Weekly Updates

Weekly Development Snapshot

Status

• September 18th: QRL Release Verifier audit complete
• September 11th: Ledger app audit along with its remediation is complete
• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits & Remediation: 60%

QRL 2.0 Testnet V3 remaining work:

• Config parameters
• [done] Upstream bug fixes
• Testnet V2 scoped audits

QRL 2.0

go-qrl

• Updated docs
• drop unused light client and checkpoint constants
• drop unsupported block header fields
• drop history filter for the removed personal namespace
• Upgraded fastssz upstream library and replace obsolete merkleization API

qrysm

• Fix reward and penalty order
• Added several fix related to fork recovery & fork choice

go-qrllib

• Implemented additional tests for Falcon 1024

qrlft

— Updated go-qrllib

• vendored Dilithium changes with linting fixes
• bumped the CI signing-action version

QRL 1.x

QRL

— Added regression coverage and documentation/CI cleanup

• fixed PyPI upload behaviour
• added Prospector configuration
• several bug fixes

qrllib

— multisig fixes

• repaired PyPI release workflow

qrl-docker

• Major refresh of the Docker operator documentation and repository layout: Ubuntu branch/image strategy
• 5 LTS version images
• latest (Resolute)/Noble guidance, TEST vs upstream dependencies
• persistent volumes and wallet migration
• port/security guidance, multi-architecture notes

Weekly Development Snapshot

Status

• September 18th: QRL Release Verifier audit complete
• September 11th: Ledger app audit along with its remediation is complete
• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits & Remediation: 60%

QRL 2.0 Testnet V3 remaining work:

• Config parameters
• Upstream bug fixes
• Testnet V2 scoped audits

QRL 2.0

qrysm

• EpochsPerSlashingsVector is now 512 - 45 days, 12 hours, 16 minutes
• fix(builder): raise execution payload response limit to 32 MiB
• fix(config): reject malformed YAML without partially applying overrides as well as validate values for some config parameters
• fix(sync): prevent zero polling intervals for one-slot epochs
• Reject empty signature groups and nil public keys, which was being accepted earlier
• Remove unbounded ML-DSA public key cache, fixing memory leak
• Prevent panics on malformed ML-DSA signature batches
• Reject all-zero-t1 ML-DSA-87 public keys
• Reject nil inputs and validate fork domain lengths
• Optimization: avoid redundant sync signature checks in replay and block proposals
• Wire the keymanager RPC to a beacon client so voluntary exits can sign
• Optimization: reject invalid gossip before costly attester signature checks
• Verify gossip signatures independently with bounded workers
• Bound signature diagnostics and avoid duplicate verification
• An empty execution payloads doesn’t necessarily mean empty withdrawal
• More tests added

qrl-genesis-generator

• Execution voting period updated to 4

web3.js

• Removed deprecated RPC APIs
• Replace Ethereum EC precompile gas with gqrl depositroot and mldsa87Verify costs
• Set Common initialBaseFee to 100 gwei so genesis fee math matches go-qrl
• Type FeeHistory.baseFeePerGas as an array because go-qrl returns one value per block

qrypto.js

• Added weak public-key and invalid secret-key validation for ML-DSA-87, plus bounded signing behaviour and corresponding documentation/tests

js-qrl-cryptography

• Updated @theqrl/mldsa87 to v2.2.0 to pick up the new validation behaviour

web3.js

• Updated QRL cryptography/wallet dependencies and raised dependency patch floors for multiple known CVEs and security advisories

go-qrllib

• Added ML-DSA-87 weak-key rejection and secret-key checks; moved verification toward validated PublicKey objects; expanded lifecycle tests/docs; updated Go security-check CI

go-qrl

• Updated to go-qrllib 0.9.2 then 0.10.0 and enforced validated ML-DSA-87 public keys in the verification precompile

rust-qrllib

• Added a validated ML-DSA PublicKey type and weak-key rule

actions-mldsa-sign

• v2 release: GitHub Action to generate ML-DSA-87 (FIPS 204) post-quantum signatures for files, and a signed manifest binding each artifact to the release it belongs to.

