{ "chain_slug": "monero", "name": "Monero", "scorecard_profile": "privacy-L2", "evaluated_at": "2026-04-18", "evaluator": "layerqu-v2-scoring-agent-3", "v1_reference": "chainscreen-v1-archive", "dimensions": { "1_cryptographic_exposure": { "weight": 0.08, "score": 25, "sub_scores": { "1a_primitive_inventory": { "score": 12, "primitives_named": [ "CLSAG ring signatures over Ed25519 (Curve25519)", "Pedersen commitments (Ed25519) for amount hiding", "Stealth addresses via ECDH (Ed25519)", "RandomX (PoW mining, ASIC-resistant)", "Keccak-256 (block/tx hashing)", "Bulletproofs+ (range proofs, Ed25519)" ], "evidence": [ "https://github.com/monero-project/monero", "https://www.getmonero.org/resources/research-lab/" ], "note": "Entire Monero privacy stack is Ed25519/Curve25519-based." }, "1b_shor_grover_pq_tag": { "score": 12, "tags": { "CLSAG / Ed25519 ring sigs": "Shor-break", "Pedersen commitments (Ed25519)": "Shor-break", "Stealth address ECDH": "Shor-break", "Bulletproofs+": "Shor-break", "RandomX": "Grover-weaken (hash-based)", "Keccak-256": "Grover-weaken-128bit" }, "evidence": [] }, "1c_algorithm_family_diversity": { "score": 0, "families_represented": 0, "families": [], "note": "ECC-only. No PQC family deployed in production." }, "1d_nist_security_category": { "score": 0, "mappings": {}, "note": "No NIST PQC primitives deployed" }, "1e_implementation_quality": { "score": 1, "formal_verification": "Academic peer review of CLSAG, Bulletproofs+, RandomX", "constant_time": "monero-project C++ implementation", "libraries": [ "monero-project/monero", "cryptonote reference" ], "evidence": [ "https://github.com/monero-project/monero" ] } }, "total_artifacts": 3 }, "2_hndl_exposure": { "weight": 0.1, "score": 6, "sub_scores": { "2a_active_key": { "score": 1, "note": "Catastrophic HNDL exposure: every XMR transaction in the chain (since 2014) uses ECC primitives. Shor break retroactively de-anonymizes ALL historical privacy-preserving tx." }, "2b_cold_key": { "score": 1, "note": "11+ years of cold keys. Every historical ring signature forgeable under Shor." }, "2c_sig_long_term": { "score": 2, "note": "CLSAG ring signatures persist on the Monero chain permanently — all retroactively Shor-breakable." }, "2d_encryption_conf": { "score": 2, "note": "Stealth addresses + Pedersen commitments ALL ECC-based. Shor-break reveals amount + recipient retroactively for every historical tx." } }, "total_artifacts": 3 }, "3_metadata_privacy_exposure": { "weight": 0.3, "score": 45, "sub_scores": { "3a_graph_visibility": { "score": 15, "note": "Ring signatures + stealth addresses + Pedersen commitments currently hide sender, recipient, and amount. Post-Shor: ALL three privacy layers break retroactively." }, "3b_rpc_concentration": { "score": 10, "note": "Pool concentration in RandomX mining. Seed nodes distributed but fewer than BTC. Dandelion++ limits mempool correlation." }, "3c_bridge_correlation": { "score": 10, "note": "Minimal bridge surface (CEX deposits/withdrawals primary). Bridge correlation lower than most chains." }, "3d_retroactive_deanon": { "score": 10, "note": "CRITICAL: Monero is the highest-stakes retroactive-deanon scenario in blockchain. A future Shor-capable adversary could retroactively deanonymize every historical XMR transaction, exposing all historical ring-sig senders, stealth-addr recipients, and Pedersen-committed amounts. Entire privacy thesis evaporates retroactively." } }, "total_artifacts": 3 }, "4_migration_architecture": { "weight": 0.15, "score": 35, "sub_scores": { "4a_crypto_agility": { "score": 