{
  "chain_slug": "flow",
  "name": "Flow",
  "scorecard_profile": "L1",
  "evaluated_at": "2026-04-18",
  "evaluator": "layerqu-v2-scoring-agent-2",
  "v1_reference": "chainscreen-v1-archive",
  "dimensions": {
    "1_cryptographic_exposure": {
      "weight": 0.15,
      "score": 22,
      "sub_scores": {
        "1a_primitive_inventory": {
          "score": 11,
          "primitives_named": [
            "ECDSA secp256k1 (account signatures)",
            "ECDSA P-256 / secp256r1 (alternate account signatures, WebAuthn compat)",
            "BLS12-381 (staking + consensus)",
            "SHA3-256 (hashing, Keccak variant)"
          ],
          "evidence": [
            "https://developers.flow.com/build/basics/accounts"
          ],
          "note": "Flow supports both secp256k1 and P-256 natively. Multi-key accounts with weight-threshold (similar to EOS)."
        },
        "1b_shor_grover_pq_tag": {
          "score": 8,
          "tags": {
            "ECDSA secp256k1": "Shor-break",
            "ECDSA P-256": "Shor-break",
            "BLS12-381": "Shor-break",
            "SHA3-256": "Grover-weaken-128bit"
          },
          "evidence": []
        },
        "1c_algorithm_family_diversity": {
          "score": 0,
          "families_represented": 0,
          "families": []
        },
        "1d_nist_security_category": {
          "score": 3,
          "mappings": {},
          "evidence": []
        },
        "1e_implementation_quality": {
          "score": 0,
          "formal_verification": "Flow-Go audited; Cadence language spec formal",
          "constant_time": "standard",
          "libraries": [
            "flow-go"
          ],
          "evidence": []
        }
      },
      "total_artifacts": 1
    },
    "2_hndl_exposure": {
      "weight": 0.1,
      "score": 18,
      "sub_scores": {
        "2a_active_key_exposure": {
          "score": 5,
          "note": "Flow addresses are 8-byte identifiers NOT derived from pubkey — similar to Hedera. Pubkey only exposed on tx. Structural advantage."
        },
        "2b_cold_key_exposure": {
          "score": 4,
          "note": "57 months mainnet (since Oct 2020). Moderate cold supply."
        },
        "2c_signature_longterm_validity": {
          "score": 4,
          "note": "All ECDSA/BLS sigs Shor-breakable."
        },
        "2d_encryption_confidentiality": {
          "score": 5,
          "note": "Standard TLS."
        }
      },
      "total_artifacts": 1
    },
    "3_metadata_privacy_exposure": {
      "weight": 0.13,
      "score": 22,
      "sub_scores": {
        "3a_tx_graph_visibility": {
          "score": 6,
          "note": "Transparent; NFT-heavy chain (NBA Top Shot) has high linkability of collector identities."
        },
        "3b_rpc_mempool_concentration": {
          "score": 5,
          "note": "Flow Access Nodes (Dapper + partners)."
        },
        "3c_cross_chain_bridge_correlation": {
          "score": 5,
          "note": "LayerZero integration."
        },
        "3d_retroactive_deanon_risk": {
          "score": 6,
          "note": "Address-decoupling helps; but NFT-ownership correlation still possible."
        }
      },
      "total_artifacts": 1
    },
    "4_migration_architecture": {
      "weight": 0.1,
      "score": 38,
      "sub_scores": {
        "4a_crypto_agility": {
          "score": 12,
          "note": "Multi-key accounts natively support adding new key types with weight-threshold. Similar to EOS/Hedera pattern."
        },
        "4b_account_abstraction_key_rotation": {
          "score": 10,
          "note": "Native multi-sig + weight-threshold + key rotation. Cadence language supports custom authorizers."
        },
        "4c_hard_fork_track_record": {
          "score": 10,
          "note": "Crescendo upgrade (EVM compat), Cadence 1.0 migration successfully shipped. Strong track record."
        },
        "4d_hybrid_deployment_readiness": {
          "score": 6,
          "note": "No hybrid path announced; Dec 2025 counterfeit token incident (Upbit halted) damaged trust somewhat."
        }
      },
      "total_artifacts": 1
    },
    "5_deployment_execution": {
      "weight": 0.22,
      "score": 2,
      "sub_scores": {
        "5a_mainnet_pqc_pct": {
          "score": 0,
          "mainnet_pqc_pct": 0,
          "evidence": [],
          "note": "Zero."
        },
        "5b_pqc_code_in_client": {
          "score": 0,
          "note": "None in flow-go."
        },
        "5c_validator_pqc_adoption": {
          "score": 0,
          "note": "Consensus + Collection + Execution + Verification nodes all on classical crypto."
        },
        "5d_published_milestones_count": {
          "score": 0,
          "count": 0,
          "note": "None."
        },
        "5e_pqc_washing_delta": {
          "score": 2,
          "ratio": 1,
          "note": "No PQC claims."
