--- title: Is Provenance Blockchain quantum-safe? chain: Provenance Blockchain ticker: HASH hardy_score: 8.5 rank: 70 of 80 tier: "5: Exposed" url: "https://hardyindex.com/chains/provenance" updated: 2026-10-22 reviewed: 2026-11-13 methodology_version: 1.8 --- # Is Provenance Blockchain quantum-safe? **Hardy Score 8.5 / 100. Rank 70 of 80. Tier 5: Exposed. Last editorial review 22 October 2026; sources checked 13 November 2026.** No. Provenance Blockchain is a proof-of-stake chain built on the Cosmos SDK for financial assets. HASH accounts sign with ECDSA on secp256k1, and validators sign consensus votes with Ed25519, which the chain's own consensus parameters make the one accepted validator key type. A sufficiently large quantum computer breaks both. Provenance runs its own fork of the Cosmos SDK, v0.53.8-pio-2, in node release v1.31.0, and the fork's changes add features and fixes without touching key types. The Cosmos SDK added ML-DSA-65 keys for accounts and validators in v0.55, released on 28 July 2026, but that is a later release line than Provenance's fork, and nothing Provenance has published, in its documentation, its blog, its releases or its governance proposals, mentions quantum computing or a plan to adopt those keys. > This is a security-readiness assessment, not investment advice. ## Summary Provenance Blockchain runs its own fork of Cosmos SDK v0.53.8, with secp256k1 accounts and Ed25519 validators, and has published no post-quantum plan; the ML-DSA keys in Cosmos SDK v0.55 are not in its fork. ## Where we are making a judgement call Two judgement calls, both about the upstream framework. The tier and the NIST and verification scores treat the ML-DSA keys in Cosmos SDK v0.55 as framework work rather than work for Provenance, because Provenance maintains its own fork and nobody with authority over Provenance has referred to them. The Cosmos Hub profile credits the same code because Cosmos Labs, which wrote it, says it is bringing the Hub's maintenance in-house; no such tie exists here. A reader who credits the upstream release as Provenance's own would place it in Tier 4, with a deployment score of 2, and might score NIST alignment 5, migration 5 and verification 3 as the Cosmos Hub profile does, which would raise the Hardy Score from 8.5 to 23.5. The migration score of 2 rather than 1 credits that upstream mechanism and Provenance's routine software upgrades; at 1 the Hardy Score would be 7.0. Separately, our finding is that we could not locate a published post-quantum position, not that we have confirmed none exists. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 0/10 | 30% | 0.0 | | 2 | Deployment stage | 1/10 | 25% | 2.5 | | 3 | NIST alignment | 0/10 | 15% | 0.0 | | 4 | Migration path | 2/10 | 15% | 3.0 | | 5 | Exposure | 2/10 | 10% | 2.0 | | 6 | Verification | 2/10 | 5% | 1.0 | | | **Hardy Score** | | | **8.5** | ### 1. Signature scheme: 0/10 Anchor band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on. HASH accounts sign with ECDSA on secp256k1, the Cosmos SDK default, and a sample of recent transactions read from the chain's API on 22 October 2026 showed no signer key type other than secp256k1. Validators sign with Ed25519. Provenance's SDK fork, v0.53.8-pio-2, adds no other key type, so nothing post-quantum protects HASH on mainnet. Source: https://docs.cosmos.network/sdk/v0.53/learn/beginner/accounts ### 2. Deployment stage: 1/10 Anchor band 1: Tier 5: Exposed. Tier 5: Exposed. The signatures securing HASH are quantum-vulnerable, and we found no post-quantum plan, proposal or research programme from Provenance: none in its documentation, its blog, its node releases or the governance proposals the chain's API returns. The ML-DSA work in Cosmos SDK v0.55 belongs to the upstream framework, whose maintainers have no authority over Provenance's fork. Source: https://github.com/provenance-io/provenance/releases/tag/v1.31.0 ### 3. NIST alignment: 0/10 Anchor band 0 to 2: No post-quantum scheme named for the chain’s fund-protecting signatures, or a proprietary scheme with no public cryptanalysis. No post-quantum scheme has been