Hardy Index Quantum readiness, rated and tracked

Chain profile

Provenance Blockchain

HASH Exposed

Provenance Blockchain runs its own fork of Cosmos SDK v0.53.8, with secp256k1 accounts and Ed25519 validators, and has published no post-quantum plan; the ML-DSA keys in Cosmos SDK v0.55 are not in its fork.

Is Provenance Blockchain quantum-safe?

No. Provenance Blockchain is a proof-of-stake chain built on the Cosmos SDK for financial assets. HASH accounts sign with ECDSA on secp256k1, and validators sign consensus votes with Ed25519, which the chain's own consensus parameters make the one accepted validator key type. A sufficiently large quantum computer breaks both. Provenance runs its own fork of the Cosmos SDK, v0.53.8-pio-2, in node release v1.31.0, and the fork's changes add features and fixes without touching key types. The Cosmos SDK added ML-DSA-65 keys for accounts and validators in v0.55, released on 28 July 2026, but that is a later release line than Provenance's fork, and nothing Provenance has published, in its documentation, its blog, its releases or its governance proposals, mentions quantum computing or a plan to adopt those keys.

Where we are making a judgement call Two judgement calls, both about the upstream framework. The tier and the NIST and verification scores treat the ML-DSA keys in Cosmos SDK v0.55 as framework work rather than work for Provenance, because Provenance maintains its own fork and nobody with authority over Provenance has referred to them. The Cosmos Hub profile credits the same code because Cosmos Labs, which wrote it, says it is bringing the Hub's maintenance in-house; no such tie exists here. A reader who credits the upstream release as Provenance's own would place it in Tier 4, with a deployment score of 2, and might score NIST alignment 5, migration 5 and verification 3 as the Cosmos Hub profile does, which would raise the Hardy Score from 8.5 to 23.5. The migration score of 2 rather than 1 credits that upstream mechanism and Provenance's routine software upgrades; at 1 the Hardy Score would be 7.0. Separately, our finding is that we could not locate a published post-quantum position, not that we have confirmed none exists.

At a glance

On mainnet today

ECDSA on secp256k1 for accounts; Ed25519 for validator consensus keys

Post-quantum scheme

None selected or proposed. ML-DSA-65 is in Cosmos SDK v0.55, which Provenance's fork does not include.

NIST standard

None named

Readiness tier

Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found.

Cryptography in use

  • Account signatures ECDSA on secp256k1 Mainnet, default Read from the chain's transaction API on 22 October 2026: every signer in the first 100 of the 142 mainnet transactions between heights 34,219,000 and 34,220,700 carries a secp256k1 public key, and none carries another key type. secp256k1 is the Cosmos SDK default account key. Read on-chain
  • Validator consensus Ed25519 Mainnet, mandatory The consensus parameters accept ed25519 as the one validator key type. Read on-chain

A role not listed is not evidenced either way. Every scheme, and which other chains share it, is in the cryptography registry.

Score breakdown

Each dimension scored 0 to 10. The weight beside it is its share of the total score.
Signature scheme 0 30% Deployment stage 1 25% NIST alignment 0 15% Migration path 2 15% Exposure 2 10% Verification 2 5%
Show the weighted arithmetic and the sourced note for each dimension
No. Dimension Score Weight Contribution
1 Signature scheme 0 30% 0.0
2 Deployment stage 1 25% 2.5
3 NIST alignment 0 15% 0.0
4 Migration path 2 15% 3.0
5 Exposure 2 10% 2.0
6 Verification 2 5% 1.0
Hardy Score 8.5

1 Signature scheme 0/10, weighted 30%

Band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on.

HASH accounts sign with ECDSA on secp256k1, the Cosmos SDK default, and a sample of recent transactions read from the chain's API on 22 October 2026 showed no signer key type other than secp256k1. Validators sign with Ed25519. Provenance's SDK fork, v0.53.8-pio-2, adds no other key type, so nothing post-quantum protects HASH on mainnet. source

2 Deployment stage 1/10, weighted 25%

Band 1: Tier 5: Exposed.

Tier 5: Exposed. The signatures securing HASH are quantum-vulnerable, and we found no post-quantum plan, proposal or research programme from Provenance: none in its documentation, its blog, its node releases or the governance proposals the chain's API returns. The ML-DSA work in Cosmos SDK v0.55 belongs to the upstream framework, whose maintainers have no authority over Provenance's fork. source

3 NIST alignment 0/10, weighted 15%

Band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis.