10, "note": "Monero has a coordinator-free hard-fork discipline (every ~6 months historically). Proven ability to upgrade crypto primitives (RingCT → CLSAG; Bulletproofs → Bulletproofs+)." }, "4b_aa_key_rotation": { "score": 6, "note": "No native AA. Subaddresses + view keys provide some rotation primitive but not full AA." }, "4c_hard_fork_track_record": { "score": 12, "note": "Monero has the most aggressive hard-fork cadence in this batch. RingCT (2017), Bulletproofs (2018), CLSAG (2020), Bulletproofs+ (2022) all required coordinated hard forks and were executed successfully." }, "4d_hybrid_deployment_readiness": { "score": 7, "note": "CCS-funded PQC research (Raptor/MatRiCT+/GLYPH) explores PQ ring signatures and lattice-based primitives. No production deployment yet, but research pipeline is the strongest in this batch." } }, "total_artifacts": 3 }, "5_deployment_execution": { "weight": 0.15, "score": 8, "sub_scores": { "5a_mainnet_pqc_pct": { "score": 0, "mainnet_pqc_pct": 0, "evidence": [], "note": "No NIST PQC in production despite active research." }, "5b_pqc_code_in_consensus": { "score": 0, "loc_or_bytes": 0, "note": "no PQC in monero-project code" }, "5c_validator_pqc_keys": { "score": 0, "pct": 0, "note": "PoW, no validator set" }, "5d_published_milestones": { "score": 6, "count": 2, "milestones": [ "CCS-funded PQC ring signature research (Raptor, MatRiCT+)", "Monero Research Lab Seraphis (post-CLSAG) next-gen protocol discussions incorporating PQ considerations" ], "note": "Research-level milestones, no dated production schedule." }, "5e_pqc_washing_delta": { "score": 2, "ratio": 1.3, "note": "Monero community is unusually clear-eyed about ECC vulnerability. 'Privacy is not retroactively quantum-safe' messaging exists. Low washing." } }, "total_artifacts": 3 }, "6_supply_chain_vendor_readiness": { "weight": 0.1, "score": 10, "sub_scores": { "6a_wallet": { "score": 3, "top3": [ "monero-wallet-cli (official)", "Feather Wallet", "Cake Wallet" ], "pqc_roadmap_count": 0, "note": "Open-source wallets aligned with MRL research." }, "6b_bridge": { "score": 2, "top3": [ "No major bridges (CEX deposits/withdrawals primary)", "Atomic swap research", "Haveno DEX" ], "pqc_roadmap_count": 0 }, "6c_custodian": { "score": 2, "top3": [ "Reduced exchange custody post-delisting (2024 EU MiCA impact)", "Kraken (selective)", "BitGo (limited)" ], "pqc_roadmap_count": 0, "note": "Many exchanges have delisted XMR." }, "6d_rpc_hsm": { "score": 3, "top3": [ "Full-node self-hosting (dominant)", "Community seed nodes", "Tor/I2P integration" ], "pqc_roadmap_count": 0 } }, "total_artifacts": 2 }, "7_governance_coordination": { "weight": 0.12, "score": 55, "sub_scores": { "7a_validator_stake_distribution": { "score": 13, "note": "PoW RandomX ASIC-resistant. Pool concentration moderate. No premine, no foundation control." }, "7b_upgrade_cadence_under_pressure": { "score": 18, "note": "Monero has the strongest hard-fork coordination track record in this batch. 6-month hardfork cadence historically. Successfully executed multiple core-crypto changes (RingCT, Bulletproofs, CLSAG, Bulletproofs+)." }, "7c_named_coordination_lead": { "score": 14, "note": "Monero Research Lab (Sarang Noether, Surae Noether, koe, etc.). Community Crowdfunding System (CCS) funds research. No named 'PQC lead' but research culture is strongest in batch." }, "7d_adversarial_coordination_precedent": { "score": 10, "note": "Handled ASICMiner attacks, responded to ring-size attacks, handled Bulletproofs critical vulnerability disclosure + hardfork. Demonstrated