named for Provenance's accounts or validators. ML-DSA-65, from the final FIPS 204, exists in Cosmos SDK v0.55, but Provenance pins its own fork of v0.53.8, and nobody with authority over Provenance has referred to it. Placement in the band: The floor of the band rather than a 1 or a 2: Provenance itself has named no scheme at any point. Crediting the upstream ML-DSA option would score a framework Provenance has not adopted rather than the chain. Source: https://github.com/provenance-io/provenance/blob/v1.31.0/go.mod ### 4. Migration path: 2/10 Anchor band 0 to 2: No agreed migration path, or the proposals on the table would strand or freeze holder funds. No migration plan has been published. A route exists upstream: under Cosmos SDK v0.55 a holder creates a new ML-DSA account and transfers funds to it, and a validator rotates its consensus key in place. None of it applies until Provenance carries its fork onto that release line, and its governance does ship software upgrades routinely, as v1.31.0 did, with a 48-hour voting period. Placement in the band: The top of the band rather than a 1: a working mechanism exists in the framework Provenance is built on, and its governance ships software upgrades on a regular cadence. It cannot reach 3, because Provenance has not acknowledged quantum migration as a problem anywhere we could find. Source: https://docs.cosmos.network/sdk/latest/keys/post-quantum-keys ### 5. Exposure: 2/10 Anchor band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses. A Cosmos SDK account address is a hash of the secp256k1 public key, so an account that has never signed keeps its key off the chain. The key is recorded with the account's opening transaction, and staking HASH needs a signed delegation, so actively held HASH sits behind a revealed key. Validator consensus keys are published by design: the chain's API lists them. No measurement of the exposed share has been published. Placement in the band: The top of the band rather than a 3: the address structure is the same as on other Cosmos SDK key-hash chains, where any send or delegation reveals the key. It is not a 0 or a 1 because never-used addresses do keep their keys hidden. Source: https://docs.cosmos.network/sdk/v0.53/learn/beginner/accounts ### 6. Verification: 2/10 Anchor band 0 to 2: No post-quantum component exists, or the claims rest on marketing. No post-quantum component protects Provenance, so there is nothing to verify. Its SDK fork, compared against upstream v0.53.8, changes modules, fees and queries, and adds no key type. Under v1.8 the openness of the classical code earns nothing here. Placement in the band: The top of the band rather than a 0 or a 1: there is no post-quantum component to verify, but nothing about the chain is marketed as quantum-safe, so its position does not rest on marketing. Source: https://github.com/cosmos/cosmos-sdk/compare/v0.53.8...provenance-io:cosmos-sdk:v0.53.8-pio-2 ## Nearest chains in the ranking The chains Provenance sits among, out of 80 rated. The last column is the gap in Hardy points from Provenance. | Rank | Chain | Tier | Hardy | vs HASH | |---:|---|---|---:|---:| | 66 | [Kite](https://hardyindex.com/chains/kite) | 5: Exposed | 8.5 | level | | 67 | [Mina Protocol](https://hardyindex.com/chains/mina) | 5: Exposed | 8.5 | level | | 68 | [MultiversX](https://hardyindex.com/chains/multiversx) | 5: Exposed | 8.5 | level | | 69 | [Polygon PoS](https://hardyindex.com/chains/polygon-pos) | 5: Exposed | 8.5 | level | | 70 | **Provenance Blockchain** | 5: Exposed | 8.5 | this chain | | 71 | [Theta Network](https://hardyindex.com/chains/theta) | 5: Exposed | 8.5 | level | | 72 | [THORChain](https://hardyindex.com/chains/thorchain) | 5: Exposed | 8.5 | level | | 73 | [VeChain](https://hardyindex.com/chains/vechain) | 5: Exposed | 8.5 | level | | 74 | [WEMIX](https://hardyindex.com/chains/wemix) | 5: Exposed | 8.5 | level | ## Signature scheme - **On mainnet today:** ECDSA on secp256k1 for accounts; Ed25519 for validator consensus keys - **Post-quantum scheme:** None selected or proposed. ML-DSA-65 is in Cosmos SDK v0.55, which Provenance's