Weekly Updates

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 55%

QRL 2.0 Testnet V3 is coming with a few things remaining before its release:

• Config parameters
• Upstream bug fixes
• Internal audit

QRL 2.0 (Project Zond)

Ledger app audit along with its remediation is complete.

qrysm

• Update several config parameters such as committee size, max committees per slot, TargetAggregatorsPerCommittee, EpochsPerExecutionVotingPeriod, TargetAggregatorsPerSyncSubcommittee, AttestationSubnetCount, SlotsPerArchivedPoint, WeakSubjectivityPeriod etc. based on realistic possibility in QRL network
• Re-baseline tests for the 32-validator committee bound and 4-attestation blocks
• Lower attestation SSZ bounds to MAX_VALIDATORS_PER_COMMITTEE=32 and MAX_ATTESTATIONS=4
• Add block-size gate test: worst-case block by SSZ bounds must fit GossipMaxSize and MaxChunkSize
• Raise MinDepositAmount to 2000 QRL and enforce it in the deposit contract
• Enforce active validator cap at genesis and activation, max 4096 for now
• To reduce the memory consumption when a beacon chain starts, Stategen: replay historical states changed to one block at a time by root
• Several bug fixes and added new tests
• Max block size in worst case ( assuming 20M gas is used, along with all attestations, deposit & withdrawal transactions) is 9,116,093 bytes (8.69 MB)
• Other parameters are still being reviewed and finalized

web3.js

• Align QRNS with web3.js ENS and keep VM64 contract fixtures
• Fix WebSocket integration tests with proxy middleware v4
• Several bug fixes and added new tests
• Match createAccessList expectations to checksummed QRL addresses
• Return typed receipts from sendFewSampleTxs

IDE

• VSCode extension created to support Hyperion, allowing developers to write the code on VSCode

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion (55% after remediation complete for the Ledger app audit)

QRL 2.0 (Project Zond)

Ledger app audit is complete and remediation work is underway.

• No critical issues or cryptographic concerns highlighted.
• Post-quantum signing engine is correctly built, and matches, byte-for-byte, an independently audited reference implementation.
• In smoke tests, signatures are correctly accepted by go-qrl and transactions are incorporated into the blockchain

qrysm

• Add randao_commit in deposit contract, to drastically reduce the chance to manipulate the validator role for next epoch by last slot block proposer of previous epoch
• Fix: Sign aggregator selection proofs once per slot and deterministically under hedged ML-DSA-87
• Fix: Bump go-qrl for the 5-field depositroot precompile and drop the deposit test skips
• Fix: Restore build of //beacon-chain/rpc/qrl/validator:validator_test (missing proto dep)
• Fix: Detect surround votes regardless of attestation order in updateSpans
• Fix: Use Q-prefixed execution addresses in REST validator client block JSON
• Fix: Take the forkchoice write lock in lateBlockTasks before notifying the engine
• Updated and added new unit tests

web3.js

• Fix VM64 event topic encoding and filtering
• Fix wallet integration tests to use a typed provider and valid Argon2id options
• Fix(web3-qrl-contract): use QRL bytecode in estimateGas without-0x test
• Fix(web3-qrl-contract): expect checksummed QRL address in revert receipt
• Fix(web3-qrl-contract): update CustomError revert data for VM64
• Fix(web3-qrl-contract): remove unused @ts-expect-error in contract_defaults test
• Fix(web3-qrl-contract): refresh SimpleOverloaded bytecode for VM64
• Updated and added new unit tests

qrl-tests

• [1/3] Add shared gqrl console E2E harness and API smoke coverage
• Collect E2E diagnostics through the Kurtosis API
• Add gqrl console contract and indexed topic coverage
• Add gqrl console transaction, constructor, and event coverage

hyperion

• Add randao_commitment argument to the depositroot builtin

go-qrl

• core/vm: add randao_commitment to the depositroot precompile input

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrysm

• Generate deposit-cli seed mnemonic from crypto/rand
• Added several upstream fixes such as 13329, 14413, 17052 and many more
• Prevent uint64 overflow in correlation slashing penalty under QRL balance constants
• Fix: Return after the first per-item error in SubmitContributionAndProofs
• Fix: Restore pre-genesis guard in initDepositCaches (nil GenesisState panic)

web3.js

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrysm

• Added missing payload parent hash validation
• Added several upstream fixes such as 16478, 17087,17110 and many more
• Pin the latest qrl-package and enable clef auto-approval
• Fix: set to the actual QRL deposit-contract block to 0
• Fix: Return an error from Keymanager.Sign on signing failure instead of a nil signature
• Fix: Cap DefaultBuilderGasLimit at go-qrl MaxGasLimit (20M)

go-qrl

• accounts/abi: move the Panic builtin selector to Panic(uint512)

web3.js

• local-testnet: use qrl-package clef dev accounts
• chore(lint): drop eslint-disable directives that suppress nothing
• feat: migrate ABI coding to VM64
• test: use distinct 64-byte QRL addresses in web3-rpc-methods fixtures
• test: migrate core and provider fixtures to VM64
• fix: hash VM storage slots as 64-byte words
• test: regenerate contract fixtures for VM64 with native hyperion

qrl-tests

• Added nightly build for with end-to-end tests for the QRL 2.0

qrl-package

• Pass importraw its flags after the subcommand
• Generate clef files with the remote signer’s image
• Raise the default genesis balance and move the tx spammer off the clef pool
• Provision ten clef development accounts
• Add automated clef approvals for the development account

