Weekly Updates

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrysm

• Generate deposit-cli seed mnemonic from crypto/rand
• Added several upstream fixes such as 13329, 14413, 17052 and many more
• Prevent uint64 overflow in correlation slashing penalty under QRL balance constants
• Fix: Return after the first per-item error in SubmitContributionAndProofs
• Fix: Restore pre-genesis guard in initDepositCaches (nil GenesisState panic)

web3.js

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrysm

• Added missing payload parent hash validation
• Added several upstream fixes such as 16478, 17087,17110 and many more
• Pin the latest qrl-package and enable clef auto-approval
• Fix: set to the actual QRL deposit-contract block to 0
• Fix: Return an error from Keymanager.Sign on signing failure instead of a nil signature
• Fix: Cap DefaultBuilderGasLimit at go-qrl MaxGasLimit (20M)

go-qrl

• accounts/abi: move the Panic builtin selector to Panic(uint512)

web3.js

• local-testnet: use qrl-package clef dev accounts
• chore(lint): drop eslint-disable directives that suppress nothing
• feat: migrate ABI coding to VM64
• test: use distinct 64-byte QRL addresses in web3-rpc-methods fixtures
• test: migrate core and provider fixtures to VM64
• fix: hash VM storage slots as 64-byte words
• test: regenerate contract fixtures for VM64 with native hyperion

qrl-tests

• Added nightly build for with end-to-end tests for the QRL 2.0

qrl-package

• Pass importraw its flags after the subcommand
• Generate clef files with the remote signer’s image
• Raise the default genesis balance and move the tx spammer off the clef pool
• Provision ten clef development accounts
• Add automated clef approvals for the development account

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrvmc

• Fix configure when Hunter is disabled
• Improve packaging and release metadata
• Bumped version into 2.0.0 and re-enabled it’s CI check
• Removed unused CI/CD configs like AppVeyor and Travis CI
• Require C++17 for example VM

qrvmone

• Updated to latest qrvmc submodule

qrysm

• Fix sync committee & aggregate tail signature ordering
• Remove unused AggregatePair helper
• Revert incomplete aggregate HTTP 404 port
• Transaction Batch Size reduced to 20 for minimal E2E transaction load
• Updated testnet script
• Derive Bazel DATE and DATE_UNIX from SOURCE_DATE_EPOCH when provided

qrl-tests

• Simplify CI concurrency key
• Add CI validation for pull request
• Add development network and ABI suite

QRL 1.0

• Added tests for grpc_proxy
• Optimized grpc_proxy to avoid triggering grpc response limit
• Updated requirements.txt to fix flask dependency issue caused by incompatible version of Werkzeug

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrl-web3-wallet

• further security-audit remediation and code-review fixes
• corrected address display and updated documentation

web3.js

• updated CI actions and patched vulnerabilities affecting fast-uri, PostCSS, SVGO and brace-expansion

js-qrl-cryptography

• updated pinned GitHub Actions and the fast-uri dependency

go-qrllib

• updated pinned GitHub Actions and opened further test-related work

qrypto.js

• updated development dependencies, lockfiles and CI actions for mldsa87

qrvmc

• Harden hex parsing, example VMs, and loader
• Tighten gas validation, loader TLS and ABI docs

go-qrl

• –bootnodes flag now override config value
• Go toolchain updated to 1.26.5
• external function values updated to 64-byte address plus a 4-byte selector
• Removed legacy local testnet script (now being moved to new repo qrl-tests)
• Several other bug fixes

qrysm

• Updated tests
• Go toolchain updated to 1.26.5
• Updated QRL dependencies
• Update the staking deposit CLI default to the valid deposit contract address
• Default address aligned with the Qrysm network config
• Fix Zond consensus version descriptor

web3.js

• ICAP and IBAN support removed as those are deprecated
• Added 64 byte topics and 512-bit integers data type

