1 Signature scheme 0/10, weighted 30%
Band 0: Classical signatures only on mainnet, with nothing post-quantum protecting live funds. Short-lived devnets and one-off benchmarks sit here: they demonstrate research rather than something a user can hold keys on.
XDC accounts and XDPoS 2.0 block, vote and timeout signatures all use ECDSA on secp256k1: the node recovers each signer with secp256k1 public-key recovery. Nothing post-quantum protects XDC on mainnet.
source
2 Deployment stage 2/10, weighted 25%
Band 2: Tier 4: Debating.
Tier 4: Debating. On the research limb: a core XDPoSChain contributor implemented and benchmarked Falcon consensus signatures on a branch of the official repository, and a forum write-up reporting the same benchmarks sets out a three-layer migration. It is not Tier 3 because the dated roadmap comes from XDC Innovation Labs, which describes itself as one contributor within a broader ecosystem, and we found no XDC improvement proposal or foundation statement adopting it.
source
3 NIST alignment 4/10, weighted 15%
Band 3 to 5: NIST schemes are referenced as candidates without a committed selection, or the work is bespoke research.
The scheme tested against XDC's own consensus signatures is Falcon, selected by NIST for standardisation as FN-DSA in FIPS 206, which is still a draft. The lab roadmap also names ML-DSA, a final standard, for wallets, but that roadmap is not the chain's proposal.
source
Placement in the band A 4 rather than a 5: the scheme tested for XDC's consensus signatures awaits a final standard, and the ML-DSA named for wallets comes from a roadmap the chain has not adopted. It is not a 3 because a specific NIST-selected scheme was implemented against XDC's own code.
4 Migration path 4/10, weighted 15%
Band 3 to 5: Migration is acknowledged as a problem with no agreed mechanism, or the mechanism is contested.
Two routes have been described. The developer forum write-up proposes a registry mapping existing addresses to post-quantum keys and a hard fork adding post-quantum transaction types, keeping addresses. The lab roadmap proposes account abstraction for wallets and a 12-month dual-signing period for masternodes before ECDSA consensus signatures are retired. Neither is built, agreed or adopted, and the lab's own pages give different dates for the same phases.
source
Placement in the band The middle of the band rather than a 3 or a 5: both descriptions keep holders' addresses, which is the hard part, but neither has been adopted by anyone with authority over XDC, and the conflicting dates show no settled plan.
5 Exposure 2/10, weighted 10%
Band 0 to 2: Public keys are exposed for effectively all accounts, or a large, measured share of total supply sits in exposed addresses.
XDC uses Ethereum's address model: an address is the last 20 bytes of a Keccak-256 hash of the public key, and the key can be recovered from any signature the account makes. An account that has never sent a transaction keeps its key hidden; every account that has transacted has revealed it.
source
Placement in the band At the top of the band rather than a 0 or a 1: the hashed address does protect accounts that have never signed. It is not a 3 because almost every account holding value, including the masternodes, has signed and so revealed its key.
6 Verification 2/10, weighted 5%
Band 0 to 2: No post-quantum component exists, or the claims rest on marketing.
No post-quantum component protects XDC. The Falcon proof of concept is open source but sits on an unmerged branch with compiled binaries committed alongside the C source, runs on no persistent network and has had no outside review. The quantum-safe marketing on xdc.network is XDC Innovation Labs' and not the chain's, and the lab's FAQ says the work is not a claim that XDC is already quantum-proof.
source
Placement in the band The top of the band rather than a 0 or a 1: no post-quantum component protects funds, but the profile does not treat the lab as XDC's authority for the tier, so its quantum-safe marketing is not counted as XDC's own claim either, and the chain's position does not rest on marketing.