COSMOS HUB · L1 · QRI 14 · BAND 1 Acknowledged Hybrid FAIL · Stage 0 · Washing 1x

Cosmos Hub sits above ~40 IBC app-chains on Ed25519 and secp256k1, and the only PQC code in the ecosystem is DoraFactory's external cosmos-pqc fork. Upgrading the Hub alone changes nothing downstream. ATOM 2.0's rejection already showed that coordination is the actual bottleneck.

inLinkedIn XPost ▼Scorecard JSON ⇆Compare Verified 2026-04-18

Summary

Cosmos Hub (ATOM) runs CometBFT with Ed25519 validator sigs and secp256k1 account sigs. Zero PQC on mainnet, zero PQC in CometBFT main branch. DoraFactory's cosmos-pqc external research fork is the only PQC code in the ecosystem. ATOM 2.0 governance rejection shows coordination difficulty. Hybrid gate fails.

What the gates say

Hybrid: FAIL. No hybrid plan on file.
Evidence: PASS. Sources reconstructable by third party.
Primitive naming: PASS. Named primitives at every scored sub-level.

Burn-vs-rescue policy on file

undeclared

Seven dimensions

Each dimension scores 0-100 internally; the weighted roll-up produces the QRI on the left. Open a row to read the sub-score detail.

1 Cryptographic Exposure 22 / 100

1a_primitive_inventory 11 / 20

Inventory clear from Cosmos SDK/CometBFT docs.

Primitives: Ed25519 (CometBFT validator signatures) · secp256k1 (account signatures) · SHA-256 (hashing)

Evidence: docs.cometbft.com · github.com

1b_shor_grover_pq_tag 8 / 20

1c_algorithm_family_diversity 0 / 20

No PQC.

1d_nist_security_category 3 / 20

1e_implementation_quality 0 / 20

2 HNDL Exposure 18 / 100

2a_active_key_exposure 4 / 20

cosmos1... addresses derived from secp256k1 pubkey hash; pubkey exposed on first tx. Similar to Ethereum EOA pattern.

2b_cold_key_exposure 4 / 20

66 months mainnet; significant exposed cold supply.

2c_signature_longterm_validity 5 / 20

All historical sigs Shor-breakable; IBC relay sigs also.

2d_encryption_confidentiality 5 / 20

Standard TLS; no PQC in p2p.

3 Metadata & Privacy Exposure 20 / 100

3a_tx_graph_visibility 5 / 20

Transparent; IBC cross-chain makes linkable.

3b_rpc_mempool_concentration 5 / 20

Public Osmosis, Keplr, Strangelove endpoints.

3c_cross_chain_bridge_correlation 5 / 20

IBC + Gravity Bridge + Skip Protocol heavy correlation.

3d_retroactive_deanon_risk 5 / 20

No ZK on Cosmos Hub; minimal retroactive deanon.

4 Migration Architecture 38 / 100

4a_crypto_agility 12 / 20

Cosmos SDK modular; CometBFT signature scheme pluggable in principle. Interchain Security v2 live.

4b_account_abstraction_key_rotation 8 / 20

authz/feegrant modules support delegation; no native AA but some key abstraction.

4c_hard_fork_track_record 10 / 20

Coordinated upgrades smooth (v10, v11, v12). IBC adoption strong.

4d_hybrid_deployment_readiness 8 / 20

DoraFactory cosmos-pqc external research exists; no mainnet hybrid path.

5 Deployment Execution 4 / 100

5a_mainnet_pqc_pct 0 / 20

Zero. Mosca cap.

5b_pqc_code_in_client 1 / 20

DoraFactory cosmos-pqc external fork; not in CometBFT main branch.

5c_validator_pqc_adoption 0 / 20

All ~180 validators on Ed25519.

5d_published_milestones_count 1 / 20

DoraFactory cosmos-pqc research only.

5e_pqc_washing_delta 2 / 20

Low announcement volume.

6 Supply Chain Vendor Readiness 4 / 100

6a_wallet 1 / 20

6b_bridge 1 / 20

6c_custodian 1 / 20

6d_rpc_hsm 1 / 20

7 Governance & Coordination 52 / 100

7a_validator_stake_distribution 12 / 20

~180 validators; top 10 control majority (moderate Nakamoto).

7b_upgrade_cadence_under_pressure 14 / 20

Consistent upgrades via governance.

7c_named_coordination_lead 14 / 20

Named: Informal Systems, Strangelove, Interchain Foundation. No named PQC lead.

7d_adversarial_coordination_precedent 12 / 20

ATOM 2.0 proposal rejection showed active governance. Coordination feasible but contentious.

The X + Y vs Z inequality

X (data shelf life): 5-15

Y (migration time): 5-10 (SDK upgrade + validator coordination)

Z10 (10% CRQC year): 2036 · Z50 (50%): 2041

Verdict: X+Y > Z (danger).

Four-scenario grid

Scenario	Value preserved	Privacy preserved
quantum never	100%	100%
arrives suddenly pre migration	10%	5%
arrives slowly post migration	55%	30%
arrives slowly mid migration	30%	15%

Peers in the L1 profile

Order-book view of the 9 chains closest to Cosmos Hub by QRI.

Public artifacts used for this scorecard

Each entry below is a sub-score citation. Clicking the link takes you to the public source. A third party should be able to reconstruct every number on this page from these URLs in 48 hours.

Cryptographic Exposure · 1a_primitive_inventory

Inventory clear from Cosmos SDK/CometBFT docs.

Supply chain snapshot

wallet Keplr · Leap · Ledger HW 0 PQC roadmaps

bridge IBC · Gravity Bridge · Axelar 0 PQC roadmaps

custodian Coinbase Custody · BitGo · Anchorage 0 PQC roadmaps

rpc_hsm Strangelove · Polkachu · Imperator 0 PQC roadmaps

A chain's supply chain cannot migrate faster than its slowest dependency. Zero PQC roadmaps in any of the four categories is a structural blocker, not a lagging indicator.

Analyst notes on the scoring

Hub of IBC economy (~40+ app-chains inherit this crypto posture). Migration of Cosmos Hub alone would not migrate the appchain ecosystem. Classic Stage 0/1.

Scorecard metadata

Profile: L1
Scored: 2026-04-18 by layerqu-v2-scoring-agent-2
v1 reference: chainscreen-v1-archive
QRI raw: 14 · after caps: 14
Confidence interval: ±6
PQC washing ratio: 1x
Burn-vs-rescue: undeclared

Caps triggered

mosca_cap_60 (5a=0)
sutor_cap_50 (5d=1)
casado_cap (all vendors 0 PQC roadmaps)