Weekly Updates

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

Qrvmc

• Several bug fixes like VM bounds checks for PUSH and memory expansion, loader config boundary and precompile sweep coverage etc.
• Updated and added new test cases
• Reviewing qrvmc to ensure changes made in Hyperion also align with qrvmc

go-qrl

• Unused ECDSA signatures are removed
• Added Local testnet setup script using kurtosis
• Move typed-data encoding to the QRL 64-byte model
• go-qrl still being reviewed for 64 bytes related changes

web3.js

• Migration to 64-byte QRL addresses and 64-byte VM words; supply-chain and dependency hardening; CI fixes; Turbo and GitHub Actions updates; Node 20 compatibility
• Further audit work underway

js-qrl-cryptography

• Added and exported SHAKE256 with selectable output length, test vectors, packaging tests and documentation

qrypto.js

• Dependency and GitHub Actions updates, including Turbo and Zizmor

qrl-web3-wallet

• Bound dApp signing and transaction requests to the authorised chain, with chain-context revalidation and tests

theqrl.org

• Added llms.txt along content-negotiation to serve content as markdown files for better LLM support

qrl-wallet (QRL 1.0)

• Prevented custom-node connections unless enabled; synchronised mainnet and testnet branches

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte addresses

• Added 64 bytes address related changes to Hyperion
• go-qrl is still being fixed with changes related to 64 bytes address

P2P Layer

• Falcon-1024 added in go-qrllib

Hyperion/qrvmc

• Added & updated several test cases for Hyperion
• Reviewing qrvmc to ensure changes made in Hyperion also align with qrvmc

Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte addresses

• Most of the changes related to 64 bytes address done for Hyperion.
• go-qrl is currently being fixed with some remaining changes related to 64 bytes address.

Tooling

• Hardhat like tool is being developed for the QRL 2.0 along with the documentation.

P2P Layer

• Falcon-1024 PR is still being reviewed.

Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte address

• 64 bytes address related changes done for hypc-js, qrl-contracts, go-qrl & qrysm
• changes in progress for hyperion related to 64 bytes address

P2P Layer

• Falcon-1024 PR is still being reviewed

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: Internal and External work ongoing

64 Byte addresses

• 64 bytes address related changes done for qrvmone, qrvmc
• hyperion is being reviewed for 64 bytes address related changes

P2P Layer PQ Implementation

• Falcon-1024 has been implemented and PR is currently being reviewed

Daniel Bernstein’s “Exploiting ML-DSA Bugs” review

The QRL ML-DSA implementation is not broken and is not at risk from any of the three forgery attacks described in the paper. Each attack relies on a specific implementation bug; we checked for all three at the bit/byte level, confirmed each is absent, and corroborated the findings with empirical probes and the existing test suite.

To guard against such bugs being introduced into the codebase in the future, we added specific regression tests.

Additional CVE review (ML-DSA Timing)

We additionally confirmed that the most recently disclosed ML-DSA timing vulnerability (Decompose, CVE-2026-22705) is not present.

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: Internal and External work ongoing

go-qrllib

• ML-KEM-1024 changes merged
• Dilithium5 removed, with CI enhancements
• Falcon-1024 implementation is in progress

64 bytes address

• Migration to 64-byte addresses merged for go-qrl
• 64-byte word accounting now used across QRVM gas and tracers
• 64-byte address changes merged for go-qrllib qrvmc

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: Internal and External work ongoing

go-qrllib

• ML-KEM-1024 implementation finished
• Falcon-1024 implementation is in progress

64 bytes address

• Changes reviewed for qrysm, go-qrllib
• Changes being reviewed for hyperion, qrvmone, go-qrl, qrl-web3-wallet etc.

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: Internal and External work ongoing

Qrysm

• Finished all upstream patches

64 bytes address

• Implementation finished for multiple repos including go-qrllib, qrysm, go-qrl, hyperion, qrvmone etc.
• Implementation is Currently being reviewed and tested

go-qrllib

• Falcon-1024 implementation is still in progress
• ML-KEM implementation has begun, it will be used in P2P layer

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: Internal and External work ongoing

Qrysm

• Upstream patches are still being reviewed and merged

64 bytes address / wallets

• Address related changes done for QRVMC, QRVMONE, go-qrl & qrysm and current being reviewed before merge
• Address-space changes complete in go-qrllib and wallet.js
• EIP-55 style address checksums implemented in wallet.js and go-qrllib

go-qrllib

• Falcon-1024 & ML-KEM implementation are still in progress

Weekly Development Snapshot

Qrysm

• Nodes tested with 48 bytes address and working totally fine
• Making changes to move from 48 bytes address to 64 bytes address, to have complete NIST Security Level 5
• Upstream patches are still being reviewed and added

go-qrllib

• Falcon-1024 implementation is still in progress
• ML-KEM implementation has begun, it will be used in P2P layer

In light of increasingly significant supply chain attacks. While no substantial issues have been found, enhancements to our CI/CD setup has been undertaken following review to follow best current practices and learn from adverse events elsewhere.