ability to coordinate under security pressure." } }, "total_artifacts": 3 } }, "gates": { "hybrid_deployment": "FAIL", "evidence_reconstruction": "PASS", "primitive_naming": "PASS" }, "caps_applied": [ "Mosca (5a<20% → QRI max 60)", "Sutor (5d count=2 — Migration Stage max 2, borderline 3)", "Casado (3+ vendor tiles pqc=0 → migration_stage max 3)", "Hybrid gate FAIL → QRI cap 60" ], "qri": { "raw": 28, "after_caps": 28, "ci_plus_minus": 10, "band": 3, "band_name": "Intentional" }, "migration_stage": 2, "mosca_inequality": { "X_signature_shelf_life_years": "20+ (privacy retroactive-deanon risk extends indefinitely backward over 11+ years of chain history)", "Y_migration_time_years_range": "6-10 (strongest research pipeline + fastest hard-fork cadence in batch)", "Z_10pct_year": 2036, "Z_50pct_year": 2041, "danger_zone_at_50pct": true }, "four_scenario_grid": { "quantum_never": { "value_preserved_pct": 100, "privacy_preserved_pct": 100 }, "arrives_suddenly_pre_migration": { "value_preserved_pct": 30, "privacy_preserved_pct": 0 }, "arrives_slowly_post_migration": { "value_preserved_pct": 85, "privacy_preserved_pct": 30 }, "arrives_slowly_mid_migration": { "value_preserved_pct": 55, "privacy_preserved_pct": 10 } }, "burn_vs_rescue_policy": "undeclared", "pqc_washing_ratio": 1.3, "vendor_tile_summary": { "wallet": { "top3": [ "monero-wallet-cli", "Feather Wallet", "Cake Wallet" ], "pqc_roadmap_count": 0 }, "bridge": { "top3": [ "No major bridges", "Atomic swap research", "Haveno DEX" ], "pqc_roadmap_count": 0 }, "custodian": { "top3": [ "Reduced exchange custody", "Kraken", "BitGo" ], "pqc_roadmap_count": 0 }, "rpc_hsm": { "top3": [ "Full-node self-hosting", "Community seed nodes", "Tor/I2P integration" ], "pqc_roadmap_count": 0 } }, "narrative_summary": "Monero is the hardest case in this batch. Every privacy primitive is ECC-based: CLSAG ring signatures over Ed25519, Pedersen commitments on Ed25519, stealth addresses via ECDH, Bulletproofs+ range proofs. A future Shor-capable adversary retroactively de-anonymizes every transaction since 2014 — sender, recipient, amount. This is the single worst retroactive-deanon scenario in the 25-chain batch. Offsetting: Monero has the STRONGEST migration architecture in the batch — aggressive hardfork cadence (RingCT, Bulletproofs, CLSAG, Bulletproofs+ all successful), CCS-funded PQC ring signature research (Raptor, MatRiCT+), and an active Monero Research Lab culture. Band 3 Intentional reflects the research pipeline + hardfork capability but no deployed PQC. Privacy-L2 weight profile amplifies the Dimension 3 weight (30%) to reflect that retroactive deanon is the core quantum risk for Monero.", "evaluator_notes": "Dimension 3 (Privacy Exposure) is weighted 30% for privacy-L2 profile, reflecting that retroactive deanonymization is Monero's primary quantum risk. HNDL score is near-floor (6/100) because every historical tx is Shor-exposed — no defense-in-depth. Migration architecture is near-ceiling for this batch because of the research pipeline + hardfork cadence. PQC-washing risk is LOW here — the Monero community is clear-eyed about the retroactive vulnerability. Seraphis and Jamtis (next-gen Monero protocol proposals) incorporate PQ considerations but aren't yet production-bound.", "narrative_voiced": "Monero is the only chain where a slow quantum arrival is still a catastrophe. Every ring signature since 2014 is Ed25519, every stealth address is ECDH, every amount is a Pedersen commitment. When Shor lands, the privacy of an eleven-year chain unwinds backwards, not forwards." }