fork does not include. - **NIST standard:** None named - **Readiness tier:** Tier 5: Exposed. The signatures securing funds on mainnet today are quantum-vulnerable, and no public post-quantum plan, proposal or research programme addressing them could be found. ## Cryptography in use - **Account signatures:** [ECDSA on secp256k1](https://hardyindex.com/algorithms/ecdsa-secp256k1.md). Mainnet, default. Read from the chain's transaction API on 22 October 2026: every signer in the first 100 of the 142 mainnet transactions between heights 34,219,000 and 34,220,700 carries a secp256k1 public key, and none carries another key type. secp256k1 is the Cosmos SDK default account key. Source (read on-chain): https://api.provenance.io/cosmos/tx/v1beta1/txs?query=tx.height%3E%3D34219000%20AND%20tx.height%3C%3D34220700&pagination.limit=100 - **Validator consensus:** [Ed25519](https://hardyindex.com/algorithms/ed25519.md). Mainnet, mandatory. The consensus parameters accept ed25519 as the one validator key type. Source (read on-chain): https://api.provenance.io/cosmos/consensus/v1/params A role not listed here is not evidenced either way. See https://hardyindex.com/algorithms.md. ## Roadmap - **28 July 2026** (shipped): Cosmos SDK v0.55.0 is released upstream with ML-DSA-65 keys for accounts and validators. It is a framework release; Provenance's fork remains on the v0.53 line. Source: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.55.0 - **2 October 2026** (shipped): Provenance releases node v1.31.0 with the geranium upgrade, built on its Cosmos SDK fork v0.53.8-pio-2 and CometBFT v0.38.23. The release notes mention no change to signatures or keys. Source: https://github.com/provenance-io/provenance/releases/tag/v1.31.0 - **No plan published** (proposed): A post-quantum plan for Provenance accounts or validators, including any move of its SDK fork to a release with ML-DSA keys. None was found. Source: https://github.com/provenance-io/cosmos-sdk/tree/v0.53.8-pio-2 ## If holders never migrate **No stated policy.** Provenance has published nothing on accounts that never move to post-quantum keys. Under the upstream Cosmos SDK design an account keeps its key for life, so moving would mean a new account and a transfer. As of 22 October 2026. ## Exposure Provenance uses the Cosmos SDK account model. An address is a hash of the account's secp256k1 public key, so a never-used address has not published its key, but the key goes on-chain with the account's opening transaction and stays there. Staking HASH needs a signed delegation, so the HASH that is actively held and staked sits behind revealed keys. Validator consensus keys are Ed25519 keys published by design, and the chain's API listed 99 bonded validators on 22 October 2026. No measurement of the exposed share of supply has been published, so the score rests on the address model. ## Frequently asked questions ### Is Provenance Blockchain quantum-safe? No. Provenance Blockchain is a proof-of-stake chain built on the Cosmos SDK for financial assets. HASH accounts sign with ECDSA on secp256k1, and validators sign consensus votes with Ed25519, which the chain's own consensus parameters make the one accepted validator key type. A sufficiently large quantum computer breaks both. Provenance runs its own fork of the Cosmos SDK, v0.53.8-pio-2, in node release v1.31.0, and the fork's changes add features and fixes without touching key types. The Cosmos SDK added ML-DSA-65 keys for accounts and validators in v0.55, released on 28 July 2026, but that is a later release line than Provenance's fork, and nothing Provenance has published, in its documentation, its blog, its releases or its governance proposals, mentions quantum computing or a plan to adopt those keys. ### Is Provenance Blockchain quantum-safe? No. HASH accounts sign with ECDSA on secp256k1 and validators sign with Ed25519, both of which a large enough quantum computer would break. Provenance has published no plan to change either. ### Does the Cosmos SDK's post-quantum release protect HASH? No. ML-DSA-65 keys arrived in Cosmos SDK v0.55. Provenance runs its own