# QRL Weekly: Ledger app audit is complete, 2026-September-04

> For the complete documentation index, see [llms.txt](/llms.txt). This markdown page mirrors [the canonical HTML page](/weekly/2026-september-04/).





Published: 2026-09-04
Updated: 2026-09-04



Author: The QRL Core Contributors
















Weekly Development Snapshot Status / overview August 4th: Audit results published for go-qrllib April 3rd: Audit complete of 2 cryptographic libraries March 31st: QRL 2.0 Testnet V2 Released Audits: 50% completion (55% after remediation complete for the Ledger app audit) QRL 2.0 (Project Zond) Ledger app audit is complete and remediation work is underway.
No critical issues or cryptographic concerns highlighted. Post-quantum signing engine is correctly built, and matches, byte-for-byte, an independently audited reference implementation. In smoke tests, signatures are correctly accepted by go-qrl and transactions are incorporated into the blockchain qrysm
Add randao_commit in deposit contract, to drastically reduce the chance to manipulate the validator role for next epoch by last slot block proposer of previous epoch Fix: Sign aggregator selection proofs once per slot and deterministically under hedged ML-DSA-87 Fix: Bump go-qrl for the 5-field depositroot precompile and drop the deposit test skips Fix: Restore build of //beacon-chain/rpc/qrl/validator:validator_test (missing proto dep) Fix: Detect surround votes regardless of attestation order in updateSpans Fix: Use Q-prefixed execution addresses in REST validator client block JSON Fix: Take the forkchoice write lock in lateBlockTasks before notifying the engine Updated and added new unit tests web3.js
Fix VM64 event topic encoding and filtering Fix wallet integration tests to use a typed provider and valid Argon2id options Fix(web3-qrl-contract): use QRL bytecode in estimateGas without-0x test Fix(web3-qrl-contract): expect checksummed QRL address in revert receipt Fix(web3-qrl-contract): update CustomError revert data for VM64 Fix(web3-qrl-contract): remove unused @ts-expect-error in contract_defaults test Fix(web3-qrl-contract): refresh SimpleOverloaded bytecode for VM64 Updated and added new unit tests qrl-tests
[1/3] Add shared gqrl console E2E harness and API smoke coverage Collect E2E diagnostics through the Kurtosis API Add gqrl console contract and indexed topic coverage Add gqrl console transaction, constructor, and event coverage hyperion
Add randao_commitment argument to the depositroot builtin go-qrl
core/vm: add randao_commitment to the depositroot precompile input