QRL Weekly: Ledger app audit is complete, 2026-September-04

4th September 2026

Weekly Development Snapshot

August 4th: Audit results published for go-qrllib
April 3rd: Audit complete of 2 cryptographic libraries
March 31st: QRL 2.0 Testnet V2 Released
Audits: 50% completion (55% after remediation complete for the Ledger app audit)

Ledger app audit is complete and remediation work is underway.

No critical issues or cryptographic concerns highlighted.
Post-quantum signing engine is correctly built, and matches, byte-for-byte, an independently audited reference implementation.
In smoke tests, signatures are correctly accepted by go-qrl and transactions are incorporated into the blockchain

qrysm

Add randao_commit in deposit contract, to drastically reduce the chance to manipulate the validator role for next epoch by last slot block proposer of previous epoch
Fix: Sign aggregator selection proofs once per slot and deterministically under hedged ML-DSA-87
Fix: Bump go-qrl for the 5-field depositroot precompile and drop the deposit test skips
Fix: Restore build of //beacon-chain/rpc/qrl/validator:validator_test (missing proto dep)
Fix: Detect surround votes regardless of attestation order in updateSpans
Fix: Use Q-prefixed execution addresses in REST validator client block JSON
Fix: Take the forkchoice write lock in lateBlockTasks before notifying the engine
Updated and added new unit tests

web3.js

Fix VM64 event topic encoding and filtering
Fix wallet integration tests to use a typed provider and valid Argon2id options
Fix(web3-qrl-contract): use QRL bytecode in estimateGas without-0x test
Fix(web3-qrl-contract): expect checksummed QRL address in revert receipt
Fix(web3-qrl-contract): update CustomError revert data for VM64
Fix(web3-qrl-contract): remove unused @ts-expect-error in contract_defaults test
Fix(web3-qrl-contract): refresh SimpleOverloaded bytecode for VM64
Updated and added new unit tests

qrl-tests

hyperion

go-qrl

4th September 2026

WRITTEN BY