How PQC Scan verifies

On Solana, every account address is an ed25519 public key. A large enough quantum computer running Shor's algorithm could forge ed25519 signatures, which would make it impossible to tell after the fact who really created a token.

Post-quantum provenance is a second, independent signature over a token's identity (mint, creator, name, symbol and image) made with a scheme that does not rely on elliptic curves. If it verifies, the holder of a specific post-quantum identity attested to this exact launch. Hash-based schemes like WOTS rely only on the security of SHA-256.

PQC Scan is read-only. It never asks you to connect a wallet, sign a message or share a seed phrase, and it reports exactly what it could and could not confirm.

We assume an adversary who can eventually forge ed25519 signatures. A verified provenance proof answers one question, who attested to this launch, and it keeps answering it after that break. It does not protect anything.

Solana validators do not check these post-quantum signatures. They are an off-chain record. Holding value under hash-based keys requires an on-chain verifier program, which is outside PQC Scan's scope.

For the WOTS + Merkle scheme, an identity is a Merkle tree of 256 one-time keys and the tree root is the public key. A signature reveals one value per hash chain plus the sibling nodes needed to climb from that leaf to the root. Every hash call is domain-separated by a public seed and a 32-byte address.

ADRS             = u32be(type) || u32be(a) || u32be(b) || u32be(c) || 0^16
F(seed, ADRS, x) = SHA-256(seed || ADRS || x)

digest = SHA-256("pqc.market/launch/v1\n" ||
  "creator=<wallet>\nimage=<url>\nleaf=<n>\nmint=<mint>\nname=<name>\nsymbol=<symbol>")

pk[i] = H^(15 - d[i])(σ[i])     chain step s uses ADRS(0, leaf, i, s)
ℓ     = H(pk[0] || … || pk[66])   ADRS(1, leaf)

node(h, j) = H(left || right)    ADRS(2, h, j)
valid     iff node(8, 0) = published root

• VerifiedThe check ran and the evidence satisfied it.
• FailedThe check ran and the evidence definitively contradicts the claim.
• Not FoundThe data the check needs does not exist (no account, no proof, no anchor).
• UnsupportedA proof exists but uses a version or scheme this verifier cannot evaluate.
• UnavailableA dependency (RPC, metadata host) failed or timed out. Retrying may help.
• Not CheckedSkipped because an earlier step it depends on did not complete.

Most Solana tokens have no PQC proof at all. That is normal and not a sign of wrongdoing.

pqc.market metadata attestation v1, implemented independently from its public specification. PQC Scan is not affiliated with pqc.market. The adapter reads the pqc object in the token's metadata JSON.

NIST schemes are certified by a WOTS leaf. Other formats can be added as adapters without changing the UI.

• Creator binding needs the mint's creation transaction. For very active tokens it may be beyond the history window, and the check reports Unavailable instead of guessing.
• The anchor search covers a bounded window of the creator wallet's recent history.
• Without an anchor, the link between the identity root and the wallet rests on the wallet's ed25519 signature of the creation transaction. That is sound today but not after an elliptic-curve break.
• The public mainnet RPC is rate limited. Configure a dedicated endpoint for reliable results.

All configuration is server-side. Secrets are never sent to the browser.

You do not need to trust PQC Scan. The whole WOTS check fits in a few lines over any SHA-256 implementation. Read the pqc object from the token's metadata and run:

import { sha256 } from '@noble/hashes/sha2.js'
import { concatBytes, hexToBytes, bytesToHex } from '@noble/hashes/utils.js'

const adrs = (t, a, b = 0, c = 0) => {
  const o = new Uint8Array(32), v = new DataView(o.buffer)
  v.setUint32(0, t); v.setUint32(4, a); v.setUint32(8, b); v.setUint32(12, c)
  return o
}
const H = (seed, ad, ...x) => sha256(concatBytes(seed, ad, ...x))

function verify({ messageHash, signature: { leaf, wots, auth }, root, pubSeed }) {
  const seed = hexToBytes(pubSeed), msg = hexToBytes(messageHash), sig = hexToBytes(wots)
  const d = [...msg].flatMap((b) => [b >> 4, b & 15])
  const cs = d.reduce((s, v) => s + 15 - v, 0)
  d.push((cs >> 8) & 15, (cs >> 4) & 15, cs & 15)

  const pk = d.map((di, i) => {
    let x = sig.slice(i * 32, i * 32 + 32)
    for (let s = di; s < 15; s++) x = H(seed, adrs(0, leaf, i, s), x)
    return x
  })
  let node = H(seed, adrs(1, leaf), ...pk), j = leaf
  auth.forEach((a, h) => {
    const sib = hexToBytes(a)
    node = j % 2 === 0 ? H(seed, adrs(2, h + 1, j >> 1), node, sib)
                       : H(seed, adrs(2, h + 1, j >> 1), sib, node)
    j >>= 1
  })
  return bytesToHex(node) === root.toLowerCase()
}

Or call the scanner directly. GET /api/scan?mint=<address> returns the full result as JSON, including every piece of evidence shown in the UI.