Blockchain Quantum Readiness Index / Polkadot
L1 · Substrate
Polkadot
Accounts and validators are entirely elliptic-curve keys. The official bridge verifies with elliptic-curve validator signatures, and a hybrid post-quantum accounts proposal exists only as a Fellowship draft with no testnet or code. Upgrades go through on-chain referenda with no admin key.
Last reviewed 2026-10-19
Is Polkadot quantum safe?
Not yet. Polkadot is at Stage 0 (Not started) in LimeChain's Blockchain Quantum Readiness Index, with a progress score of 8/100. Post-quantum accounts have only been discussed, so users have no way to keep funds out of a quantum attacker's reach. Still exposed or unproven: bridges & messaging.
What Polkadot needs for Stage 1: Committed
- Stage 1 needs an official roadmap or accepted spec for PQ user accounts (U is: discussed)
Caps and adjustments
- cap 40: users cannot hold and spend funds under a production PQ mechanism on mainnet
- cap 60: consensus PQ not even on testnet
Rosette slices
| Slice | State | Points | Weight | Reason & evidence |
|---|---|---|---|---|
| U User keys | Discussed At rest: Hidden until first spend Default sr25519/ed25519 accounts are exposed: the SS58 address encodes the raw public key (AccountId32 = pubkey). But the relay chain and Asset Hub accept MultiSignature, whose ECDSA variant derives the AccountId32 as blake2_256 of the compressed secp256k1 key (and the newer Eth variant from its keccak address), so an ECDSA account keeps the key hidden until the first signed extrinsic. ECDSA accounts are a non-default wallet option; a plain account cannot rotate keys in place. |
1/10 | 25 | Hybrid PQ accounts exist only as Fellowship RFC PR #165, a draft with no testnet or SDK code. Sources 1 |
| C Consensus | Discussed | 1/10 | 20 | Validators sign with sr25519/ed25519/ECDSA (BABE: sr25519, GRANDPA: ed25519, BEEFY: ecdsa). A Web3 Foundation research post proposes Dilithium (ML-DSA) for validator messages, without dates or code. |
| P Proof system | Not applicable | — | — | L1 with no validity or fraud proof system. no evidence |
| B Bridges & messaging | Exposed | 0/10 | 15 | Snowbridge is the system bridge (exclusively governed by OpenGov) and verifies messages with an on-chain BEEFY light client over relay-chain ECDSA validator signatures; parachain XCM settles under the same ECC relay-chain consensus. |
| A Admin & upgrade keys | Not applicable | — | — | All protocol changes (including runtime upgrades) pass stake-weighted OpenGov referenda enacted autonomously on-chain; no privileged admin key exists. The Fellowship whitelist is not a key: whitelisted calls are still enacted via the Whitelist Caller referendum track. |
| M Migration & recovery | Discussed | 1/10 | 15 | The draft hybrid-accounts RFC and the Web3 Foundation research post (a FRI-based proof of knowledge of the seed behind an ECC key) are the only migration paths discussed; no ratified plan exists. |
Stage gates
| Requirement | Status | Details & evidence |
|---|---|---|
| Current audit of the deployed PQ signing code (Stage 5) | Not met | not claimed |
| Admin timelock of at least 30 days with a PQ override (Stage 6, alternative to PQ admin keys) | Not met | not claimed |
| Ratified migration plan with an activation date (Stage 6) | Not met | not claimed |
| New accounts PQ or hybrid by default (Stage 6) | Not met | not claimed |
| ECC sunset enforced (Stage 7) | Not met | not claimed |
PQ adoption published, not scored
There are no PQ accounts on mainnet yet. Having PQ accounts does not mean people move to them. This tracks the share of value and accounts that actually moved, over time.
Measured exposure
No on-chain probe run yet. Bitcoin, Solana, Cosmos and Substrate probes are planned.
Evidence and sources (12)
Every non-zero rating above cites at least one of these public sources.
- github.com/polkadot-fellows/RFCs/pull/165
- docs.polkadot.com/reference/parachains/accounts/
- raw.githubusercontent.com/paritytech/polkadot-sdk/master/subs…
- raw.githubusercontent.com/paritytech/polkadot-sdk/master/polk…
- raw.githubusercontent.com/paritytech/polkadot-sdk/master/cumu…
- wiki.polkadot.network/learn/learn-cryptography/
- forum.polkadot.network/t/post-quantum-cryptography-roadmap-fo…
- docs.snowbridge.network/architecture/governance.md
- docs.snowbridge.network/architecture/verification.md
- docs.snowbridge.network/architecture/verification/polkadot.md
- wiki.polkadot.network/learn/learn-polkadot-opengov/
- wiki.polkadot.network/learn/learn-runtime-upgrades/
Source: chains/polkadot.json. Reproduce: python3 score.py chains/polkadot.json
Building on Polkadot?
LimeChain helps teams plan their post-quantum migration: what is exposed, what to change first, and the engineering to get there.
Talk to usOpen, repeatable scoring. Non-zero ratings need public evidence; missing evidence means unknown. Methodology v0.4 · mechanism registry 2026-10-13.