No post-quantum scheme has been named for Provenance's accounts or validators. ML-DSA-65, from the final FIPS 204, exists in Cosmos SDK v0.55, but Provenance pins its own fork of v0.53.8, and nobody with authority over Provenance has referred to it. source

Placement in the band The floor of the band rather than a 1 or a 2: Provenance itself has named no scheme at any point. Crediting the upstream ML-DSA option would score a framework Provenance has not adopted rather than the chain.

4 Migration path 2/10, weighted 15%

Band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds.

No migration plan has been published. A route exists upstream: under Cosmos SDK v0.55 a holder creates a new ML-DSA account and transfers funds to it, and a validator rotates its consensus key in place. None of it applies until Provenance carries its fork onto that release line, and its governance does ship software upgrades routinely, as v1.31.0 did, with a 48-hour voting period. source

Placement in the band The top of the band rather than a 1: a working mechanism exists in the framework Provenance is built on, and its governance ships software upgrades on a regular cadence. It cannot reach 3, because Provenance has not acknowledged quantum migration as a problem anywhere we could find.

5 Exposure 2/10, weighted 10%

Band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses.

A Cosmos SDK account address is a hash of the secp256k1 public key, so an account that has never signed keeps its key off the chain. The key is recorded with the account's opening transaction, and staking HASH needs a signed delegation, so actively held HASH sits behind a revealed key. Validator consensus keys are published by design: the chain's API lists them. No measurement of the exposed share has been published. source

Placement in the band The top of the band rather than a 3: the address structure is the same as on other Cosmos SDK key-hash chains, where any send or delegation reveals the key. It is not a 0 or a 1 because never-used addresses do keep their keys hidden.

6 Verification 2/10, weighted 5%

Band 0 to 2: No post-quantum component exists, or the claims rest on marketing.

No post-quantum component protects Provenance, so there is nothing to verify. Its SDK fork, compared against upstream v0.53.8, changes modules, fees and queries, and adds no key type. Under v1.8 the openness of the classical code earns nothing here. source

Placement in the band The top of the band rather than a 0 or a 1: there is no post-quantum component to verify, but nothing about the chain is marketed as quantum-safe, so its position does not rest on marketing.

The deployment dimension is not a separate judgement. It is Tier 5 expressed as a number. See the tier mapping.

How it compares

All 80 rated chains on the 0 to 100 scale. Provenance Blockchain is marked. Select any point to open that profile.
Provenance 8.5

Nearest chains in the ranking

The 9 chains Provenance sits among, out of 80 rated. The last column is the gap in Hardy points from Provenance.

Rank Chain Tier Hardy vs HASH
66 Kite 5: Exposed 8.5 level
67 Mina Protocol 5: Exposed 8.5 level
68 MultiversX 5: Exposed 8.5 level
69 Polygon PoS 5: Exposed 8.5 level
70 Provenance Blockchain this chain 5: Exposed 8.5
71 Theta Network 5: Exposed 8.5 level
72 THORChain 5: Exposed 8.5 level
73 VeChain 5: Exposed 8.5 level
74 WEMIX 5: Exposed 8.5 level

Roadmap

  1. 28 July 2026 shipped

    Cosmos SDK v0.55.0 is released upstream with ML-DSA-65 keys for accounts and validators. It is a framework release; Provenance's fork remains on the v0.53 line. source

  2. 2 October 2026 shipped

    Provenance releases node v1.31.0 with the geranium upgrade, built on its Cosmos SDK fork v0.53.8-pio-2 and CometBFT v0.38.23. The release notes mention no change to signatures or keys. source

  3. No plan published proposed

    A post-quantum plan for Provenance accounts or validators, including any move of its SDK fork to a release with ML-DSA keys. None was found. source

If holders never migrate

No stated policy

Provenance has published nothing on accounts that never move to post-quantum keys. Under the upstream Cosmos SDK design an account keeps its key for life, so moving would mean a new account and a transfer.

As of 22 October 2026. Published beside the score, not in it. Every chain's stance is compared on the commitments page.

Exposure

Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.