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 55%

QRL 2.0 Testnet V3 is coming with a few things remaining before its release:

• Config parameters
• Upstream bug fixes
• Internal audit

QRL 2.0 (Project Zond)

Ledger app audit along with its remediation is complete.

qrysm

• Update several config parameters such as committee size, max committees per slot, TargetAggregatorsPerCommittee, EpochsPerExecutionVotingPeriod, TargetAggregatorsPerSyncSubcommittee, AttestationSubnetCount, SlotsPerArchivedPoint, WeakSubjectivityPeriod etc. based on realistic possibility in QRL network
• Re-baseline tests for the 32-validator committee bound and 4-attestation blocks
• Lower attestation SSZ bounds to MAX_VALIDATORS_PER_COMMITTEE=32 and MAX_ATTESTATIONS=4
• Add block-size gate test: worst-case block by SSZ bounds must fit GossipMaxSize and MaxChunkSize
• Raise MinDepositAmount to 2000 QRL and enforce it in the deposit contract
• Enforce active validator cap at genesis and activation, max 4096 for now
• To reduce the memory consumption when a beacon chain starts, Stategen: replay historical states changed to one block at a time by root
• Several bug fixes and added new tests
• Max block size in worst case ( assuming 20M gas is used, along with all attestations, deposit & withdrawal transactions) is 9,116,093 bytes (8.69 MB)
• Other parameters are still being reviewed and finalized

web3.js

• Align QRNS with web3.js ENS and keep VM64 contract fixtures
• Fix WebSocket integration tests with proxy middleware v4
• Several bug fixes and added new tests
• Match createAccessList expectations to checksummed QRL addresses
• Return typed receipts from sendFewSampleTxs

IDE

• VSCode extension created to support Hyperion, allowing developers to write the code on VSCode

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion (55% after remediation complete for the Ledger app audit)

QRL 2.0 (Project Zond)

Ledger app audit is complete and remediation work is underway.

• No critical issues or cryptographic concerns highlighted.
• Post-quantum signing engine is correctly built, and matches, byte-for-byte, an independently audited reference implementation.
• In smoke tests, signatures are correctly accepted by go-qrl and transactions are incorporated into the blockchain

qrysm

• Add randao_commit in deposit contract, to drastically reduce the chance to manipulate the validator role for next epoch by last slot block proposer of previous epoch
• Fix: Sign aggregator selection proofs once per slot and deterministically under hedged ML-DSA-87
• Fix: Bump go-qrl for the 5-field depositroot precompile and drop the deposit test skips
• Fix: Restore build of //beacon-chain/rpc/qrl/validator:validator_test (missing proto dep)
• Fix: Detect surround votes regardless of attestation order in updateSpans
• Fix: Use Q-prefixed execution addresses in REST validator client block JSON
• Fix: Take the forkchoice write lock in lateBlockTasks before notifying the engine
• Updated and added new unit tests

web3.js

• Fix VM64 event topic encoding and filtering
• Fix wallet integration tests to use a typed provider and valid Argon2id options
• Fix(web3-qrl-contract): use QRL bytecode in estimateGas without-0x test
• Fix(web3-qrl-contract): expect checksummed QRL address in revert receipt
• Fix(web3-qrl-contract): update CustomError revert data for VM64
• Fix(web3-qrl-contract): remove unused @ts-expect-error in contract_defaults test
• Fix(web3-qrl-contract): refresh SimpleOverloaded bytecode for VM64
• Updated and added new unit tests

qrl-tests

• [1/3] Add shared gqrl console E2E harness and API smoke coverage
• Collect E2E diagnostics through the Kurtosis API
• Add gqrl console contract and indexed topic coverage
• Add gqrl console transaction, constructor, and event coverage

hyperion

• Add randao_commitment argument to the depositroot builtin

go-qrl

• core/vm: add randao_commitment to the depositroot precompile input

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrysm

• Generate deposit-cli seed mnemonic from crypto/rand
• Added several upstream fixes such as 13329, 14413, 17052 and many more
• Prevent uint64 overflow in correlation slashing penalty under QRL balance constants
• Fix: Return after the first per-item error in SubmitContributionAndProofs
• Fix: Restore pre-genesis guard in initDepositCaches (nil GenesisState panic)

web3.js

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrysm

• Added missing payload parent hash validation
• Added several upstream fixes such as 16478, 17087,17110 and many more
• Pin the latest qrl-package and enable clef auto-approval
• Fix: set to the actual QRL deposit-contract block to 0
• Fix: Return an error from Keymanager.Sign on signing failure instead of a nil signature
• Fix: Cap DefaultBuilderGasLimit at go-qrl MaxGasLimit (20M)

go-qrl

• accounts/abi: move the Panic builtin selector to Panic(uint512)

web3.js

• local-testnet: use qrl-package clef dev accounts
• chore(lint): drop eslint-disable directives that suppress nothing
• feat: migrate ABI coding to VM64
• test: use distinct 64-byte QRL addresses in web3-rpc-methods fixtures
• test: migrate core and provider fixtures to VM64
• fix: hash VM storage slots as 64-byte words
• test: regenerate contract fixtures for VM64 with native hyperion

qrl-tests

• Added nightly build for with end-to-end tests for the QRL 2.0

qrl-package

• Pass importraw its flags after the subcommand
• Generate clef files with the remote signer’s image
• Raise the default genesis balance and move the tx spammer off the clef pool
• Provision ten clef development accounts
• Add automated clef approvals for the development account

