// the find
QuipNetwork/hashsigs-solidity
Solidity contracts implementing hash based post quantum signatures
A single Solidity contract implementing WOTS+ (Winternitz One-Time Signature Plus), a hash-based post-quantum signature scheme, built with Foundry and validated against keccak256 test vectors. It's for people experimenting with quantum-resistant signing on-chain, not a production-ready library.
Ships actual test vectors (test/test_vectors/wotsplus_keccak256.json) rather than just unit tests against itself, so correctness is checked against an independent reference. Uses Foundry, which keeps the build/test loop fast and standard. Hash-based signatures are a real answer to ECDSA's eventual quantum exposure, and having a working on-chain implementation at all is more than most 'PQC' repos manage.
No security audit, no gas benchmarks, and no deployed addresses — this is unaudited cryptographic code with the risks that implies for anyone wiring it into a live contract. The README has zero usage documentation: no interface, no example of calling WOTSPlus.sol from another contract, no explanation of key/signature sizes or one-time-use constraints that are the whole point of WOTS+. AGPL-3.0 is a hard sell for teams that can't take on copyleft obligations for their smart contract stack. The 11.2k stars against 34 forks and a single-contract repo is a ratio that doesn't match organic developer interest — worth being skeptical of before weighting this by popularity.