What it is. zkSync Era lets every account act like a tiny program that can pick its own way of checking signatures, so an individual account can switch to quantum-resistant protection on its own without waiting for the whole network to change.
What we found. That switch is built and easy to flip, but nobody has actually flipped it: the part that guards real user money is still the old kind a future quantum computer could break, and the team's claim that its newest proof technology is fully quantum-safe only covers an internal step, not what protects your account.
Why it matters. Anyone holding or building here is leaning on protection that a powerful future quantum computer could forge, and the popular wallets, bridges, and custody services still have no published plan to fix it, so the ready-but-unused switch buys you nothing until someone turns it on.
zkSync Era has a strong PQ migration substrate (native AA + a proof system already moved twice through full prover-stack swaps + a literally-PQ-safe inner proof in Airbender), and the deployment surface for what users actually rely on is essentially untouched. Architecture-Execution Gap is 33 (Dim 4 60 − Dim 5 27). Era is the canonical 'PQ-ready architecture, PQ-empty execution' rollup.
Summary
zkSync Era scores QRI 28 (Band 3 Planning, ± 6), Migration Stage 1. The chain's substrate: native account abstraction from genesis lets every smart account choose its own signature validator without a protocol fork, and Matter Labs has executed two full prover-stack migrations (legacy PLONK to Boojum to Airbender). Airbender's inner proof, live in production via the Atlas upgrade, uses DEEP STARK / FRI over Mersenne31 with Blake2s and Blake3 hashes, hash-based, conjectured PQ-safe at the proof-soundness layer. The on-chain verifier on Ethereum L1 remains FFLONK-on-BN254, which is Shor-breakable, and zero post-quantum signatures ship at the user, sequencer, or proposer layer. Gate 1a-Sig and Gate 1a-KEM both fail. The Mainnet-Traffic, Architecture-Execution Gap (33), and Milestone-Discipline caps fire. Top-3 wallets, bridges, custodians (with the partial BitGo-Prividium exception), and RPC providers have no published PQC roadmap. The deployment surface that users rely on is essentially untouched. Era is the canonical 'PQ-ready architecture, PQ-empty execution' rollup.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no documented hybrid signature composition shipped at user-EOA, smart-account validator, sequencer, or proposer level; AA makes hybrid trivial to deploy; nothing is deployed
- Gate 1a, Hybrid KEM: FAIL , validator gossip, RPC, sequencer feed all use classical X25519/P-256/RSA TLS; no documented hybrid PQ KEM
- Gate 1b, Commit-to-hash: COND , Gate 1a-Sig fails outright; commit-to-hash test does not apply
- Gate 2, Evidence reconstruction: PASS , every active sub-score has 3+ public artifacts
- Gate 3, Primitive naming: PASS , every primitive named, ECDSA secp256k1, secp256r1 / P256Verify, Keccak-256, Poseidon, Blake2s, Blake3, FRI/STARK, FFLONK-on-BN254, X25519/AES-GCM/SHA-256). 1d voided per Gate 3 (no NIST PQC primitive deployed = nothing to map
Burn-vs-rescue policy on file
Declared option e, Optional migration via per-account AA rotation (implicit, undeclared in formal governance text). Native AA architecturally enables every smart account to rotate to a PQ validator without coordinated chain action; there is no published declaration that this is the policy, no freeze/burn fallback for accounts that fail to rotate, and no rate-limit canary. Implicit-(e), formally undeclared.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 43 / 100
zkSync Era publicly enumerates most primitives across user, prover and settlement layers.
ECDSA secp256k1 (default user signatures via native AA validator) · secp256r1 / WebAuthn via P256Verify precompile · EIP-1271 (smart-contract signatures) · Keccak-256 (state hashing, Ethereum-compatible) · Poseidon (in-circuit hash, Boojum/legacy) · Boojum 1.0 STARK with FRI over Goldilocks-style field, wrapped at end into PlonK/FFLONK SNARK over BN254 pairing-friendly curve · Airbender (mainnet via Atlas upgrade, late 2025): DEEP STARK/FRI over Mersenne31 prime field, Blake2s + Blake3 in-circuit hash, FFLONK-on-BN254 on-chain SNARK wrapper · Ethereum settlement, blob/calldata DA, validator/sequencer TLS inherit standard classical primitives The proof-system architecture is hybrid in mathematical structure but not in security: the on-chain verifier is BN254-pairing-based (Shor-vulnerable). Matter Labs claims Airbender is 'resilient against quantum threats' but this applies to the FRI inner proof, not to the on-chain FFLONK wrapper that L1 actually verifies, nor to user signatures.
