opeq: Solana wallets quantum computers can't break

CPU / how it works

Ladders, a tree, a check

The signature scheme is WOTS+ (Winternitz one-time signatures) arranged in a Merkle tree, the same family as NIST's SLH-DSA standard.

Eighteen ladders

Picture 18 ladders with 255 rungs each. At the bottom of every ladder sits a secret number. Climbing one rung means hashing the number once. Climbing is easy, coming down is impossible. The tops of all ladders together form the public key.

To sign, the message is hashed into 16 numbers from 0 to 255, plus 2 checksum numbers. For each ladder you reveal the rung the number points to. The verifier climbs the rest of the way and checks that every ladder reaches its top.

Why nobody can forge it

Someone who sees a signature can climb further up any ladder, so they could raise message numbers. The two checksum ladders stop that: if any message number goes up, the checksum must go down, and going down a ladder is impossible. The only way through is to find a different message with exactly the same 128-bit hash.

One tree, 1024 keys

A one-time key must never sign twice. So opeq makes 1024 of them and hashes their public keys pair by pair into a Merkle tree. The chain stores only the 16-byte root. Each signature carries its key's 160-byte path to the root.

On chain

Your client signs. It reserves the next key and writes the counter to storage before signing, so a crash can never reuse a key. It hashes the exact instructions to run, then grinds a salt so verification is cheap.
A normal transaction carries it. Phantom (or any Ed25519 key) pays the fee. That key only pays: it has no power over the opeq wallet.
The program checks everything. Expiry slot, unused key, the hash of every inner instruction, all 18 ladders, the Merkle path, the root on chain.
Then it acts. It advances the counter and calls the target programs, signing as your wallet address with invoke_signed.

PCIe / compared

What exists today

The only other quantum-resistant option on Solana is a cold-storage vault. opeq is a wallet you can use.

	Ed25519 wallet	Winternitz vault	opeq
Safe against quantum computers	No	Yes	Yes
Address stays the same	Yes	New address each time	Yes
Holds tokens	Yes	SOL only	Yes
Swaps, DeFi, any program	Yes	No	Yes
Recovery words	Yes	-	Yes
Needs a protocol change	No	No	No
Signature size	64 B	-	448 B
Status	Mainnet	Experimental	Pre-audit

Solana core developers have proposed a Falcon signature syscall (SIMD-0416). If it ships, opeq can add Falcon as a second signature type. It does not need to wait for it.

TPM / security

What is protected

A clear threat model, the limits we know about, and what two internal reviews found.

Protected: Funds and tokens in your opeq wallet. Every action needs a hash-based signature over the exact instructions. The program's upgrade key is also an opeq wallet.
Not protected by opeq: The Ed25519 key that pays fees (keep little SOL in it). Solana's validators and consensus, which use classical cryptography and need their own migration.

Security level

Classical security per one-time key	128 bits
Quantum security (Grover), NIST category 1, like SLH-DSA-128	64 bits
Multi-target speedup (every hash call has a unique address tweak)	none
Signature expiry, enforced on chain	at most 300 slots
The one rule	Never sign twice with one key. The client enforces it, the chain refuses a reused key.

Internal reviews

Two independent adversarial reviews looked at the program, the protocol, the cryptography and the client, and tried to prove every finding with working attack code. Everything they found is fixed and covered by tests.

Severity	Finding	Fix
critical	Two client runs at the same time could sign with the same key	File and tab locks, counter saved before signing
high	The wallet locked forever once all 1024 keys were used	Last 16 keys reserved for rekey only
high	A tampered wallet file could roll back the counter	Whole-record authentication with the password
high	A retried rekey could orphan the new tree	Trees derived from the master seed, rekey state recovered from chain
high	Two paths to one wallet file could bypass the lock	Lock on the real path, not its spelling
medium	Rekey could return to the current tree	Rejected on chain (error 22)
medium	Message hash had no secret randomizer	16 random bytes hashed first, as in SLH-DSA
medium	An interrupted send could run twice on retry	In-flight record kept until the chain settles it
low	A failed transaction could be replayed until it expired	Failed keys are burned

Not externally audited. Internal reviews are not a substitute for a professional audit. Do not move real funds to opeq until an external audit is published.

RAM / specification

The details

Everything needed to write an independent client or verifier.

Parameters

one-time signature: WOTS+, n = 16 bytes, w = 256, 16 message + 2 checksum chains
signature size: 288 B (18 x 16)
merkle tree: height 10, 1024 leaves, auth path 160 Bleaves 0..1007 sign actions, 1008..1023 only rekeys
tweakable hash: F(x) = SHA256(pub_seed16 || ADRS8 || x)[0..16]
ADRS (8 bytes): type u8 | a u8 | b u8 | 0 | index u32le
hash types: 0 chain (a = chain, b = position, index = leaf)1 leaf (index = leaf)2 node (a = height, index = node)3 secret (client only)
checksum: sum(255 - d) over 16 digits, as 2 base-256 digits (max 4080)
tree seeds: sk = SHA256("opeq/tree/sk/v1" || master || epoch u32le)pub = SHA256("opeq/tree/pub/v1" || master || epoch u32le)[0..16]
master seed: 32 bytes, shown as 24 BIP39 English words
account id: SHA256("opeq/id/v1" || pub_seed of tree 0 || root of tree 0)
addresses (PDAs): state = ["s", account id], wallet = ["w", account id]
expiry: named by the signer, at most 300 slots ahead, checked on chain

