QRC Scoring Methodology

Methodology Overview

Quantum computers pose a significant threat to cryptocurrency security. Within the next decade (estimated 2030-2035), sufficiently powerful quantum computers may be able to break the cryptographic signatures that protect virtually all major cryptocurrencies today.

The QRC score combines seven distinct security factors, each measuring a different aspect of quantum resistance:

#	Component	Weight	What It Measures
1	Signature Resistance	35%	Can quantum computers forge your signature?
2	Consensus Security	15%	Does the network survive if signatures break?
3	Key Protection	15%	How much value has exposed keys?
4	Crypto-Agility	12%	How quickly can the chain upgrade?
5	Hash Strength	8%	Are the hash functions secure?
6	Pairing-Free Status	8%	Does it avoid BLS/KZG vulnerabilities?
7	Operational Mitigations	7%	What practical security measures exist?

Higher scores indicate greater quantum resistance. A score of 100 represents a fully quantum-resistant protocol. A score near 0 indicates critical vulnerability requiring immediate attention.

Risk Bands

Final scores map to three risk categories, indicated by colored indicators in the leaderboard:

1. Signature Resistance (35%)

What it measures: The quantum resistance of the digital signature algorithm used to authorize your transactions. When you send cryptocurrency, you prove ownership by creating a digital signature with your private key.

The core question: Can a quantum computer forge my signature and steal my funds?

Signature Algorithm	Score	Status
XMSS (hash-based)	95	Quantum-resistant, NIST recommended
Dilithium (ML-DSA)	95	NIST FIPS 204 standard, lattice-based
SPHINCS+ (SLH-DSA)	95	NIST FIPS 205 standard, hash-based
Hybrid (Classical + PQC)	50-75	Transitional security
ECDSA (secp256k1)	5	Broken by Shor’s algorithm
Ed25519	5	Broken by Shor’s algorithm
BLS Signatures	5	Pairing-based, broken by Shor’s
Schnorr	5	Elliptic curve, equally vulnerable

Why 35% weight: Signature vulnerability is the most direct quantum threat. A broken signature scheme means attackers can forge transactions and steal funds. No other mitigation fully compensates for vulnerable signatures.

2. Consensus Security (15%)

What it measures: Whether the network’s block production mechanism depends on digital signatures. This component asks: If signatures are broken, can the blockchain still operate?

Consensus Type	Category	Score	Network Survives Quantum?
XMSS Native	Hash-Based	98	Yes – quantum-resistant signatures
Proof of Work	Hash-Based	95	Yes – hash computation, no signatures needed
Proof of Authority	Signature-Based	45	No – authorities must sign blocks
Delegated PoS (DPoS)	Signature-Based	40	No – delegates must sign blocks
Tendermint BFT	Signature-Based	38	No – validators must sign blocks
Standard PoS	Signature-Based	35	No – validators must sign blocks
PoS with BLS	Signature-Based	25	No – BLS aggregation adds vulnerability

3. Key Protection (15%)

What it measures: What percentage of a cryptocurrency’s total value has exposed public keys that a quantum attacker could target. A quantum computer can only attack a key if it knows the public key.

Blockchain	Model	Exposure	Score
QRL	UTXO + OTS	~5%	95
Bitcoin	UTXO	~35%	65
Solana	Account	~85%	15
Ethereum	Account	~88%	12

UTXO model (Bitcoin): Public keys are only revealed when you spend. If you receive to a fresh address and never spend, your public key remains hidden. Bitcoin’s ~35% exposure means ~65% of supply is protected.

Account model (Ethereum): Public keys are revealed on your first outgoing transaction and remain exposed forever. Users cannot retroactively protect themselves.

4. Crypto-Agility (12%)

What it measures: How quickly the blockchain can upgrade its cryptography when quantum computers become a threat. Evaluates three factors:

Account Flexibility: Can users upgrade their signature scheme without a network-wide upgrade?

• Native account abstraction (score 9-10)
• Smart contract wallets like EIP-4337 (score 5-6)
• Single hardcoded scheme (score 1-2)

Governance Speed: How long does it take to propose and deploy changes?

• Bitcoin: ~22 months for major changes
• Polkadot: ~3 months for major changes
• Centralized governance: Days to weeks

Ecosystem Readiness: Is there active research, testnets, and tooling for post-quantum cryptography?

5. Hash Strength (8%)

What it measures: The quantum resistance of the hash functions used throughout the cryptocurrency for addresses, mining, Merkle trees, and data integrity.

Key insight: Unlike signatures, hash functions are NOT completely broken by quantum computers. Grover’s algorithm provides only a square-root speedup. 256-bit hashes retain 128-bit security, which remains adequate.

Hash Function	Classical Security	Quantum Security	Score
SHA-256	256 bits	128 bits	90
Keccak-256 (SHA-3)	256 bits	128 bits	90
Blake2b-256	256 bits	128 bits	90
RIPEMD-160	160 bits	80 bits	70

Most modern cryptocurrencies pass this test. This component primarily penalizes legacy or weak hash usage.

6. Pairing-Free Status (8%)

What it measures: Whether the cryptocurrency avoids pairing-based cryptography (BLS signatures, KZG commitments). These systems introduce additional quantum-vulnerable primitives beyond basic signatures.

Usage	Score	Impact
No pairing/KZG usage	100	No additional consensus-layer quantum risk
Uses BLS/pairing cryptography	0	Consensus or data availability depends on vulnerable primitives

Why this matters: Ethereum aggregates over 100,000 BLS signatures per slot, creating a massive attack surface. Pairing/KZG vulnerabilities can undermine consensus mechanisms, affecting all users regardless of their personal key management.

7. Operational Mitigations (7%)

What it measures: Practical security measures that reduce quantum risk without requiring cryptographic changes.

• Hash-based signatures available in protocol
• Address non-reuse enforcement or guidelines
• Script hiding (Taproot-style)
• Quantum-ready hardware security modules
• Time-lock contracts and MPC custody
• Active post-quantum research programs

Why it matters: Even with vulnerable cryptography, operational measures can significantly reduce actual risk by limiting key exposure and providing time for emergency responses.

How Weaknesses Compound

The three primary security components (Signature Resistance, Consensus Security, Key Protection) are not independent. Weakness in one amplifies weakness in another, creating cascading failures:

Signatures	Consensus	Key Protection	Combined Effect
Strong	Strong	Strong	Fully protected (e.g., QRL)
Weak	Strong	Medium	Limited theft, network survives (e.g., Bitcoin)
Weak	Weak	Medium	Network fails, some funds protected
Weak	Weak	Weak	Total collapse (e.g., Ethereum under quantum attack)

Update Policy

Rankings are reviewed weekly and updated when material changes occur:

• Protocol upgrades deploying new cryptographic primitives
• Official announcements of PQC migration roadmaps
• Governance changes affecting upgrade capabilities
• New research affecting quantum timeline estimates
• Corrections based on community feedback with primary sources

Report an error: If you identify inaccuracies, please contact us with specific details and primary source documentation. Verified corrections are implemented within 72 hours.