ECDSA secp256k1→ Shor-break-via-DL-without-pairingssecp256r1 (P256Verify precompile)→ Shor-break-via-DL-without-pairingsKeccak-256→ Grover-weaken (256→128-bit preimage)Poseidon (in-circuit hash, Boojum/legacy)→ Grover-weaken (Tier-4 cryptanalytic maturity)Blake2s/Blake3 (in-circuit hash, Airbender)→ Grover-weaken (Tier-2 maturity)BN254 pairing curve (FFLONK final wrapper, on-chain L1 verifier)→ Shor-break-via-pairings, soundness of on-chain proof verification depends on the BN254 discrete-log assumptionFRI/STARK inner layer (Boojum and Airbender)→ PQ-safe (hash-based, conjectured)BLS12-381 (inherited via Ethereum settlement and EIP-2537 precompile)→ Shor-break-via-pairingsSHA-256 / X25519 / AES-128-GCM (TLS, validator gossip, RPC)→ Grover-weaken / Shor-break
Families: 1 (hash). Hash-based primitives are present in production within the inner proof layer (Boojum FRI, Airbender FRI/STARK). No lattice, code-based, or isogeny family is deployed. No PQ signature scheme (ML-DSA, Falcon, SLH-DSA, XMSS) ships at the user, sequencer, or proposer level. The hash-only inner proof is genuine PQ deployment for a narrow surface (proof soundness against a quantum prover) but does not extend to the user signature path, the on-chain verifier wrapper, or KEMs.
zkSync Era has not deployed any NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA) primitive. No public mapping exists at any subsystem. Per Gate 3, this sub-score is voided to 0.
zkSync verifier and circuit code receives independent audits (OpenZeppelin, Spearbit, Code4rena, ChainLight published findings including a 2023 ZK-EVM soundness bug), but no machine-checked formal proofs of cryptographic primitives are published; Boojum and Airbender circuit security relies on academic FRI/STARK literature plus internal review. constant_time: standard Rust implementations (era-boojum, zksync-airbender) without dudect / Formosa-grade attestation. library_provenance: matter-labs/era-boojum (archived; succeeded by zksync-crypto), matter-labs/zksync-airbender (MIT). Cryptanalytic_tier: Tier 1 for ECDSA secp256k1; Tier 2 for Keccak-256 / Blake2s / Blake3; Tier 4 for Poseidon.
2 Quantum Recovery Exposure weight 8% 19 / 100
zkSync Era TVL is approximately $0.16–$0.30B as of Q1 2026 per L2BEAT. EOAs use ECDSA secp256k1; smart accounts likewise default to ECDSA validators in widely deployed wallets. Public keys are revealed on first signed transaction. All actively used balances are exposed to Shor-class forgery once a CRQC exists. Native AA does enable per-account migration to alternative signature schemes once a verifier contract exists, but no PQ verifier is shipped or live today.
zkSync Era live since 2023-03-24 (~37 months). Bridge contract balances, dormant accounts, and treasury holdings sit at ECDSA-derived addresses. As with Ethereum, the address is Keccak-256(pubkey)[12:32] so the pubkey is not directly revealed by the address, but any prior outbound transaction exposed it. ZKsync Lite shutdown on 2026-05-04 forces Lite users to migrate or withdraw, partially compressing the dormant surface but not eliminating it for Era.
Historical user ECDSA signatures, sequencer batch commitments, and the FFLONK-on-BN254 final-proof signatures recorded on Ethereum L1 are all Shor-forgeable post-CRQC. No retro-signing, freeze-window, or PQ-wrapping mechanism for historical state-root attestations is documented.
Public RPC endpoints (Matter Labs, Alchemy, QuickNode, Ankr, Chainstack) and validator/sequencer gossip use standard TLS 1.3 (X25519/P-256 ECDHE + AES-GCM). No hybrid PQ KEM is documented at any zkSync transport layer. The rollup itself publishes state diffs as Ethereum calldata or blobs (public), so consensus material is not HNDL-vulnerable; HNDL surface is the operator-side TLS.
3 Metadata, Anonymity & Confidentiality weight 8% 16 / 100
Transparent EVM-style ledger; full transaction graph is public via block explorers. Pseudonymous addresses only.
Sequencing is performed by a single Matter Labs sequencer (whitelisted proposer per L2BEAT). Public RPC concentrated among Matter Labs RPC, Alchemy, QuickNode, Ankr, Chainstack. No public mempool, transactions are sent to the sequencer and only become observable when committed in a batch on L1. Validator metadata retention as a formal published policy is not declared.
Canonical bridge produces direct L1↔L2 linkage observable on Ethereum. Third-party bridges (LayerZero, Across, Stargate, Synapse) and Elastic Network interop (v29 messaging upgrade 2025-10-06; v31 in audit) make cross-chain hops traceable via passive observation.
No shielded pools natively on zkSync Era. The Prividium privacy stack (institutional, deployed 2026 Q1) is a separate Elastic Network chain rather than a feature of Era itself. Era's pseudonymity has the standard property: Shor on secp256k1 enables key recovery from any revealed pubkey, retroactively linking historical activity if any off-chain identity binding exists.