Signed message

digest = SHA256(
    R (16 random bytes)
 || "opeq/exec/v1" || program id || account id
 || epoch u32 || leaf u32 || expiry slot u64
 || count u8
 || for each inner instruction:
       program id || meta count u8
    || for each account:
          pubkey || flags u8
          (flags: 1 = signer, 2 = writable)
    || data length u16 || data
 || salt u32
)[0..16]

Rekey uses "opeq/rekey/v1" and hashes the new public seed and new root instead of instructions. The client tries 2¹⁷ salts and keeps the one with the fewest verification steps.

Instructions and state

0 init    tag | pub_seed 16 | root 16 | lamports u64
          payer (s, w), state (w), wallet, system
1 exec    tag | leaf u32 | expiry u64 | salt u32 | R 16
          | sig 288 | path 160 | count u8 | inner...
          state (w), wallet (w), every account used
2 rekey   tag | leaf u32 | expiry u64 | salt u32 | R 16
          | sig 288 | path 160 | new pub_seed 16 | new root 16
          state (w), wallet

state account, 88 bytes
  0  magic "OPEQST01"      40  pub_seed (16)
  8  account id (32)       56  root (16)
 72  next leaf u32         76  epoch u32
 80  state bump, wallet bump, 6 zero bytes

costs
  SOL transfer       about 160,000 CU
  Raydium swap       about 200,000 CU
  base fee           5000 lamports
  transfer ix data   502 bytes of 1232

Error codes

1bad instruction13bad signature2too many accounts14state not writable3state not owned by program15init address mismatch4bad state account16too many slices5wallet/state mismatch17account index out of range6signature expired18payer must sign7leaf already used19already initialized8leaf out of range20bad system program9self cpi21too many metas10bad meta flags22rekey to the current root11signer escalation23expiry too far in the future12malformed inner instructions

Audio / questions

Questions

Is opeq live?

Not on mainnet yet. The program has not had an external audit. Please don't use it with real money yet.

When will quantum computers break Ed25519?

Nobody knows. Published estimates range from five to twenty years. What is certain is that network-wide migrations take years, and that on Solana every public key is already visible on chain.

Why not wait for Solana to add post-quantum signatures?

A Falcon verification syscall has been proposed (SIMD-0416), and a full migration plan exists on paper. Protocol migrations are slow. opeq works today, on the network as it is, and can adopt Falcon later.

Do I get a new address?

Yes. Your opeq wallet is a new address. You move funds into it like into any other address. After that the address never changes.

What does Phantom do here?

It pays transaction fees and approves them. Your funds don't live in Phantom: they live in the opeq address, which only moves with your hash-based signature. If Phantom's key were ever broken, the attacker would get the fee balance and nothing else.

Where are my keys stored?

In your browser, encrypted with your password (PBKDF2 with 600,000 rounds and AES-256-GCM). They never leave your device and are never sent to any server. The site loads nothing from third parties. An open wallet locks itself after 10 minutes without activity, and showing the 24 words always asks for the password again.

What if I clear my browser or lose my device?

Use your 24 words on the Recover screen. The client rebuilds your keys, finds your current tree on chain and skips ahead 64 keys to stay safe.

Can I use the same words on two devices?

For recovery, yes. Don't sign from two devices at the same time: each device tracks which keys it used, and two devices can't see each other's counters until a transaction lands.

What happens after 1008 transactions?

You rekey. The wallet moves to a fresh tree of 1024 keys derived from the same words. Your address, balances and words stay the same. The last 16 keys of every tree are reserved for this, so you can never get locked out.

How much does it cost?

The normal 5000 lamport fee. A transfer uses about 160,000 compute units, well inside Solana's limits. When priority fees apply, they scale with compute units, so a busy network costs a little more than a plain transfer.

Why are the signatures so big?

Hash-based signatures trade size for safety. 288 bytes of signature plus 160 bytes of Merkle path, 448 bytes in total, against 64 bytes for Ed25519. It still fits in one transaction, together with a swap.

Which apps work?

Any program that accepts a signer. Tested: system transfers, SPL Token, Token-2022, associated token accounts, Memo and Raydium CPMM. Large transactions need address lookup tables, which opeq supports. Programs that demand an Ed25519 signature from the wallet itself can't work with any program-based wallet.

Could the opeq team steal my funds?

The program can be upgraded, and whoever controls upgrades could change it. Today the upgrade key is itself an opeq wallet. Before mainnet the plan is to make the program immutable or put upgrades behind a multisig with a timelock, so users can leave before any change.

Is the code open source?

Yes, under the Apache 2.0 license. The repository goes public at launch.