ARBITRUM ONE · rollup-L2 · QRI 18 · BAND 2 Acknowledged Hybrid FAIL · Stage 0 · Washing 1x

Arbitrum is the biggest L2 at $16.2B TVL and its quantum strategy is to wait for Ethereum. That is not laziness, it is the correct answer for a rollup, but it does mean the Stylus and account abstraction machinery sits idle until someone upstream moves. Delegated readiness is still readiness with a counterparty.

inLinkedIn XPost ▼Scorecard JSON ⇆Compare Verified 2026-04-18

Summary

Arbitrum One is the largest L2 ($16.2B TVL) with strong governance and permissionless fraud proofs via BoLD, but zero quantum readiness. PQC is gated by Ethereum L1 migration. Stylus + AA give a theoretical pathway but no work shipped. Rollup-L2 scorecard applied.

What the gates say

Hybrid: FAIL. No hybrid plan on file.
Evidence: PASS. Sources reconstructable by third party.
Primitive naming: PASS. Named primitives at every scored sub-level.

Burn-vs-rescue policy on file

undeclared (dependent on Ethereum L1 policy)

Seven dimensions

Each dimension scores 0-100 internally; the weighted roll-up produces the QRI on the left. Open a row to read the sub-score detail.

1 Cryptographic Exposure 28 / 100

1a_primitive_inventory 10 / 20

Inherits Ethereum primitives. Nitro client uses EVM crypto primitives.

Primitives: ECDSA secp256k1 (inherited Ethereum) · Keccak-256 · BLS12-381 (Ethereum L1 settlement consensus)

Evidence: docs.arbitrum.io · github.com

1b_shor_grover_pq_tag 12 / 20

Evidence: docs.arbitrum.io

1c_algorithm_family_diversity 0 / 20

No PQC families deployed

1d_nist_security_category 0 / 20

No NIST PQC primitives deployed

1e_implementation_quality 6 / 20

Evidence: docs.arbitrum.io

2 HNDL Exposure 18 / 100

2a_active_key_exposure 4 / 20

$16.2B TVL, largest L2. All EOA sigs expose pubkeys on first tx.

2b_cold_key_exposure 4 / 20

42 months age; moderate cold-key exposure.

2c_signature_longterm_validity 5 / 20

Sequencer sigs and state root commitments forgeable post-Shor.

2d_encryption_confidentiality 5 / 20

Standard TLS; Sequencer API uses TLS/HTTPS.

3 Metadata & Privacy Exposure 15 / 100

3a_tx_graph_visibility 4 / 20

Pseudonymous EVM transparent ledger.

3b_rpc_mempool_concentration 3 / 20

Single Offchain Labs sequencer controls tx ordering.

3c_cross_chain_bridge_correlation 4 / 20

20+ bridges; correlation across Ethereum <-> Arbitrum is direct.

3d_retroactive_deanon_risk 4 / 20

No shielded pool; ECDSA Shor-breakable.

4 Migration Architecture 55 / 100

4a_crypto_agility 15 / 20

Stylus (WASM) enables custom verification including PQC. Nitro upgrade path via DAO.

4b_account_abstraction_key_rotation 15 / 20

Inherits ERC-4337, EIP-7702 (Pectra). Custom sig verification via AA.

4c_hard_fork_track_record 15 / 20

Stylus upgrade, BoLD permissionless validation (Feb 2025). 42-month upgrade history.

4d_hybrid_deployment_readiness 10 / 20

Architecturally possible via Stylus precompile but no hybrid work shipped.

5 Deployment Execution 3 / 100

5a_mainnet_pqc_pct 0 / 20

no public artifact found

5b_pqc_code_in_client 0 / 20

no PQC in Nitro

5c_validator_pqc_adoption 0 / 20

Centralized sequencer; BoLD validators do not use PQC

5d_published_milestones_count 0 / 20

no PQC milestones published

5e_pqc_washing_delta 3 / 20

No PQC announcements.

6 Supply Chain Vendor Readiness 7 / 100

6a_wallet 2 / 20

6b_bridge 1 / 20

6c_custodian 2 / 20

6d_rpc_hsm 2 / 20

7 Governance & Coordination 62 / 100

7a_validator_stake_distribution 10 / 20

Sequencer centralized (NC=1); BoLD permissionless validation since Feb 2025 improves decentralization.

7b_upgrade_cadence_under_pressure 18 / 20

Active DAO governance, Security Council (9/12 multisig).

7c_named_coordination_lead 20 / 20

Offchain Labs (Steven Goldfeder, Ed Felten) + Arbitrum Foundation.

7d_adversarial_coordination_precedent 14 / 20

Sequencer outages handled; no crypto-change adversarial precedent.

The X + Y vs Z inequality

X (data shelf life): 5-10 (EOA with rotation possible)

Y (migration time): 10-15

Z10 (10% CRQC year): 2036 · Z50 (50%): 2041

Verdict: X+Y > Z (danger).

Four-scenario grid

Scenario	Value preserved	Privacy preserved
quantum never	100%	100%
arrives suddenly pre migration	15%	5%
arrives slowly post migration	85%	70%
arrives slowly mid migration	50%	30%

Peers in the rollup-L2 profile

Order-book view of the 9 chains closest to Arbitrum One by QRI.

Public artifacts used for this scorecard

Each entry below is a sub-score citation. Clicking the link takes you to the public source. A third party should be able to reconstruct every number on this page from these URLs in 48 hours.

Cryptographic Exposure · 1a_primitive_inventory

Inherits Ethereum primitives. Nitro client uses EVM crypto primitives.

Cryptographic Exposure · 1b_shor_grover_pq_tag

https://docs.arbitrum.io

Cryptographic Exposure · 1e_implementation_quality

https://docs.arbitrum.io/how-arbitrum-works/bold

Supply chain snapshot

wallet MetaMask · Rabby · Ledger HW 0 PQC roadmaps

bridge Native Arbitrum Bridge · LayerZero · Across 0 PQC roadmaps

custodian Coinbase Custody · BitGo · Fireblocks 0 PQC roadmaps

rpc_hsm Alchemy · Infura · QuickNode 0 PQC roadmaps

A chain's supply chain cannot migrate faster than its slowest dependency. Zero PQC roadmaps in any of the four categories is a structural blocker, not a lagging indicator.

Analyst notes on the scoring

No Arbitrum-specific PQC work. When Ethereum ships PQC via AA, Arbitrum can inherit via Stylus/AA. Classified Band 2 Acknowledged because Ethereum's PQC posture implicitly covers it.

Scorecard metadata

Profile: rollup-L2
Scored: 2026-04-18 by layerqu-v2-scoring-agent-1
v1 reference: chainscreen-v1-archive
QRI raw: 18 · after caps: 18
Confidence interval: ±10
PQC washing ratio: 1x
Burn-vs-rescue: undeclared (dependent on Ethereum L1 policy)

Caps triggered

mosca_cap_60
sutor_stage_cap_2
casado_stage_cap_3
preskill_half_dim2_dim3_dim5_dim6
hybrid_gate_fail_cap_60