pqc.market is a Solana-based protocol for launching tokens on pump.fun with post-quantum cryptographic attestations. Its official website (https://pqc.market/) describes a system where every token launch is signed using hash-based, one-time Winternitz One-Time Signatures (WOTS) arranged in an XMSS-style Merkle tree—deriving identity from a user’s Solana wallet without introducing new seed phrases. The native token contract resides on Solana at address 7K52aYQW9rWGjwZmQ7o2d1P6E7bji6hSMsqaLy5EcxLh, and is visible on explorers including Solscan (https://solscan.io/token/7K52aYQW9rWGjwZmQ7o2d1P6E7bji6hSMsqaLy5EcxLh) and Intel ARKM (https://intel.arkm.com/explorer/token/pqc-market). Technical documentation (https://pqc.market/docs) details the full stack: deterministic key derivation via HKDF from ed25519 signatures, SHA-256–based primitives, on-chain anchoring via SPL Memo instructions, and optional passphrase-hardening. The protocol supports multiple NIST-standardized schemes—including ML-DSA, SPHINCS+, and Falcon—certified once by the root WOTS key. Critical open questions include whether the quantum vault program (DNsPfPecrbnS7jFqMpEDG3VoWAdkuaU2VxsmaPENcg9F) has undergone independent audit, how leaf reuse is enforced across client and server layers, and whether the claimed 256-launch capacity per identity is enforced immutably on-chain or relies on centralized database integrity.
pqc.market implements a rigorously specified, browser-local post-quantum identity layer atop Solana, using WOTS+Merkle trees with SHA-256 and domain separation (pqc.market/docs). Its core claim—that coin provenance survives ECDSA break—is technically sound and self-contained: every launch is signed by a one-time key, anchored on-chain via SPL Memo (pqc.market/docs), and verifiable offline using only SHA-256 (pqc.market/docs). The quantum vault program (DNsPfPecrbnS7jFqMpEDG3VoWAdkuaU2VxsmaPENcg9F) is named and described as enforcing WOTS-only spend control—no ed25519 path exists (pqc.market/docs). Privilege analysis confirms no mint, pause, or upgrade functions are exposed in the documented protocol; all signing occurs client-side, and the server holds no secrets (pqc.market/docs). However, no audit report, formal verification, or third-party security review is referenced or linked (pqc.market, pqc.market/docs, CoinGecko). The token contract address is supplied (CoinGecko, pqc.market), but its bytecode, deployment transaction, or ownership controls are not verified or described. Market data shows circulating supply ~963M (CoinGecko), yet no evidence confirms token utility, revenue model, or treasury controls. Social presence is minimal (twitter.com/pqcmarket), and documentation lacks API specs or operational SLAs. While the cryptographic design is transparent and internally consistent, absence of independent validation of implementation correctness or on-chain privilege enforcement caps assurance.
Overall score: 7/10 Confidence: Medium