A Solana vault that no ordinary key can spend from

An ordinary Solana wallet is secured by a key that a large enough quantum computer could forge. A ZeroQube vault has no such key. Money leaves it only with a one-time signature built from hash functions, which quantum computers are not known to break.

For you, that means SOL and tokens held in a vault cannot be moved with a forged wallet key. You can still swap through Jupiter and stake from inside it, on mainnet today.

Create a vault Check the program yourself

Status: Live on Solana mainnet since 24 September 2026Last upgraded 10 October 2026, slot 455,374,559
Program: BsKbo3shF4X5nG3sMcBApDGcDM7ocC7Gun4ycBqsfrRo
Solana Explorer Solscan

Code hash, SHA-2563bb2f3a8…c870
Who can spend: Only a hash-based signature: generalized XMSSIts family is standardised in RFC 8391 and NIST SP 800-208. 1,037 bytes, from a key that signs once. See a real one
Who can upgrade: One ordinary Solana key, held by the team 7F8kuQEyvsfAwCn4UyoZ7grgGSwKYMrABZHb41eYVDR6 Until that changes, the vault is only as quantum-resistant as that key.
Limits: What is covered, and what is not

Facts on this page were checked against Solana mainnet on 4 November 2026.

One signature from a vault, drawn to scale: 1,037 bytesThe transaction it moved money in Read every byte

An ordinary Solana signature, 64 bytes, at the same scale

Key number, 4 bytes
Salt, 21
Chain values, 828
Tree path, 184

4 + 21 + 828 + 184 = 1,037 bytes

What a quantum computer could do to a wallet, and to a vault

No publicly known computer can break a Solana wallet's key today. The question is what happens to money that is still sitting behind that key when one can.

	An ordinary Solana wallet	A ZeroQube vault
The address	Is a public key. Anyone can read it on chain.	Is a program address. No private key for it exists.
With a large enough quantum computer	The private key can be computed from the address. Whoever holds it signs as you and moves everything.	There is nothing to recover. A spend still needs a one-time hash-based signature, and no ordinary Solana key can stand in for it.
What authorises a spend	One 64-byte ed25519 signature, from the same key every time.	One 1,037-byte signature from a key that signs once. The program refuses that key a second time.

ed25519 is the elliptic-curve signature every ordinary Solana wallet uses. Shor's algorithm solves the problem it rests on. Hash functions have no such structure for it to use.

This signature moved money out of a vault on 24 September 2026

It is the vault's first swap on mainnet, printed here in full. The program checked these 1,037 bytes and marked key 64 used before any money moved.

Transaction: wggJur7CkEwp7J3L5xawJqP1u2nhQ4wYSA8FXqvitS3boaGFsvPApQqewtZr5Xsipne4Gzj4HJCiu3dT6KbjiYM
Solana Explorer Solscan
Slot: 450,153,284
Signed with: Key 64 of the tree's 256

