Pure PoS smart-contract platform
Algorand ALGO
Algorand is in an active transition phase (Stage 3: Migration Live). State proofs have been secured with Falcon-1024 signatures since 2022, and a native Falcon-1024 account upgrade (v5.0.0) has passed consensus and is in cooldown for mainnet activation. However, as of the evaluation date, default spend authorization remains entirely Ed25519-based, and the consensus layer (VRF and validator signatures) is completely classical. All circulating value is held in quantum-vulnerable accounts, and no independent cryptographic audit of the PQ implementation is documented. These gaps result in multiple material caps that limit the final QRI stage and score.
Partial ProtectionHybrid-PQPQ-Recoverable
Category breakdown
QRI Factors
Algorithm & Implementation Assurance
13.25 / 20
Migration Mechanism, Governance & Ecosystem Coordination
5 / 15
Migration Status & Value-at-Risk
5.75 / 25
Production Cryptographic Protection
17.5 / 35
Security Assessment & Evidence Preparedness
5 / 5
Critical Quantum Blockers
- Consensus authentication (VRF and validator signatures) remains entirely classical (Ed25519/ECVRF), creating a quantum-critical vulnerability for network finality.
- Active production spend authorization defaults to Ed25519; native Falcon-1024 accounts are in v5.0.0 cooldown and not yet activated on mainnet as of 2026-08-17.
- Material long-exposure quantum-vulnerable value exists in legacy Ed25519 accounts with no evidenced deprecation, freeze, or burn policy for unmigratable balances.
Key Risks
- Consensus layer (VRF/sortition) remains entirely classical and quantum-vulnerable.
- All circulating supply is held in quantum-vulnerable Ed25519 accounts until native Falcon accounts activate and users migrate.
- Default account creation will remain classical even after the native Falcon upgrade, perpetuating the vulnerable surface.
- Absence of independent audit for the Falcon implementation introduces unverified cryptography risk.
- No forced migration, freeze, or deprecation mechanism for legacy Ed25519 accounts has been proposed or implemented.
Assurance Notes
- No independent cryptographic audit targeting the Falcon implementation or the v5.0.0 native Falcon-1024 account upgrade is cited in the dossier.
- Evidence Confidence is capped at Medium because quantum-critical claims rely mainly on official documentation and roadmap disclosures without current independent review or reproducible mainnet proof of native Falcon-1024 spend authorization at evaluation date.
- Performance and resource-impact analysis for Falcon-1024 signature verification and its effect on block validation, node hardware, and fee markets is not documented in the provided sources.
- The v5.0.0 upgrade introducing native Falcon-1024 accounts has passed the 90% node consensus threshold and is in its cooldown period as of the evaluation date (2026-08-17), but mainnet activation has not yet occurred.
- Percentage of circulating supply and TVL currently held in quantum-vulnerable Ed25519 accounts vs. migrated to Falcon accounts is unmeasurable from the supplied dossier.
Non-Scoring Caveats
- Independent audit specifically covering Falcon implementations and the v5.0.0 upgrade is not evidenced.
- Formal performance/resource benchmark for Falcon-1024 native accounts is not evidenced.
- Formal quantum-specific incident-response playbook is not evidenced.
- Exchange and custody migration attestations for Falcon-1024 accounts are not evidenced.
Evidence record
Claims and Caveats
Security Assessment & Evidence Preparedness
Public cryptographic inventory and quantum threat model
Claim: Algorand has published a post-quantum cryptography roadmap detailing Ed25519 usage, Falcon-1024 state proofs, and migration plans.
Coverage basis: Public roadmap and technical documentation
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Roadmap is well-documented and specific to Algorand's architecture.
Roadmap publication date (2026-06-18) predates evaluation date; Q3 2026 native Falcon account deployment status requires verification.
Security Assessment & Evidence Preparedness
Public evidence record supporting the assessment
Claim: Algorand provides technical briefs, documentation, and code references supporting PQ migration claims.
Coverage basis: Official documentation and technical briefs
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Technical brief on Falcon transactions is detailed and specific.
Evidence supports state proofs and experimental PQ transactions; native account deployment pending.
Production Cryptographic Protection
Spend authorization / transaction signatures
Claim: Ed25519 is the production signature scheme for spend authorization; Falcon-1024 available via LogicSig since 2025 but not default or native.
Coverage basis: Classical ECC-only by default; optional PQ path exists
Implementation score: 0.75 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Active production spend authorization remains entirely ECC/BLS/Schnorr/EdDSA-only by default
Assurance: PyTeal documentation and technical brief confirm Ed25519 as default; Falcon via LogicSig is experimental/optional.