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrvmc

• Fix configure when Hunter is disabled
• Improve packaging and release metadata
• Bumped version into 2.0.0 and re-enabled it’s CI check
• Removed unused CI/CD configs like AppVeyor and Travis CI
• Require C++17 for example VM

qrvmone

• Updated to latest qrvmc submodule

qrysm

• Fix sync committee & aggregate tail signature ordering
• Remove unused AggregatePair helper
• Revert incomplete aggregate HTTP 404 port
• Transaction Batch Size reduced to 20 for minimal E2E transaction load
• Updated testnet script
• Derive Bazel DATE and DATE_UNIX from SOURCE_DATE_EPOCH when provided

qrl-tests

• Simplify CI concurrency key
• Add CI validation for pull request
• Add development network and ABI suite

QRL 1.0

• Added tests for grpc_proxy
• Optimized grpc_proxy to avoid triggering grpc response limit
• Updated requirements.txt to fix flask dependency issue caused by incompatible version of Werkzeug

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrl-web3-wallet

• further security-audit remediation and code-review fixes
• corrected address display and updated documentation

web3.js

• updated CI actions and patched vulnerabilities affecting fast-uri, PostCSS, SVGO and brace-expansion

js-qrl-cryptography

• updated pinned GitHub Actions and the fast-uri dependency

go-qrllib

• updated pinned GitHub Actions and opened further test-related work

qrypto.js

• updated development dependencies, lockfiles and CI actions for mldsa87

qrvmc

• Harden hex parsing, example VMs, and loader
• Tighten gas validation, loader TLS and ABI docs

go-qrl

• –bootnodes flag now override config value
• Go toolchain updated to 1.26.5
• external function values updated to 64-byte address plus a 4-byte selector
• Removed legacy local testnet script (now being moved to new repo qrl-tests)
• Several other bug fixes

qrysm

• Updated tests
• Go toolchain updated to 1.26.5
• Updated QRL dependencies
• Update the staking deposit CLI default to the valid deposit contract address
• Default address aligned with the Qrysm network config
• Fix Zond consensus version descriptor

web3.js

• ICAP and IBAN support removed as those are deprecated
• Added 64 byte topics and 512-bit integers data type

qrl-package

• Changes merged related to 64-byte address

QRL 1.0

dice

• 2018 Python script rewritten as JavaScript application
• session isolation, CI and browser end-to-end tests
• a verifiable single-file offline release

qrllib

• added RNG-regression protection
• modernised Emscripten support
• migrated release processes to GitHub Actions
• added trusted publishing and npm/PyPI deployment
• v1.2.6 released

offline-wallet-generator

• merge of v3 wallet format with stronger encryption and password security
• added reproducible offline builds, CSP tests and a security-focused CI/release pipeline

qrl-wallet

• 7 issues closed
• continued UI refinements
• gated multisig signing on validation and tighter OTS-reuse checks
• applied security hardening and documentation updates
• v1.9.1-beta in pre-release

qrllib-browserify

• updated support to Node.js 22+
• rebuilt the bundle for qrllib 1.2.6 and corrected module export and Browserify interoperability

qrl-cli

• replaced the aes256 dependency with scrypt-derived AES-256-GCM encryption while retaining compatibility with legacy wallet files

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

QRL 2.0

go-qrl

• Added several upstream go-ethereum fixes with tests

QRVMC & QRVMONE

• Both are still being reviewed for bugs, issues and further changes related to 64 bytes word size

qrl-web3-wallet

• 64 byte address changes
• First phase security-audit remediation; code-review fixes; address-display correction; documentation updates;

Other

• Hardhat like tool documented & is currently being tested

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

web3.js

• Audit remediation; keystore cryptography hardening; removal of import cycles; coverage gates; reproducible supply-chain checks; dependency overrides; CI timeout and build-order fixes
• 20 constituent packages released 🎉

rust-qrllib

• Refactored the demo build, aligned documentation with go-qrllib, and updated demo dependencies and TypeScript configuration