QRL Weekly, 2026-September-18

Weekly Development Snapshot

Status

• September 18th: QRL Release Verifier audit complete
• September 11th: Ledger app audit along with its remediation is complete
• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 Released
• Audits & Remediation: 60%

QRL 2.0 Testnet V3 remaining work:

• Config parameters
• Upstream bug fixes
• Testnet V2 scoped audits complete

QRL 2.0

qrysm

• EpochsPerSlashingsVector is now 512 - 45 days, 12 hours, 16 minutes
• fix(builder): raise execution payload response limit to 32 MiB
• fix(config): reject malformed YAML without partially applying overrides as well as validate values for some config parameters
• fix(sync): prevent zero polling intervals for one-slot epochs
• Reject empty signature groups and nil public keys, which was being accepted earlier
• Remove unbounded ML-DSA public key cache, fixing memory leak
• Prevent panics on malformed ML-DSA signature batches
• Reject all-zero-t1 ML-DSA-87 public keys
• Reject nil inputs and validate fork domain lengths
• Optimization: avoid redundant sync signature checks in replay and block proposals
• Wire the keymanager RPC to a beacon client so voluntary exits can sign
• Optimization: reject invalid gossip before costly attester signature checks
• Verify gossip signatures independently with bounded workers
• Bound signature diagnostics and avoid duplicate verification
• An empty execution payloads doesn’t necessarily mean empty withdrawal
• More tests added

qrl-genesis-generator

• Execution voting period updated to 4

web3.js

• Removed deprecated RPC APIs
• Replace Ethereum EC precompile gas with gqrl depositroot and mldsa87Verify costs
• Set Common initialBaseFee to 100 gwei so genesis fee math matches go-qrl
• Type FeeHistory.baseFeePerGas as an array because go-qrl returns one value per block

qrypto.js

• Added weak public-key and invalid secret-key validation for ML-DSA-87, plus bounded signing behaviour and corresponding documentation/tests

js-qrl-cryptography

• Updated @theqrl/mldsa87 to v2.2.0 to pick up the new validation behaviour

web3.js

• Updated QRL cryptography/wallet dependencies and raised dependency patch floors for multiple known CVEs and security advisories

go-qrllib

• Added ML-DSA-87 weak-key rejection and secret-key checks; moved verification toward validated PublicKey objects; expanded lifecycle tests/docs; updated Go security-check CI

go-qrl

• Updated to go-qrllib 0.9.2 then 0.10.0 and enforced validated ML-DSA-87 public keys in the verification precompile

rust-qrllib

• Added a validated ML-DSA PublicKey type and weak-key rule

actions-mldsa-sign

• v2 release: GitHub Action to generate ML-DSA-87 (FIPS 204) post-quantum signatures for files, and a signed manifest binding each artifact to the release it belongs to.

QRL v1.0

qrllib

• Hardened key-material and entropy handling; improved cross-platform native testing and Go symbol isolation; made XMSS signing allocation-failure safe; fixed XmssFast copy/move state; prepared the v1.3.0 release

qrllib-browserify

• Updated underlying qrllib from 1.2.7 through 1.3.0 and published the v1.2.0 release

qrl-cli

• Dependency refresh, principally updating qrllib to 1.2.7

webtools

• Updated qrllib/qrllib-browserify dependencies, released v1.1.1 and subsequently moved to qrllib-browserify 1.3.0 with further release preparation

offline-wallet-generator

• Updated through qrllib-browserify 1.2.0 and 1.3.0; produced the v2.0.2 release changes and subsequent release preparation