fork of v0.53.8, which does not include them, so no HASH holder or Provenance validator can use an ML-DSA key until Provenance carries its fork onto that release and passes a software upgrade, and neither has been proposed. ### Does Provenance's fork of the Cosmos SDK change its cryptography? No. Compared with upstream Cosmos SDK v0.53.8, the fork adds Provenance-specific features such as message-based fees, a count authorisation and multi-input transfers, and carries upstream fixes. It adds no key type, so accounts and validators use the same schemes as any Cosmos SDK v0.53 chain. ### Are HASH public keys already exposed? For actively held HASH, yes. An address is a hash of the key and hides it until the account signs, but sending or delegating reveals it, and staking needs a signed delegation. Those keys could be recorded now and attacked later by a quantum computer. ## What this rating means if you hold Provenance Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) ## Sources 1. [Provenance v1.31.0 release](https://github.com/provenance-io/provenance/releases/tag/v1.31.0): Provenance Blockchain (GitHub) (primary, checked 22 October 2026) 2. [Provenance go.mod at v1.31.0](https://github.com/provenance-io/provenance/blob/v1.31.0/go.mod): Provenance Blockchain (GitHub) (primary, checked 22 October 2026) 3. [Provenance Cosmos SDK fork, v0.53.8-pio-2](https://github.com/provenance-io/cosmos-sdk/tree/v0.53.8-pio-2): Provenance Blockchain (GitHub) (primary, checked 22 October 2026) 4. [Comparison of Cosmos SDK v0.53.8 with v0.53.8-pio-2](https://github.com/cosmos/cosmos-sdk/compare/v0.53.8...provenance-io:cosmos-sdk:v0.53.8-pio-2): GitHub (primary, checked 22 October 2026) 5. [Provenance mainnet transactions, heights 34,219,000 to 34,220,700](https://api.provenance.io/cosmos/tx/v1beta1/txs?query=tx.height%3E%3D34219000%20AND%20tx.height%3C%3D34220700&pagination.limit=100): Provenance (chain API) (primary, checked 22 October 2026) 6. [Provenance consensus parameters](https://api.provenance.io/cosmos/consensus/v1/params): Provenance Blockchain node API (primary, checked 22 October 2026) 7. [Provenance latest validator set](https://api.provenance.io/cosmos/base/tendermint/v1beta1/validatorsets/latest): Provenance Blockchain node API (primary, checked 22 October 2026) 8. [Provenance node information](https://api.provenance.io/cosmos/base/tendermint/v1beta1/node_info): Provenance Blockchain node API (primary, checked 22 October 2026) 9. [Governance](https://docs.provenance.io/community/governance): Provenance Blockchain documentation (primary, checked 22 October 2026) 10. [Accounts (Cosmos SDK v0.53)](https://docs.cosmos.network/sdk/v0.53/learn/beginner/accounts): Cosmos SDK documentation (Cosmos Labs) (primary, checked 22 October 2026) 11. [Post-quantum keys](https://docs.cosmos.network/sdk/latest/keys/post-quantum-keys): Cosmos SDK documentation (Cosmos Labs) (primary, checked 22 October 2026) 12. [Cosmos SDK v0.55.0 release](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.55.0): Cosmos SDK (GitHub) (primary, checked 22 October 2026) 13. [Provenance Blockchain blog](https://provenance.io/blog): Provenance Blockchain (primary, checked 22 October 2026) ## How to cite this rating A rating is only true as of the day it was reviewed, so both forms carry the review date and the methodology version. If you are quoting the score, quote those too. The Hardy Index (2026). Provenance Blockchain: quantum readiness assessment. Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8. Last reviewed 22 October 2026; sources checked 13 November 2026. https://hardyindex.com/chains/provenance ```bibtex @misc{hardyindex_provenance_2026, author = {{The Hardy Index}}, title = {Provenance Blockchain: quantum readiness assessment}, year = {2026}, howpublished = {\url{https://hardyindex.com/chains/provenance}}, note = {Hardy Score 8.5 of 100, Tier 5: Exposed. Methodology v1.8}, urldate = {2026-11-13} } ``` --- Methodology: https://hardyindex.com/methodology (v1.8). Cite as: The Hardy Index, "Provenance Blockchain", https://hardyindex.com/chains/provenance, as of 13 November 2026.