Trail of Bits publishes its review of QRL's go-qrllib signing library
The assessment covers the cryptographic library being built for QRL 2.0, with the project's announcement putting the remediation record alongside the limits of the review.
Trail of Bits has published an independent security assessment of go-qrllib, the cryptographic library being developed for the Quantum Resistant Ledger's QRL 2.0 project. QRL's Aug. 4 announcement says the review identified 15 findings, one High, four Low and ten Informational, and that the team resolved the findings after remediation and a follow-up review.
The publication matters because go-qrllib sits close to the point where a wallet turns a user's intent into an authorized signature. QRL 2.0 is designed around post-quantum signature schemes and an EVM-compatible execution environment, but the report is about a library, not a verdict on the complete chain, wallet suite or migration plan.
What the reviewers examined
Trail of Bits examined the XMSS and ML-DSA implementations, the exported API boundary and wallet state-management paths. Its methods included manual source review, fuzzing, comparison with reference implementations, external test vectors, mutation testing and checks around how the library is built and released. That mix matters for cryptography because a mathematically correct primitive can still be exposed through an unsafe parser or a confusing interface.
The report also separates the primitive from the surrounding code. It asks whether inputs are validated, whether malformed signatures are rejected consistently, whether secret material is handled carefully and whether the package distributed to users matches the source that reviewers inspected. Those are integration and release questions, not just questions about the underlying algorithms.
A completed finding is a checkpoint
QRL says the remediation work strengthened API validation, error handling, documentation, secret-memory handling, wallet behavior and regression testing. The announcement also points to hedged ML-DSA signing by default and additional CI controls. Trail of Bits reviewed the fixes on June 22, according to the project. The result is a public record of a review-and-fix cycle, which is more useful than a bare claim that code was audited.
The next evidence has a wider perimeter. QRL's March development update described a code freeze for several repositories before the audit process, while a separate Halborn assessment of qrypto.js examined a JavaScript implementation of ML-DSA and Dilithium. Those reports help map the cryptographic stack, but operators and users still need the project to publish the results of the remaining audits, show reproducible release artifacts and demonstrate the full QRL 2.0 system under testnet and production conditions.
