QRL Weekly, 2026-August-07

Weekly Development Snapshot

Status / overview

• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits: 50% completion

QRL 2.0 (Project Zond)

qrl-web3-wallet

• further security-audit remediation and code-review fixes
• corrected address display and updated documentation

web3.js

• updated CI actions and patched vulnerabilities affecting fast-uri, PostCSS, SVGO and brace-expansion

js-qrl-cryptography

• updated pinned GitHub Actions and the fast-uri dependency

go-qrllib

• updated pinned GitHub Actions and opened further test-related work

qrypto.js

• updated development dependencies, lockfiles and CI actions for mldsa87

qrvmc

• Harden hex parsing, example VMs, and loader
• Tighten gas validation, loader TLS and ABI docs

go-qrl

• –bootnodes flag now override config value
• Go toolchain updated to 1.26.5
• external function values updated to 64-byte address plus a 4-byte selector
• Removed legacy local testnet script (now being moved to new repo qrl-tests)
• Several other bug fixes

qrysm

• Updated tests
• Go toolchain updated to 1.26.5
• Updated QRL dependencies
• Update the staking deposit CLI default to the valid deposit contract address
• Default address aligned with the Qrysm network config
• Fix Zond consensus version descriptor

web3.js

• ICAP and IBAN support removed as those are deprecated
• Added 64 byte topics and 512-bit integers data type

qrl-package

• Changes merged related to 64-byte address

QRL 1.0

dice

• 2018 Python script rewritten as JavaScript application
• session isolation, CI and browser end-to-end tests
• a verifiable single-file offline release

qrllib

• added RNG-regression protection
• modernised Emscripten support
• migrated release processes to GitHub Actions
• added trusted publishing and npm/PyPI deployment
• v1.2.6 released

offline-wallet-generator

• merge of v3 wallet format with stronger encryption and password security
• added reproducible offline builds, CSP tests and a security-focused CI/release pipeline

qrl-wallet

• 7 issues closed
• continued UI refinements
• gated multisig signing on validation and tighter OTS-reuse checks
• applied security hardening and documentation updates
• v1.9.1-beta in pre-release

qrllib-browserify

• updated support to Node.js 22+
• rebuilt the bundle for qrllib 1.2.6 and corrected module export and Browserify interoperability

qrl-cli

• replaced the aes256 dependency with scrypt-derived AES-256-GCM encryption while retaining compatibility with legacy wallet files

Other News & Updates

QRL Announces Trail of Bits Publication of Security Assessment of its Cryptographic Heart, With All Findings Resolved

An independent review examined the cryptographic heart of QRL, including implementations, public API, and wallet state management.

Reflections on the COLDCARD RNG Exploit

The Coldcard RNG exploit shows how silently degraded entropy can put hardware wallet users at risk. QRL v1 wallets remain secure with 384 bits of operating-system entropy, while the incident underscores the need for continuous audits, fail-closed randomness, and quantum-resistant cryptography.