An ordinary Solana signature, 64 bytes, at the same scale

Key number, 4 bytes
Salt, 21
Chain values, 828
Tree path, 184

4 + 21 + 828 + 184 = 1,037 bytes

Key number 4 bytes

00 00 00 40= key 64

Salt 21 bytes

a9 8c 4c ba c7 f5 61 fa fd 81 91 12 65 46 a8 75 e5 f8 ae ce 67

Chain values 36 rows of 23 bytes

01f9 2a 48 3f bb fc e4 7c 81 0a f7 7a c9 07 26 da 54 0c 60 9a 49 dd 37

02f9 bf 8a 6f 8b cd e8 34 5f 4e d6 21 a3 9a 2f 6d 2a 07 64 a3 a6 5a ac

03b2 4e 31 76 02 5b 3d 2e 5f 80 91 ed 17 d7 a5 e6 b0 e7 b2 96 ae 73 bf

045a 16 f5 a9 d3 2a 72 82 1c d7 d0 89 55 86 90 93 33 25 34 f3 1c a3 18

0512 c7 29 96 86 72 9b 74 d0 ac 64 8a 79 06 e3 c4 db a0 19 fd 79 25 a3

0625 1c 9e c6 28 99 f7 5b ac c8 a9 b6 48 6f 17 3a 84 9a 73 19 df 74 57

0732 25 82 7b 6b a7 ef 2a e8 99 5e 5e a6 3a a3 35 ba ff 4e 91 5f 4e c5

08cf 67 26 c9 79 79 c0 e9 5e 72 16 52 45 85 d0 c9 7b 10 42 b9 8e 4d 7e

0949 50 d6 ed 85 88 d1 a5 95 e2 19 de 7f 03 d6 eb f2 47 40 cf 80 cc e1

109d 7f da b9 17 01 ab 80 bc 66 4f 06 01 30 52 40 47 8e 7b 34 6f 3a ad

1199 9a 1f 95 fc e0 3b 93 c9 c6 a6 33 c4 59 40 91 ac 5b 5d 3f 1e d6 d5

1276 74 1d ef 6c d0 70 06 96 c0 3e 3d 43 c0 f6 78 e7 b0 3c f8 4e 08 3d

13ca 47 9f 64 83 02 04 ca 39 10 6d 92 a5 0d 87 32 0e dc c6 18 b4 04 59

14bd 8b e8 5f e2 52 89 7a ac 55 69 00 99 03 7b 67 17 b1 c6 28 27 9e 3d

1552 42 11 04 fa 93 7d 50 37 d9 1f 9a c5 2a a9 2a 6f 83 f1 3c f8 0f da

1618 08 db ab 43 a7 09 15 c8 bf f4 b6 11 82 c9 29 34 8e be 0f c3 39 f2

17c8 42 f9 75 aa 0e 3c 21 30 df 28 2c 5e 01 52 54 be c1 31 84 13 8c 3a

1865 fb d7 a7 72 e5 65 4e 10 13 f8 5f ed 7d 53 29 a8 f5 c9 fd 7c ad 97

19d0 8c c8 f2 2c 88 ad be 13 ef 19 33 4c 4f 7e 50 a4 cf d3 f9 82 99 7c

2061 19 47 14 90 60 d3 47 1d f9 ed 59 7c 9e d6 7e e5 b0 d2 1d e9 59 ba

2102 36 1f 4d 8a 13 55 1d b7 b0 40 dd 27 4f ac d1 c4 a7 31 62 ec 15 21

22df fe ab a9 12 b1 ad 32 23 c3 75 d3 a7 a9 55 47 ca 25 b5 1c 9a 46 a0

23f4 54 52 55 68 39 31 8d 49 1f 4d 00 99 10 a1 77 64 76 bf 06 80 f1 6f

2412 2b f5 71 e4 40 d8 86 0f 7d 5a a1 2d 62 bd ab b7 29 8f 1c 5a f1 0e

2507 e5 5a c2 1c d9 a9 05 18 cc 15 2e 6b a5 79 db 5d fb b1 ce e1 5a b2

26c4 4e e5 c0 98 37 25 12 d4 7d 60 1c 6b ad 71 92 a5 46 65 67 b4 9a 3e

27b7 bd fe f5 e6 8b 65 fe 9d 2e f2 1e 83 9b 16 f6 9c ff 0f 43 f3 51 6f

2832 1e e5 6a 1c d5 33 69 91 1a 73 82 56 90 93 2d e1 dc 8a b3 4b 33 a3

294a 58 4e a4 f7 3c 90 28 7d bd 3a 7a 88 e4 08 0f fe 07 61 57 05 b2 e7

3013 e3 8a 94 8d bc c2 6e 4c 37 c4 b9 38 22 bd c5 37 b1 df dd 96 7c 4b

31c9 30 ea c4 b8 bf 9f 3f fe bc 9a 8b cf 77 37 70 b7 46 0e e9 23 3a 64

32b0 b6 ac c5 dc a1 ec d1 7e a9 1e 6e d5 d9 28 db a5 fb 0e 79 bd de 0c

33db 10 56 d0 31 45 8a 87 73 24 a6 08 20 d2 c6 ba 6b 40 c9 ce 2f 49 68

3403 51 45 cb 2a 0d d4 d5 ba 05 cf a4 5e 92 5c 60 55 50 63 b7 02 f6 42

35f4 30 62 c0 c1 3b c6 f3 df 23 a4 54 48 dd d2 3f 1e 17 02 54 9f 44 9b

364c f1 cd 30 85 fa c6 0b c5 3e a6 80 a5 93 e2 86 bb 58 c0 d7 c9 d3 08

Tree path 8 rows of 23 bytes

0118 65 4d f3 c4 8e 62 33 ee e5 a2 ff 35 03 5f 73 9a 91 59 22 18 61 c8

0288 e5 55 55 25 90 b2 5f d9 f8 52 b5 62 e0 04 02 27 86 ab 69 6f 52 60

0318 12 dd 05 26 91 f4 a9 2d b1 32 08 06 db 89 f3 70 29 32 ee 7d a5 88

04cb 28 e5 69 84 cd 4e 4c 7f c9 68 52 83 c5 16 f9 76 5f af d1 0d 38 4f

05e4 cc 1c c3 b6 d1 0f 07 d9 ea 7f ff 0c a6 7e f5 62 38 dc 54 da 69 18

0626 55 6b bb 4e 33 91 a4 65 03 c5 a3 35 d5 49 fc 87 d1 4f ee 09 ed e8

0717 22 01 a1 c5 27 e3 ab 60 14 61 b5 ac 5b 63 99 7b 59 84 bc 61 d1 42

0807 2f 55 4a e7 d8 ce 48 4a b5 51 9a 44 a0 ff 20 55 e6 cd 5c 2d 24 9b

The ordinary signature in the same transaction 64 bytes

2f 28 51 57 69 6e 22 55 77 b4 4d fa 67 48 ac 14 5e 1d ec 46 57 54 a6

88 63 a6 96 a5 bf 14 6e 10 c7 35 f7 94 98 b9 7e 2e 3a ca 14 da 6d 3e

58 2f 2a c7 17 5f 7e 66 b6 d0 70 ad 69 ef e9 8f 1e 0e

It belongs to the gas wallet that paid the network fee. That key can pay fees. It cannot sign a spend from the vault or change one.

