FLOW · L1 · QRI 14 · BAND 1 Acknowledged Hybrid FAIL · Stage 0 · Washing 1x

Flow already has the architecture a PQC-ready chain would design: account IDs separate from pubkeys, multi-key weight-thresholds, native P-256 alongside secp256k1. It has never used any of it for PQC. The interesting chains are the ones quietly prepared and never pulling the trigger.

inLinkedIn XPost ▼Scorecard JSON ⇆Compare Verified 2026-04-18

Summary

Flow (Dapper Labs) has notable structural PQC readiness without PQC activity: addresses decoupled from pubkeys (like Hedera), multi-key accounts with weight-threshold (like EOS), native P-256 + secp256k1 support. Zero PQC research or code. Dec 2025 counterfeit token incident (Upbit halted) showed coordination test.

What the gates say

Hybrid: FAIL. No hybrid plan on file.
Evidence: PASS. Sources reconstructable by third party.
Primitive naming: PASS. Named primitives at every scored sub-level.

Burn-vs-rescue policy on file

undeclared

Seven dimensions

Each dimension scores 0-100 internally; the weighted roll-up produces the QRI on the left. Open a row to read the sub-score detail.

1 Cryptographic Exposure 22 / 100

1a_primitive_inventory 11 / 20

Flow supports both secp256k1 and P-256 natively. Multi-key accounts with weight-threshold (similar to EOS).

Primitives: ECDSA secp256k1 (account signatures) · ECDSA P-256 / secp256r1 (alternate account signatures, WebAuthn compat) · BLS12-381 (staking + consensus) · SHA3-256 (hashing, Keccak variant)

Evidence: developers.flow.com

1b_shor_grover_pq_tag 8 / 20

1c_algorithm_family_diversity 0 / 20

1d_nist_security_category 3 / 20

1e_implementation_quality 0 / 20

2 HNDL Exposure 18 / 100

2a_active_key_exposure 5 / 20

Flow addresses are 8-byte identifiers NOT derived from pubkey — similar to Hedera. Pubkey only exposed on tx. Structural advantage.

2b_cold_key_exposure 4 / 20

57 months mainnet (since Oct 2020). Moderate cold supply.

2c_signature_longterm_validity 4 / 20

All ECDSA/BLS sigs Shor-breakable.

2d_encryption_confidentiality 5 / 20

Standard TLS.

3 Metadata & Privacy Exposure 22 / 100

3a_tx_graph_visibility 6 / 20

Transparent; NFT-heavy chain (NBA Top Shot) has high linkability of collector identities.

3b_rpc_mempool_concentration 5 / 20

Flow Access Nodes (Dapper + partners).

3c_cross_chain_bridge_correlation 5 / 20

LayerZero integration.

3d_retroactive_deanon_risk 6 / 20

Address-decoupling helps; but NFT-ownership correlation still possible.

4 Migration Architecture 38 / 100

4a_crypto_agility 12 / 20

Multi-key accounts natively support adding new key types with weight-threshold. Similar to EOS/Hedera pattern.

4b_account_abstraction_key_rotation 10 / 20

Native multi-sig + weight-threshold + key rotation. Cadence language supports custom authorizers.

4c_hard_fork_track_record 10 / 20

Crescendo upgrade (EVM compat), Cadence 1.0 migration successfully shipped. Strong track record.

4d_hybrid_deployment_readiness 6 / 20

No hybrid path announced; Dec 2025 counterfeit token incident (Upbit halted) damaged trust somewhat.

5 Deployment Execution 2 / 100

5a_mainnet_pqc_pct 0 / 20

Zero.

5b_pqc_code_in_client 0 / 20

None in flow-go.

5c_validator_pqc_adoption 0 / 20

Consensus + Collection + Execution + Verification nodes all on classical crypto.

5d_published_milestones_count 0 / 20

None.

5e_pqc_washing_delta 2 / 20

No PQC claims.

6 Supply Chain Vendor Readiness 3 / 100

6a_wallet 1 / 20

6b_bridge 1 / 20

6c_custodian 1 / 20

6d_rpc_hsm 0 / 20

7 Governance & Coordination 42 / 100

7a_validator_stake_distribution 8 / 20

Multi-role node architecture; Dapper-concentrated.

7b_upgrade_cadence_under_pressure 12 / 20

Cadence 1.0, Crescendo EVM both shipped. Strong capacity.

7c_named_coordination_lead 12 / 20

Named: Dieter Shirley (Dapper Labs CTO, Flow creator), Roham Gharegozlou. No PQC lead.

7d_adversarial_coordination_precedent 10 / 20

Dec 2025 counterfeit token incident tested coordination; Upbit halted. Response capacity documented but mixed.

The X + Y vs Z inequality

X (data shelf life): 5-15 (NBA Top Shot + NFT holders long-term)

Y (migration time): 4-8 (multi-key architecture accelerates)

Z10 (10% CRQC year): 2036 · Z50 (50%): 2041

Verdict: X+Y < Z (safe).

Four-scenario grid

Scenario	Value preserved	Privacy preserved
quantum never	100%	100%
arrives suddenly pre migration	20%	12%
arrives slowly post migration	65%	40%
arrives slowly mid migration	35%	18%

Peers in the L1 profile

Order-book view of the 9 chains closest to Flow by QRI.

Public artifacts used for this scorecard

Each entry below is a sub-score citation. Clicking the link takes you to the public source. A third party should be able to reconstruct every number on this page from these URLs in 48 hours.

Cryptographic Exposure · 1a_primitive_inventory

Flow supports both secp256k1 and P-256 natively. Multi-key accounts with weight-threshold (similar to EOS).

https://developers.flow.com/build/basics/accounts

Supply chain snapshot

wallet Blocto · Lilico · Dapper Wallet 0 PQC roadmaps

bridge LayerZero · Celer 0 PQC roadmaps

custodian Coinbase Custody · Anchorage 0 PQC roadmaps

rpc_hsm Flow Access Nodes · Dapper Labs Infra 0 PQC roadmaps

A chain's supply chain cannot migrate faster than its slowest dependency. Zero PQC roadmaps in any of the four categories is a structural blocker, not a lagging indicator.

Analyst notes on the scoring

Third-highest Migration Architecture score in batch after Hedera and EOS, thanks to native multi-key + address-decoupling. Zero execution. Stage 1 Acknowledged (generous).

Scorecard metadata

Profile: L1
Scored: 2026-04-18 by layerqu-v2-scoring-agent-2
v1 reference: chainscreen-v1-archive
QRI raw: 14 · after caps: 14
Confidence interval: ±6
PQC washing ratio: 1x
Burn-vs-rescue: undeclared

Caps triggered

mosca_cap_60 (5a=0)
sutor_cap_50 (5d=0)
casado_cap (vendors 0)