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrvmc

• Fix configure when Hunter is disabled
• Improve packaging and release metadata
• Bumped version into 2.0.0 and re-enabled it’s CI check
• Removed unused CI/CD configs like AppVeyor and Travis CI
• Require C++17 for example VM

qrvmone

• Updated to latest qrvmc submodule

qrysm

• Fix sync committee & aggregate tail signature ordering
• Remove unused AggregatePair helper
• Revert incomplete aggregate HTTP 404 port
• Transaction Batch Size reduced to 20 for minimal E2E transaction load
• Updated testnet script
• Derive Bazel DATE and DATE_UNIX from SOURCE_DATE_EPOCH when provided

qrl-tests

• Simplify CI concurrency key
• Add CI validation for pull request
• Add development network and ABI suite

QRL 1.0

• Added tests for grpc_proxy
• Optimized grpc_proxy to avoid triggering grpc response limit
• Updated requirements.txt to fix flask dependency issue caused by incompatible version of Werkzeug

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrl-web3-wallet

• further security-audit remediation and code-review fixes
• corrected address display and updated documentation

web3.js

• updated CI actions and patched vulnerabilities affecting fast-uri, PostCSS, SVGO and brace-expansion

js-qrl-cryptography

• updated pinned GitHub Actions and the fast-uri dependency

go-qrllib

• updated pinned GitHub Actions and opened further test-related work

qrypto.js

• updated development dependencies, lockfiles and CI actions for mldsa87

qrvmc

• Harden hex parsing, example VMs, and loader
• Tighten gas validation, loader TLS and ABI docs

go-qrl

• –bootnodes flag now override config value
• Go toolchain updated to 1.26.5
• external function values updated to 64-byte address plus a 4-byte selector
• Removed legacy local testnet script (now being moved to new repo qrl-tests)
• Several other bug fixes

qrysm

• Updated tests
• Go toolchain updated to 1.26.5
• Updated QRL dependencies
• Update the staking deposit CLI default to the valid deposit contract address
• Default address aligned with the Qrysm network config
• Fix Zond consensus version descriptor

web3.js

• ICAP and IBAN support removed as those are deprecated
• Added 64 byte topics and 512-bit integers data type

qrl-package

• Changes merged related to 64-byte address

QRL 1.0

dice

• 2018 Python script rewritten as JavaScript application
• session isolation, CI and browser end-to-end tests
• a verifiable single-file offline release

qrllib

• added RNG-regression protection
• modernised Emscripten support
• migrated release processes to GitHub Actions
• added trusted publishing and npm/PyPI deployment
• v1.2.6 released

offline-wallet-generator

• merge of v3 wallet format with stronger encryption and password security
• added reproducible offline builds, CSP tests and a security-focused CI/release pipeline

qrl-wallet

• 7 issues closed
• continued UI refinements
• gated multisig signing on validation and tighter OTS-reuse checks
• applied security hardening and documentation updates
• v1.9.1-beta in pre-release

qrllib-browserify

• updated support to Node.js 22+
• rebuilt the bundle for qrllib 1.2.6 and corrected module export and Browserify interoperability

qrl-cli

• replaced the aes256 dependency with scrypt-derived AES-256-GCM encryption while retaining compatibility with legacy wallet files

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

QRL 2.0

go-qrl

• Added several upstream go-ethereum fixes with tests

QRVMC & QRVMONE

• Both are still being reviewed for bugs, issues and further changes related to 64 bytes word size

qrl-web3-wallet

• 64 byte address changes
• First phase security-audit remediation; code-review fixes; address-display correction; documentation updates;

Other

• Hardhat like tool documented & is currently being tested

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

web3.js

• Audit remediation; keystore cryptography hardening; removal of import cycles; coverage gates; reproducible supply-chain checks; dependency overrides; CI timeout and build-order fixes
• 20 constituent packages released 🎉

rust-qrllib

• Refactored the demo build, aligned documentation with go-qrllib, and updated demo dependencies and TypeScript configuration

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

Qrvmc

• Several bug fixes like VM bounds checks for PUSH and memory expansion, loader config boundary and precompile sweep coverage etc.
• Updated and added new test cases
• Reviewing qrvmc to ensure changes made in Hyperion also align with qrvmc

go-qrl

• Unused ECDSA signatures are removed
• Added Local testnet setup script using kurtosis
• Move typed-data encoding to the QRL 64-byte model
• go-qrl still being reviewed for 64 bytes related changes

web3.js

• Migration to 64-byte QRL addresses and 64-byte VM words; supply-chain and dependency hardening; CI fixes; Turbo and GitHub Actions updates; Node 20 compatibility
• Further audit work underway

js-qrl-cryptography

• Added and exported SHAKE256 with selectable output length, test vectors, packaging tests and documentation

qrypto.js

• Dependency and GitHub Actions updates, including Turbo and Zizmor

qrl-web3-wallet

• Bound dApp signing and transaction requests to the authorised chain, with chain-context revalidation and tests

theqrl.org

• Added llms.txt along content-negotiation to serve content as markdown files for better LLM support

qrl-wallet (QRL 1.0)

• Prevented custom-node connections unless enabled; synchronised mainnet and testnet branches

Weekly Development Snapshot

Status / overview

• April 3rd: Audit complete of 2 cryptographic libraries.
• March 31st: QRL 2.0 Testnet V2 Released.
• Audits: 50% completion

64 byte addresses

• Added 64 bytes address related changes to Hyperion
• go-qrl is still being fixed with changes related to 64 bytes address

P2P Layer

• Falcon-1024 added in go-qrllib

Hyperion/qrvmc

• Added & updated several test cases for Hyperion
• Reviewing qrvmc to ensure changes made in Hyperion also align with qrvmc