norm, so operational-maturity credit is limited.

Single centralized sequencer; the tracker records that no entity other than the operator can propose blocks. Censorship resistance rests on an L1 force-transaction path with up to a 12-hour delay. State roots come from a single whitelisted proposer under permissioned Cannon fault-dispute games, where the dispute-game contract designates exactly two permissioned addresses as proposer and challenger; L2BEAT states 'Only one entity is currently allowed to propose and submit challenges, as only permissioned games are currently allowed', lists the chain as 'not even a Stage 0 project' pending a node-software review, and records both no exit window and no delay on code upgrades. Upgrade authority sits with the chain operator's 5-of-8 multisig alongside a shared Optimism Security Council and Guardian. Nakamoto coefficient 1 at sequencing and at proposing. Decentralized sequencing and a staked attestation overlay (WIP-1008, Draft) are proposed, not delivered.

Mainnet 2024-10-17. Inherits OP Stack hard forks, with Isthmus handling present in the chain's own chainspec and proof code, and follows Superchain-wide contract upgrades; the OP Contracts v5.2 dispute-game migration was executed 2026-05-18 by the operator's multisig and a shared SuperchainConfig upgrade landed 2026-07-06. PBH mainnet launch in 2025. Node releases ran roughly monthly through 2026 (v1.10.1 2026-02-18, v1.11.3 2026-03-14, v2.2.0 2026-05-06, v2.3.0 2026-06-17, v2.4.0 2026-07-03, v2.4.1 2026-08-12, v2.4.2 2026-08-14) after a gap from 2025-11-25. A public improvement-proposal process has been live in the chain repository since 2026-03-27 with eight Draft WIPs, alongside four Draft WIPs in the World ID protocol repository since 2026-03-18. Multiple coordinated upgrades landed on schedule; none yet under adversarial time pressure. Short operational history of roughly 22 months.

Named organizations are verifiable and distinct: Tools for Humanity as the development organization and named co-developer of the Rollup-Boost sequencing component, the World Foundation as the self-described 'steward of World', the rollup-as-a-service host as chain operator and holder of the upgrade multisig, and an external company named in the World ID protocol's own deployment file as managing the multisig that owns the OPRF key registry. Every Draft WIP in both repositories carries named authors with public handles, so technical ownership per proposal is attributable. No named post-quantum migration working group and no post-quantum lead role exists for World Chain or for World ID. OP Stack governance runs upstream, and the upstream post-quantum roadmap is explicitly conditioned on a governance approval that had not occurred at publication. Two individual executives are sometimes named as chain leadership; neither could be confirmed from a primary source, so no individual attribution is asserted here; the organizational and per-proposal attributions above are what the record supports, which are directly reconstructable.

No major adversarial-pressure coordination event for World Chain specifically, and no exploit-driven hard fork on the chain. The wider Worldcoin protocol has faced regulatory pressure in multiple jurisdictions over biometric data, but that pressure is protocol- and product-level and produced no chain-level emergency coordination precedent that would evidence readiness under time pressure.

No published rate-limit canary, no cryptographic tripwire, no dedicated early-warning mechanism, no community honeypot. The chain repository's security section describes standard vulnerability disclosure only.