Native Falcon-1024 accounts in v5.0.0 cooldown; not yet activated on mainnet as of 2026-08-17.
Production Cryptographic Protection
Account, address, public-key exposure, and key derivation
Claim: Algorand accounts use Ed25519 by default; long-exposure public keys exist in legacy accounts with no evidenced deprecation policy.
Coverage basis: Classical ECC-only accounts with long-exposure risk
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Quantum blocker: Material long-exposure quantum-vulnerable value exists with no migration, freeze, deprecation, burn, recovery, or policy path
Assurance: No evidenced policy for deprecating, freezing, or burning legacy Ed25519 accounts.
Percentage of value in vulnerable accounts is unmeasurable from dossier.
Production Cryptographic Protection
Consensus-critical authentication
Claim: Consensus relies on VRF and sortition using classical ECC-based cryptography (Ed25519/ECVRF).
Coverage basis: Classical ECC-only consensus authentication
Implementation score: 0 · Evidence confidence: High
Issue classification: quantum-critical vulnerability · Score treatment: cap-applying
Quantum blocker: Consensus finality, validator authentication, randomness, or block certification remains quantum-vulnerable
Assurance: Pure PoS documentation confirms classical VRF/sortition; no PQ consensus migration evidenced prior to 2027.
Roadmap mentions ongoing research for PQ VRF and consensus signatures but no production deployment.
Production Cryptographic Protection
State-integrity and data-availability mechanisms
Claim: State proofs use Falcon-1024 signatures since 2022, providing PQ protection for state integrity.
Coverage basis: PQ-protected state proofs
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Falcon state proofs are well-documented and live since 2022.
State integrity layer is PQ-protected; this does not extend to spend authorization or consensus.
Production Cryptographic Protection
Privacy and proof layers
Claim: Algorand does not have a native privacy layer; privacy-specific subfactors are not applicable.
Coverage basis: No privacy layer
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Production Cryptographic Protection
P2P transport, node identity, and peer authentication
Claim: P2P node identity and transport layer details are not specified in the dossier.
Coverage basis: Insufficient evidence
Implementation score: 0.5 · Evidence confidence: Low
Issue classification: quantum-critical uncertainty · Score treatment: confidence-only
Assurance: No evidence provided for P2P layer cryptographic implementation.
P2P identity may use classical cryptography but impact on spend/consensus is unclear.
Production Cryptographic Protection
Critical wallet, custody, HSM, signer, and hardware-wallet workflows
Claim: Wallet and custody workflow support for Falcon-1024 is not evidenced; current workflows support Ed25519.
Coverage basis: Classical ECC-only wallet support
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: operational/product caveat · Score treatment: score-reducing
Assurance: Roadmap mentions hybrid accounts and multisig planned by end 2026 but no current wallet support evidenced.
Native Falcon account support pending v5.0.0 activation.
Migration Status & Value-at-Risk
Percentage of economically relevant value-at-risk protected
Claim: Percentage of economically relevant value-at-risk protected by PQ paths is unmeasurable from the dossier.
Coverage basis: Unmeasurable migration coverage
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: quantum-critical uncertainty · Score treatment: score-reducing
Assurance: No public analytics on migration coverage or value-at-risk distribution.
Native Falcon accounts not yet activated; migration coverage is effectively 0% as of evaluation date.
Migration Status & Value-at-Risk
Critical wallets migrated, protected, or inherently PQ-native
Claim: Migration status of critical wallets (treasuries, exchanges, custodians) is not evidenced.
Coverage basis: Unmeasurable critical wallet migration
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: quantum-critical uncertainty · Score treatment: score-reducing
Assurance: No exchange or custody migration attestations provided.
Critical wallet migration cannot occur until native Falcon accounts are activated.
Migration Status & Value-at-Risk
Legacy vulnerable pools identified, measurable, deprecated, migrated, frozen, or absent by design
Claim: Legacy Ed25519 accounts remain vulnerable with no evidenced deprecation, freeze, or burn policy.
Coverage basis: Unaddressed legacy vulnerable pools
Implementation score: 0 · Evidence confidence: Medium
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Assurance: No governance plans evidenced for deprecating or freezing legacy Ed25519 accounts.
Legacy accounts will remain indefinitely vulnerable unless policy is implemented.
Migration Mechanism, Governance & Ecosystem Coordination
Public migration or protection roadmap
Claim: Algorand has published a detailed post-quantum cryptography roadmap with sequencing and milestones through 2027.