The specification

The vault signs with generalized XMSS built on target-sum Winternitz one-time signatures, over Keccak-256. The construction is from the paper Hash-Based Multi-Signatures for Post-Quantum Ethereum, by Drake, Khovratovich, Kudinov and Wagner3.

It belongs to the hash-based signature family standardised in RFC 83911 and NIST SP 800-2082. The parameters are the paper's. They are not one of those documents' parameter sets.

The values at the right are the ones built into the deployed program. Each size can be counted in the transaction above.

Scheme	Generalized XMSS, target-sum WinternitzIACR ePrint 2025/0553
Hash	Keccak-256Outputs truncated to 23 bytes, the public parameter to 18
Chains	36 chains, w = 4, target sum 29716 positions a chain
Salt	21 bytes
Tree	Height 8256 one-time keys a tree
Signature	1,037 bytes4 + 21 + 36 × 23 + 8 × 23
Public key	41 bytesA 23-byte tree root and an 18-byte parameter
Checking one	37,695 compute units on chainMeasured in the program's test M1.2, 15 September 2026
Stated target	128-bit classical, 64-bit quantumBy calculation. The quantum figure is the Grover bound at these hash widths. No NIST level is claimed.

What is quantum-resistant, and what is not

The right to move money out of a vault is quantum-resistant. Everything around the vault is still ordinary Solana, secured by ed25519 keys that a large enough quantum computer could forge.

Covered

The right to spendThe program releases SOL or tokens only against a one-time hash-based signature. No ordinary Solana key can move a vault's money, at any time.
The vault's addressIt is a program address with no private key behind it, so there is nothing for a quantum computer to recover.
What a signature allowsEach signature covers the program, the vault, the key used, an expiry, and every byte of every instruction it allows. A signature for a 1 SOL swap cannot be turned into a 2 SOL one.
Key reuseEach of a tree's 256 keys signs once. The program refuses a used key.

Not covered

The program's upgrade keyOne ordinary Solana key, held by the team, can still upgrade the program. Until that changes, the vault is only as quantum-resistant as that key.
7F8kuQEyvsfAwCn4UyoZ7grgGSwKYMrABZHb41eYVDR6
The gas walletA small ordinary wallet pays your vault's network fees. A forger could take its SOL or delay your transactions, and could not sign a spend or change one.
The wallet you deposit fromMoney is covered once it is in the vault, and exposed again once it leaves.
Solana itselfThe validators that run the chain, and the programs a swap passes through.
Your device and your 24 wordsWhoever has the words has the vault.
An auditThe program is not yet audited.

Check the deployed program yourself

Verify reads the program from Solana in your browser, hashes it, and compares the hash with the one published here. It shows the program hasn't changed since the hash was published. It can't show you the source, which isn't public yet.

Open Verify

Deployed build: 74,144 bytes, last upgraded 10 October 2026
SHA-256: 3bb2f3a8a8cd55be7bf1db8063db0deb5b71b6552715e5a36ba0035294dec870
Program data: DxHi9JBoD3gU5pZej3yYB2goJLh7nuaspZ5JJcDhorgz
Upgrade authority: 7F8kuQEyvsfAwCn4UyoZ7grgGSwKYMrABZHb41eYVDR6

Or without this site, with the Solana CLI

solana program dump BsKbo3shF4X5nG3sMcBApDGcDM7ocC7Gun4ycBqsfrRo thevault-deployed.so -u mainnet-beta
head -c 74144 thevault-deployed.so | sha256sum

One-time keys

A hash-based key is safe to use once, so the program enforces it. A used key is refused before any hashing. A key that signs is marked used on chain before any money moves, so it can never sign again.

A tree holds 256 one-time keys. The vault moves to a new tree before it runs out, and the app keeps count for you. Every spend also expires.

Refusing a used key costs 907 compute units, measured in the program's test M1. Keys and recovery, in Learn

One key tree, drawn key by key. Point at a key, or focus the drawing and use the arrow keys.

Key 64 signed the swap above. It is the only key this page knows is used.

Status

The vault	Live on mainnet since 24 September 2026	Hold and send SOL and tokens.
Swaps	Live on mainnet since 24 September 2026	Through Jupiter, from inside the vault. The program checks what arrived against your minimum before it finishes. The fee is 0.30%.
Staking	Live on mainnet since 10 October 2026	Stake SOL natively from inside the vault.
Privacy layer	On devnet, not on mainnet	A private balance whose notes are sealed with ML-KEM-768 (NIST FIPS 2034) and whose transfers are proved with hash-based STARKs.
External audit	Not started

Create a vault Read how it works in Learn