No protocol-level mixer integrated into zkSync Era.
4 Migration Architecture weight 15% 60 / 100
Two independent forms of production crypto-agility. (1) Native account abstraction from genesis: every account is a smart contract that can implement custom signature validation. The chain natively supports ecrecover, EIP-1271, and the P256Verify precompile for secp256r1 / WebAuthn, multiple non-ECDSA validators are already in production. A PQ verifier (ML-DSA, Falcon, SLH-DSA) could be added as a custom Solidity/Yul validator without any protocol fork. (2) The proof system has been migrated once already, from PLONK-on-BN254 (legacy) to Boojum 1.0 (FRI inner + FFLONK wrapper) on protocol version v27, and is migrating again to Airbender (Atlas upgrade, late 2025), demonstrating end-to-end prover-stack swap discipline.
Strongest native AA story of any production EVM-compatible chain alongside Starknet. Smart Accounts are fully programmable; signature schemes, multi-sig, spending limits, and paymaster sponsorship are first-class. Key rotation is a contract-level operation. Documented client-layer PQ migration path is not published. Score 16 reflects strong AA + partial client-layer narrative through Airbender's PQ inner proof and Prividium's pluggable interop.
Multiple coordinated upgrades without contested forks: Boojum activation (2023-07-17), v24 prover upgrade, v27 (legacy prover stack removed), v29 interop messaging (2025-10-06), v29.3/v29.4 patch upgrades (Q1 2026), Atlas upgrade introducing Airbender + new sequencer (late 2025), v31 interop in audit. Governance flows through ZK Nation governor on Era itself with token-holder voting, Security Council and Guardians, plus Emergency Upgrade Board (3/3 multisig).
Hybrid deployment is architecturally trivial via native AA, a smart account can validate both an ECDSA and a PQ signature, including AND-composition (require both) or OR-composition (accept either). No public reference implementation, audit, or testnet of such a hybrid validator is documented. Airbender PQ-safe inner proof is itself a single-family pure replacement at the proof-soundness layer, not a hybrid. Architecturally ready, formally undeclared.
zkSync Era does not use any stateful hash signature scheme (no XMSS, LMS, leanXMSS) at user, sequencer, or settlement layers. Stateless schemes only.
zkSync Era has no BLS-aggregation-based BFT consensus at L2; sequencing is a single whitelisted Matter Labs operator and settlement reuses Ethereum L1 finality. The chain's L2 consensus is not a BFT committee with aggregated PQ signatures, so 4f is N/A; rendered as 0 with N/A flag rather than penalized.
5 Deployment Execution weight 22% 27 / 100
Mainnet PQC %: ~0% at user signature layer; non-zero at proof-soundness inner layer (Airbender FRI/STARK is 'post-quantum proof' per Matter Labs Q1 2026 deliverables). Zero PQ user signatures observed on mainnet. The Airbender inner proof generation is hash-based (Blake2s/Blake3 + FRI over Mersenne31) and runs in production via the Atlas upgrade, but the on-chain proof verifier on Ethereum L1 is FFLONK-on-BN254 (Shor-vulnerable). The PQ surface is therefore real but partial.
matter-labs/zksync-airbender (MIT, public) is shipped, audited, and running in production, STARK/FRI hash-based primitives (Blake2s, Blake3, Mersenne31 field arithmetic) are present in the most-used prover stack. matter-labs/era-boojum likewise ships hash-based FRI in legacy production. No ML-DSA, Falcon, SLH-DSA, XMSS code is merged in the user-facing zksync-era client. Partial credit for proof-side PQ code, no credit for signature-side.
Matter Labs operates a single sequencer with a classical ECDSA L1 batch-poster key. ZKnomics Staking Pilot Season 1 with 300M+ ZK staked is described as 'laying the technical groundwork for a future decentralized sequencer'. No validator/sequencer holds a PQ signing key today.
VOIDED to 0 per v3.1 rule (5a effectively zero at user signature layer, well below the 20% threshold). The 2026 roadmap exists but does not name dated, enforcement-mechanism-backed PQ-signature milestones (no 'Era v32 will activate ML-DSA on date X' governance proposal exists at ZK Nation). Airbender's PQ-readiness is claimed as a property today, not a future milestone with deadline.
Ratio: ~2.0. Announced PQ surface (trailing 12 months): Airbender '100% post-quantum proof' (Q1 2026 deliverables, mirror.xyz launch post, multiple X posts), Airbender main marketing page 'resilient against quantum threats', Boojum framed historically as 'post-quantum path.' Shipped PQ surface: Airbender FRI/STARK inner proof in production (real); FFLONK-on-BN254 on-chain wrapper (not PQ); zero PQ user signatures (not PQ). The '100% post-quantum proof' framing applies to the inner-layer prover, not to end-to-end on-chain verification, and the marketing copy does not consistently distinguish.