Provenance uses the Cosmos SDK account model. An address is a hash of the account's secp256k1 public key, so a never-used address has not published its key, but the key goes on-chain with the account's opening transaction and stays there. Staking HASH needs a signed delegation, so the HASH that is actively held and staked sits behind revealed keys. Validator consensus keys are Ed25519 keys published by design, and the chain's API listed 99 bonded validators on 22 October 2026. No measurement of the exposed share of supply has been published, so the score rests on the address model.

What this rating means for you

If you hold Provenance

Provenance runs quantum-vulnerable signatures with no published post-quantum plan that we could find. Nothing here is urgent today, and there is also nothing scheduled to change it.

Editorial guidance from the Hardy Index.

Embed this rating

Paste this anywhere to show Provenance Blockchain's current rating. It renders live from the index, so it updates when the rating does, and the review date is written into the image. There is nothing to sign up for and nothing to pay. 

<a href="https://hardyindex.com/chains/provenance"><img src="https://hardyindex.com/badge/provenance.svg" width="260" height="76" alt="Quantum readiness rated by the Hardy Index"></a>

The image is /badge/provenance.svg. It is a plain SVG with no script and no tracking, it sets no cookie, and it records nothing about whoever loads it.

Questions

Is Provenance Blockchain quantum-safe?

No. HASH accounts sign with ECDSA on secp256k1 and validators sign with Ed25519, both of which a large enough quantum computer would break. Provenance has published no plan to change either.

Does the Cosmos SDK's post-quantum release protect HASH?

No. ML-DSA-65 keys arrived in Cosmos SDK v0.55. Provenance runs its own fork of v0.53.8, which does not include them, so no HASH holder or Provenance validator can use an ML-DSA key until Provenance carries its fork onto that release and passes a software upgrade, and neither has been proposed.

Does Provenance's fork of the Cosmos SDK change its cryptography?

No. Compared with upstream Cosmos SDK v0.53.8, the fork adds Provenance-specific features such as message-based fees, a count authorisation and multi-input transfers, and carries upstream fixes. It adds no key type, so accounts and validators use the same schemes as any Cosmos SDK v0.53 chain.

Are HASH public keys already exposed?

For actively held HASH, yes. An address is a hash of the key and hides it until the account signs, but sending or delegating reveals it, and staking needs a signed delegation. Those keys could be recorded now and attacked later by a quantum computer.

Sources

  1. Provenance v1.31.0 release Provenance Blockchain (GitHub) · primary · checked 22 October 2026
  2. Provenance go.mod at v1.31.0 Provenance Blockchain (GitHub) · primary · checked 22 October 2026
  3. Provenance Cosmos SDK fork, v0.53.8-pio-2 Provenance Blockchain (GitHub) · primary · checked 22 October 2026
  4. Comparison of Cosmos SDK v0.53.8 with v0.53.8-pio-2 GitHub · primary · checked 22 October 2026
  5. Provenance mainnet transactions, heights 34,219,000 to 34,220,700 Provenance (chain API) · primary · checked 22 October 2026
  6. Provenance consensus parameters Provenance Blockchain node API · primary · checked 22 October 2026
  7. Provenance latest validator set Provenance Blockchain node API · primary · checked 22 October 2026
  8. Provenance node information Provenance Blockchain node API · primary · checked 22 October 2026
  9. Governance Provenance Blockchain documentation · primary · checked 22 October 2026
  10. Accounts (Cosmos SDK v0.53) Cosmos SDK documentation (Cosmos Labs) · primary · checked 22 October 2026
  11. Post-quantum keys Cosmos SDK documentation (Cosmos Labs) · primary · checked 22 October 2026
  12. Cosmos SDK v0.55.0 release Cosmos SDK (GitHub) · primary · checked 22 October 2026
  13. Provenance Blockchain blog Provenance Blockchain · primary · checked 22 October 2026
Cite this rating

A rating is only true as of the day an editor last reviewed it, so both forms below carry that date and the methodology version, with the date its cited sources were last checked. If you are quoting the score, quote those too.

Plain text

The Hardy Index (2026). Provenance Blockchain: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/provenance

BibTeX 
@misc{hardyindex_provenance_2026,
  author       = {{The Hardy Index}},
  title        = {Provenance Blockchain: quantum readiness assessment},
  year         = {2026},
  howpublished = {\url{https://hardyindex.com/chains/provenance}},
  note         = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8},
  urldate      = {2026-11-13}
}

The whole dataset is reusable under the terms on the about page. A machine-readable version of this page is at /chains/provenance.md.

This is a security-readiness assessment, not investment advice.