qrl-package

• Changes merged related to 64-byte address

QRL 1.0

dice

• 2018 Python script rewritten as JavaScript application
• session isolation, CI and browser end-to-end tests
• a verifiable single-file offline release

qrllib

• added RNG-regression protection
• modernised Emscripten support
• migrated release processes to GitHub Actions
• added trusted publishing and npm/PyPI deployment
• v1.2.6 released

offline-wallet-generator

• merge of v3 wallet format with stronger encryption and password security
• added reproducible offline builds, CSP tests and a security-focused CI/release pipeline

qrl-wallet

• 7 issues closed
• continued UI refinements
• gated multisig signing on validation and tighter OTS-reuse checks
• applied security hardening and documentation updates
• v1.9.1-beta in pre-release

qrllib-browserify

• updated support to Node.js 22+
• rebuilt the bundle for qrllib 1.2.6 and corrected module export and Browserify interoperability

qrl-cli

• replaced the aes256 dependency with scrypt-derived AES-256-GCM encryption while retaining compatibility with legacy wallet files

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

QRL 2.0

go-qrl

• Added several upstream go-ethereum fixes with tests

QRVMC & QRVMONE

• Both are still being reviewed for bugs, issues and further changes related to 64 bytes word size

qrl-web3-wallet

• 64 byte address changes
• First phase security-audit remediation; code-review fixes; address-display correction; documentation updates;

Other

• Hardhat like tool documented & is currently being tested

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

web3.js

• Audit remediation; keystore cryptography hardening; removal of import cycles; coverage gates; reproducible supply-chain checks; dependency overrides; CI timeout and build-order fixes
• 20 constituent packages released 🎉

rust-qrllib

• Refactored the demo build, aligned documentation with go-qrllib, and updated demo dependencies and TypeScript configuration

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

Qrvmc

• Several bug fixes like VM bounds checks for PUSH and memory expansion, loader config boundary and precompile sweep coverage etc.
• Updated and added new test cases
• Reviewing qrvmc to ensure changes made in Hyperion also align with qrvmc

go-qrl

• Unused ECDSA signatures are removed
• Added Local testnet setup script using kurtosis
• Move typed-data encoding to the QRL 64-byte model
• go-qrl still being reviewed for 64 bytes related changes

web3.js

• Migration to 64-byte QRL addresses and 64-byte VM words; supply-chain and dependency hardening; CI fixes; Turbo and GitHub Actions updates; Node 20 compatibility
• Further audit work underway

js-qrl-cryptography

• Added and exported SHAKE256 with selectable output length, test vectors, packaging tests and documentation

qrypto.js

• Dependency and GitHub Actions updates, including Turbo and Zizmor

qrl-web3-wallet

• Bound dApp signing and transaction requests to the authorised chain, with chain-context revalidation and tests

theqrl.org

• Added llms.txt along content-negotiation to serve content as markdown files for better LLM support

qrl-wallet (QRL 1.0)

• Prevented custom-node connections unless enabled; synchronised mainnet and testnet branches

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte addresses

• Added 64 bytes address related changes to Hyperion
• go-qrl is still being fixed with changes related to 64 bytes address

P2P Layer

• Falcon-1024 added in go-qrllib

Hyperion/qrvmc

• Added & updated several test cases for Hyperion
• Reviewing qrvmc to ensure changes made in Hyperion also align with qrvmc

Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte addresses

• Most of the changes related to 64 bytes address done for Hyperion.
• go-qrl is currently being fixed with some remaining changes related to 64 bytes address.

Tooling

• Hardhat like tool is being developed for the QRL 2.0 along with the documentation.

P2P Layer

• Falcon-1024 PR is still being reviewed.

Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte address

• 64 bytes address related changes done for hypc-js, qrl-contracts, go-qrl & qrysm
• changes in progress for hyperion related to 64 bytes address

P2P Layer

• Falcon-1024 PR is still being reviewed