        }
      },
      "total_artifacts": 0
    },
    "6_supply_chain_vendor_readiness": {
      "weight": 0.22,
      "score": 3,
      "sub_scores": {
        "6a_wallet": {
          "score": 1,
          "top3": [
            "Blocto",
            "Lilico",
            "Dapper Wallet"
          ],
          "pqc_roadmap_count": 0,
          "evidence": []
        },
        "6b_bridge": {
          "score": 1,
          "top3": [
            "LayerZero",
            "Celer"
          ],
          "pqc_roadmap_count": 0,
          "evidence": []
        },
        "6c_custodian": {
          "score": 1,
          "top3": [
            "Coinbase Custody",
            "Anchorage"
          ],
          "pqc_roadmap_count": 0,
          "evidence": []
        },
        "6d_rpc_hsm": {
          "score": 0,
          "top3": [
            "Flow Access Nodes",
            "Dapper Labs Infra"
          ],
          "pqc_roadmap_count": 0,
          "evidence": []
        }
      },
      "total_artifacts": 0
    },
    "7_governance_coordination": {
      "weight": 0.08,
      "score": 42,
      "sub_scores": {
        "7a_validator_stake_distribution": {
          "score": 8,
          "note": "Multi-role node architecture; Dapper-concentrated."
        },
        "7b_upgrade_cadence_under_pressure": {
          "score": 12,
          "note": "Cadence 1.0, Crescendo EVM both shipped. Strong capacity."
        },
        "7c_named_coordination_lead": {
          "score": 12,
          "note": "Named: Dieter Shirley (Dapper Labs CTO, Flow creator), Roham Gharegozlou. No PQC lead."
        },
        "7d_adversarial_coordination_precedent": {
          "score": 10,
          "note": "Dec 2025 counterfeit token incident tested coordination; Upbit halted. Response capacity documented but mixed."
        }
      },
      "total_artifacts": 2
    }
  },
  "gates": {
    "hybrid_deployment": "FAIL",
    "evidence_reconstruction": "PASS",
    "primitive_naming": "PASS"
  },
  "caps_applied": [
    "mosca_cap_60 (5a=0)",
    "sutor_cap_50 (5d=0)",
    "casado_cap (vendors 0)"
  ],
  "qri": {
    "raw": 14,
    "after_caps": 14,
    "ci_plus_minus": 6,
    "band": 1,
    "band_name": "Acknowledged"
  },
  "migration_stage": 0,
  "mosca_inequality": {
    "X_signature_shelf_life_years": "5-15 (NBA Top Shot + NFT holders long-term)",
    "Y_migration_time_years_range": "4-8 (multi-key architecture accelerates)",
    "Z_10pct_year": 2036,
    "Z_50pct_year": 2041,
    "danger_zone_at_50pct": false
  },
  "four_scenario_grid": {
    "quantum_never": {
      "value_preserved_pct": 100,
      "privacy_preserved_pct": 100
    },
    "arrives_suddenly_pre_migration": {
      "value_preserved_pct": 20,
      "privacy_preserved_pct": 12
    },
    "arrives_slowly_post_migration": {
      "value_preserved_pct": 65,
      "privacy_preserved_pct": 40
    },
    "arrives_slowly_mid_migration": {
      "value_preserved_pct": 35,
      "privacy_preserved_pct": 18
    }
  },
  "burn_vs_rescue_policy": "undeclared",
  "pqc_washing_ratio": 1,
  "vendor_tile_summary": {
    "wallet": {
      "top3": [
        "Blocto",
        "Lilico",
        "Dapper Wallet"
      ],
      "pqc_roadmap_count": 0
    },
    "bridge": {
      "top3": [
        "LayerZero",
        "Celer"
      ],
      "pqc_roadmap_count": 0
    },
    "custodian": {
      "top3": [
        "Coinbase Custody",
        "Anchorage"
      ],
      "pqc_roadmap_count": 0
    },
    "rpc_hsm": {
      "top3": [
        "Flow Access Nodes",
        "Dapper Labs Infra"
      ],
      "pqc_roadmap_count": 0
    }
  },
  "narrative_summary": "Flow (Dapper Labs) has notable structural PQC readiness without PQC activity: addresses decoupled from pubkeys (like Hedera), multi-key accounts with weight-threshold (like EOS), native P-256 + secp256k1 support. Zero PQC research or code. Dec 2025 counterfeit token incident (Upbit halted) showed coordination test.",
  "evaluator_notes": "Third-highest Migration Architecture score in batch after Hedera and EOS, thanks to native multi-key + address-decoupling. Zero execution. Stage 1 Acknowledged (generous).",
  "narrative_voiced": "Flow already has the architecture a PQC-ready chain would design: account IDs separate from pubkeys, multi-key weight-thresholds, native P-256 alongside secp256k1. It has never used any of it for PQC. The interesting chains are the ones quietly prepared and never pulling the trigger."
}