Audit Comp | Quantus
Quantus is a Layer 1 blockchain designed to keep digital assets secure against the emerging threat of quantum computing. Built on Polkadot's Substrate framework and secured by proof-of-work, it replaces elliptic-curve cryptography with lattice-based, post-quantum signatures (an ML-DSA / CRYSTALS-Dilithium scheme), adds a ZK-friendly Poseidon2 hash and a Plonky2-based proof-aggregation layer for scalability, and includes a zk-wormhole system modeled on EIP-7503 for private transfers. It is delivered as a Substrate node, runtime, and pallets, dedicated Rust cryptography libraries for the signatures, hashing, and ZK circuits, and a mobile wallet app. Together these aim to offer a full, quantum-resistant environment for holding and transacting digital wealth.
Evaluating
Triaged by Immunefi
Runnable PoC Required
Vault program
This Audit Competition Is Under Evaluation
Competition timeline
This timeline may change depending on the competition progress and Immunefi needs
| Milestone | Date |
|---|---|
| Announcement | Aug 10, 2026 |
| Launch (competition goes live) | Aug 12, 2026 |
| Competition ends | Aug 25, 2026 |
| Project deadline to resolve all reports | Aug 31, 2026 |
| Results frozen and calculated | Aug 31, 2026 |
| Final 48-hour dispute deadline | Sep 11, 2026 |
| Payment complete | Sep 30, 2026 |
| Results published | Sep 30, 2026 |
Immunefi vault program
Rewards
Rewards by Threat Level
Rewards are distributed among SRs according to Immunefi’s Standardized Competition Reward Terms and includes All Star Pool and Podium Pool reserved for All Star Program participants].
Rewards are denominated in USD and distributed in USDC on Ethereum.
- If any valid bug is found — even a single Low-severity bug — the full reward pool of $20,000 USD is unlocked and must be fully distributed among security researchers.
- If no security vulnerability is found (Insights do not count as bugs), the reward pool is $3,000 USD.
Public Disclosure of Known Issues
Bug reports for publicly disclosed bugs are not eligible for a reward.
Private Known Issues Reward Policy
Private known issues — known issues that were not publicly disclosed — are valid for a reward at their full severity and unlock the corresponding reward pool without any downgrade. Public known issues are invalid.
Program Overview
Quantus is a Layer 1 (L1) blockchain built on Polkadot's Substrate framework. Because it is built on Substrate, much of the blockchain's code is inherited from that framework; the areas where Quantus differs are the focus of this competition:
-
Lattice-based signatures, instead of elliptic-curve cryptography.
-
Proof-of-work consensus.
-
A zk-wormhole system modeled on EIP-7503.
Technical Project Information
System overview
Quantus is a Layer 1 blockchain deployed to its own network, built on Polkadot's Substrate. It is not an upgrade of an existing system — most of the blockchain's code is inherited from Substrate. What distinguishes it from a standard Substrate chain is lattice-based signatures rather than elliptic-curve cryptography, proof-of-work consensus, and a zk-wormhole system modeled on EIP-7503. No token standards (ERC-20 / ERC-721 / ERC-777 / ERC-1155) are supported.
Priority areas of concern
The project is most concerned about: soundness bugs in the ZK system; failure of the lattice cryptography; accidental double minting; and signature-verification bugs.
Emergency actions and severity downgrades
The governance system handles runtime upgrades, which can edit storage, which can undo most problems.
External dependencies
Approximately 1,200 package dependencies in the chain.
Notes for researchers
The zk-wormhole is the most novel component and the likeliest to be misunderstood — it follows the zk-wormhole concept from EIP-7503. This involves two kinds of addresses “wormhole” and “dilithium” addresses which are intended to be indistinguishable.
Standardized Rules
This program follows Immunefi's standard competition rules. For the full default rules on validity, duplicates, known issues, severity, disputes, KYC, payments, and publication, read How Audit Competitions Work: Rules and Policies. Where this program page defines a specific rule, the program page prevails.
Insight Reporting
Insight reports may be submitted to this program. Runnable code is not required, but the PoC section must describe the conditions under which the insight is valuable.
Only the best report of a given Insight is rewarded. Duplicates of Insights are not rewarded.
Insights are rewarded according to Immunefi's Standardized Competition Reward Terms (link: https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873) and are not eligible for mediation or appeal.
Dispute Resolution
Disputes may only address report validity, duplicate determinations, and severity.
If a researcher disagrees with a closure decision while the competition is live, they may request mediation. A mediation fee, set by Immunefi, is required to initiate the review.
After the evaluation phase, a dispute period opens for appealing decisions. Immunefi announces a final 48-hour deadline for the last disputes. Once the window closes, results are final.
Immunefi has final say on validity, duplicates, and severity, based on the terms of this program. Insights are not eligible for mediation or appeal.
Responsible Publication Policy
Immunefi will publish bug reports, earnings, and a leaderboard for this Audit Competition
Security Researchers may publish their bug reports as well, but only after Immunefi has published the valid bug reports as part of the competition results.
Eligibility Criteria
Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
- On OFACs SDN list
- Official contributor, both past or present
- Employees and/or individuals closely associated with the project
- Security auditors that directly or indirectly participated in an audit review of the code in scope (Such auditors may still participate in this program only if they receive project permission)
- From a restricted country or territory per Immunefi's Terms of Use (link: https://immunefi.com/terms-of-use/)
- Under 18 years of age. Participants under 18 cannot pass KYC and will not receive rewards.
Submission Fees
A submission fee, set and managed by Immunefi, applies to each report and is shown at submission time. If a researcher disagrees with a closure decision, initiating a mediation also requires a fee set by Immunefi.
Audits
Completed audit reports for this project can be found at the links below.
Any unpatched or unresolved vulnerabilities disclosed in these reports are not eligible for rewards.
Known Issues
Reports covering previously identified bugs listed below are not eligible for rewards under this program.
This includes:
- Known issues that the project is aware of, even if no fix or code changes have been implemented.
- Issues the project has consciously decided not to remediate.
- Cases where operational mitigations or procedures have been implemented to reduce potential risk.
KYC not required
No KYC information is required for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.