Coverage basis: Public roadmap with sequencing
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Roadmap is detailed and specific with Q3 2026 and 2027 milestones.
Roadmap is forward-looking; production deployment status requires verification.
Migration Mechanism, Governance & Ecosystem Coordination
Migration accessibility and defaults
Claim: Native Falcon-1024 accounts are in v5.0.0 cooldown; migration tooling and accessibility not yet available.
Coverage basis: Migration not yet accessible
Implementation score: 0.25 · Evidence confidence: Medium
Issue classification: operational/product caveat · Score treatment: score-reducing
Assurance: v5.0.0 upgrade in cooldown; migration accessibility pending activation.
Users cannot currently create native Falcon accounts or migrate existing balances.
Migration Mechanism, Governance & Ecosystem Coordination
Migration enforcement and ecosystem coordination
Claim: No enforcement mechanisms evidenced for deprecating legacy Ed25519 accounts or coordinating exchange/custody migration.
Coverage basis: No enforcement mechanisms
Implementation score: 0 · Evidence confidence: Medium
Issue classification: quantum-critical vulnerability · Score treatment: score-reducing
Assurance: No governance plans evidenced for mandatory migration or legacy account deprecation.
Enforcement mechanisms are critical for addressing long-exposure vulnerable value.
Migration Mechanism, Governance & Ecosystem Coordination
Emergency disclosure, incident response, or quantum governance
Claim: Emergency disclosure and incident-response process for quantum vulnerabilities is not evidenced.
Coverage basis: No emergency governance evidenced
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: assurance-only caveat · Score treatment: confidence-only
Assurance: No formal quantum-specific incident-response playbook evidenced.
Emergency governance is important but does not directly affect current quantum-attack readiness.
Algorithm & Implementation Assurance
Standardized, standards-track, or broadly reviewed PQC algorithm selection
Claim: Algorand uses Falcon-1024, a NIST-standardized PQC algorithm, for state proofs and planned native accounts.
Coverage basis: NIST-standardized PQC algorithm
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Falcon-1024 is a NIST-standardized algorithm appropriate for digital signatures.
Algorithm selection is sound; implementation assurance is separate.
Algorithm & Implementation Assurance
Independent cryptographic and implementation audit
Claim: Independent audit specifically covering Falcon implementations and v5.0.0 upgrade is not evidenced.
Coverage basis: No independent audit evidenced
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: assurance-only caveat · Score treatment: confidence-only
Assurance: No independent audit evidenced for Falcon implementations or v5.0.0 upgrade.
Audit absence affects confidence but not QRI score unless quantum-critical properties are unverifiable.
Algorithm & Implementation Assurance
Open-source, reproducible implementation
Claim: Algorand's go-algorand repository is publicly available on GitHub.
Coverage basis: Open-source implementation
Implementation score: 1 · Evidence confidence: High
Issue classification: none · Score treatment: not applicable
Assurance: Source code is publicly available for review and reproducibility.
Open-source status supports independent verification of implementations.
Algorithm & Implementation Assurance
Parameter agility and future upgrade path
Claim: Algorand roadmap mentions cryptographic agility for multiple schemes and future upgrades.
Coverage basis: Documented parameter agility
Implementation score: 0.75 · Evidence confidence: Medium
Issue classification: none · Score treatment: not applicable
Assurance: Roadmap mentions cryptographic agility but implementation details are limited.
Parameter agility is important for future PQ-to-PQ upgrades.
Algorithm & Implementation Assurance
Stateful-signature, side-channel, fault-injection, HSM, and custody implementation risks
Claim: Implementation risk controls for Falcon signatures (stateful/stateless, side-channel, etc.) are not detailed in the dossier.
Coverage basis: Insufficient evidence
Implementation score: 0.5 · Evidence confidence: Low
Issue classification: assurance-only caveat · Score treatment: confidence-only
Assurance: Falcon is a stateless signature scheme, reducing state-management risks compared to XMSS/LMS.
Implementation risk controls are important but do not directly affect current quantum-attack readiness.
Algorithm & Implementation Assurance
Performance and resource-impact analysis
Claim: Formal performance and resource-impact analysis for Falcon-1024 is not evidenced.
Coverage basis: No performance analysis evidenced
Implementation score: 0.25 · Evidence confidence: Low
Issue classification: assurance-only caveat · Score treatment: confidence-only
Assurance: No formal performance benchmark evidenced for Falcon-1024 native accounts.
Performance analysis is important but does not directly affect current quantum-attack readiness unless resource constraints prevent safe use.
Report metadata