No PQ signature scheme deployed → no measured per-block PQ footprint to publish. Architecturally, native AA gives smart accounts complete control over the validator contract, so a Falcon-512 (~10–11× ECDSA), ML-DSA-44 (~38× ECDSA raw), or SLH-DSA-128s (~110–125× ECDSA) validator can be deployed per-account without protocol changes. Calldata cost on Ethereum settlement bounds the per-tx PQ footprint, and AA paymasters can sponsor that cost. Awarded 10/20 reflecting '5–10× expected for Falcon-style with AA-validator amortization, undeclared in formal specification.'
6 Supply Chain Vendor Readiness weight 25% 5 / 100
Top-3 zkSync Era wallets (MetaMask + Snap, Rabby, Safe, plus native AA wallets like Argent and Clave) have no published PQC roadmap as of 2026-05-01. WebAuthn / passkey support exists (P256Verify precompile), useful for UX but not PQ.
Top-3 (Canonical Era bridge, LayerZero, Across), no published PQC roadmap. LayerZero's classical-ECDSA / Ed25519 oracle and relayer architecture remains. Elastic Network Hyperbridges and the v31 interop upgrade do not specify PQ primitives.
Top-3 (BitGo via Q1 2026 Prividium partnership, Coinbase Custody, Anchorage). BitGo's MPC custody architecture is structurally amenable to PQ retrofitting (key-shares can be regenerated under a PQ scheme). No public PQC roadmap from any of these custodians as a formal commitment. Awarded 5 to reflect the BitGo-Prividium institutional partnership creating concentration on a custodian with a regulated-finance posture.
Matter Labs RPC, Alchemy, QuickNode, Ankr, Chainstack, no published PQC roadmap. HSMs used for batch-poster keys (Ledger, AWS KMS, Thales) operate under classical ECDSA. No TEE attestation chain integration documented for zkSync Era.
7 Governance & Coordination weight 10% 40 / 100
L2 sequencing is a single Matter Labs sequencer (Nakamoto coefficient = 1 for L2 sequencing). L1 settlement inherits Ethereum's distribution. ZK token governance has ~1.13B ZK active voting power and ZKnomics Staking Pilot at 300M+ ZK staked, but this governs upgrades, not real-time consensus.
Multiple coordinated protocol upgrades shipped under industry-watch conditions: Boojum activation (2023), v27 prover swap, v29 interop messaging (2025-10-06), Atlas / Airbender (late 2025), v29.3/v29.4 patches (Q1 2026), v31 in audit. Established standard path (~10-day governance) and emergency path (3/3 multisig). No contested fork.
Matter Labs (Alex Gluchowski as CEO/founder, public-facing) plus the ZK Nation governance system (Token Assembly, Security Council, Guardians). Dedicated PQ working group or named PQ-cryptography lead is not publicly identified at zkSync, Airbender is presented as a Matter Labs prover team output without a named PQ-migration WG mandate.
No documented adversarial-pressure cryptographic upgrade; Boojum and Airbender migrations were planned, not adversarial. Sequencer outages (notably 2024 multi-hour halt) tested operational coordination but not cryptographic-change coordination under attack.
No published canary, honeypot, or rate-limited spending rule for cryptographic-break detection at zkSync Era.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X+Y midpoint ~2036, Crisis Zone (vs Z10 2030); Outside risk window at upper end (vs Z25 2035)
Z-compliance
Outside compliance window at upper-bound, NIST IR 8547 deprecation 2030 / disallowance 2035; X+Y midpoint past 2035 in slow case
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
One alternative-weighting view treats native AA as a stronger weight in Dim 4 because per-account migration is the canonical mechanism for PQ rollout on EVM, raising Dim 4 from 60 to ~75 and pulling QRI to ~30 (still bound by Mainnet-Traffic cap).
A second view discounts the Airbender 'post-quantum' claim entirely on the ground that on-chain proof verification remains BN254-pairing-based, which would push 1b down by ~3 and 5a/5b down by ~3 each, pulling QRI to ~25.
Delta-QRI under alternative weighting
Under alternative weighting, QRI shifts ±3 around the 28 point estimate.
Announcement-to-shipped ratio
Announced: 7. Shipped: 3. Ratio: 2.
Tag: borderline at >2.0 threshold for QRI cap 65; conservative reading places it at 'moderate, not narrative-only'. Cap not applied above the Mainnet-Traffic cap (60), which already binds. The 'Airbender 100% post-quantum proof' framing applies to the inner-layer prover, not to end-to-end on-chain verification (FFLONK-on-BN254 wrapper is Shor-breakable).
Peers in the rollup-L2 profile
9 chains closest to zkSync Era by Stage then QRI.