Monero's principles, rebuilt without elliptic curves.
Every transfer is shielded. Sender, recipient and amount are hidden.
wallet.qnero.io testnet, live
The public testnet has run since 2026-09-15. The software is pre-alpha, nothing of Qnero's own code is audited, key storage is dev grade and the network may be reset. Where the work stands.
Four priorities, in this order
- Private by default, every spend a proof. A call that moves transparent value between accounts a user chooses is refused by the runtime. The one transparent payout that survives the filter is the genesis vesting claim, whose payee and amount are both fixed at genesis. The filter has no exemption on this chain: nothing in the runtime can produce a Root dispatch, so it is the whole rule for every dispatch the chain can execute.
-
Proof of work, with no stake and no validators.
RandomX, stock
rx/0, the algorithm every CPU miner already runs. No foundation keys in consensus, and no algorithm nobody has hardware or software for. - Post-quantum from genesis. Hash-based proofs, lattice signatures and lattice encapsulation. There is nothing in the transaction path for Shor to break.
-
Audited parts only: standardized primitives and firm-audited circuits.
Those audited parts are upstream's. The audits are Eiger on the Wormhole circuits
(2026-03-20) and a Substrate audit of the chain (2026-05-13). No external audit of
the Qnero delta exists, and that delta is the leaf circuit's note fragments, the
public-input layouts at all three layers, the aggregator rules and
pallet-shielded. Plonky2's 100-bit security here is a conjecture.
The mental model carries over almost intact
Ten pieces of Monero and what each becomes here. The last two are the habits that do not carry, and the words underneath them are defined in the walk-through.
| Monero | Qnero |
|---|---|
| Spend key and view key |
Still split. Spending authority is ask = H("qnero/ask", sk) and the
address half that receives is pk = H(PK, ak, nk). The viewing side
is an ML-KEM decapsulation key opening the AEAD ciphertext on each output, with
a separate nk for spent status. Scanning is the same linear trial
decryption of every output.
|
| Ring size 16 with decoys | Gone. A spend proves Merkle membership in a 4-ary Poseidon tree whose leaves are every note ever appended, so the set it hides in is the pool itself. |
| Key image |
A nullifier, nf = H(NF, nk, rho, r), published into
UsedNullifiers. Same role: the chain refuses one it has already
seen, so a note spends once.
|
| RingCT with Bulletproofs+ |
One proof. A note commits as
cm = H(CM, H(NOTE, pk, rho, r), v), balance is proved in circuit,
and each output range-checks to 62 bits inside the spend proof.
|
| Stealth address over ECDH | An ML-KEM encapsulation per output and an AEAD note ciphertext. |
| Coinbase to the miner | Still a note. One per block, minted from a required inherent, its value and its block public, the recipient hidden. |
| RandomX proof of work |
RandomX, stock rx/0, the same algorithm and the same constants. A
rig that mines Monero mines Qnero with a config change.
|
| 120-second blocks | 120 seconds, decided 2026-09-14. The RandomX seed epoch of 2048 blocks is Monero's 2.84 days to the hour. |
| Unlock time |
Absent. An anchor expires after BlockHashWindow, 256 blocks, which
is 8.5 hours at a 120-second target, and that is the only waiting rule.
|
| Tail emission |
Undesigned. The emission schedule inherited from the upstream chain runs against
MAX_SUPPLY, so the question Monero answered with a tail is open
here.
|
Supply is capped at 21M QNR on the upstream decay schedule, and emission at genesis supply is 4.11 QNR a block against the 120-second target. Every unit of value created after genesis is a note, minted one per block to whoever mined it. The genesis allocation is undecided: a 2 percent placeholder sits in the design and may be removed. Tail emission is undecided as well. Both are open questions, and this site promises neither answer.
Why the cryptography was replaced
- CLSAG ring signatures with key images
- RingCT Pedersen commitments with Bulletproofs+
- ECDH stealth addresses
- The in-progress FCMP++ curve trees
None of the four has a production-grade post-quantum replacement. Lattice RingCT designs, MatRiCT+ and Raptor among them, remain unaudited papers with transactions in the tens of KB.
Hash-based FRI proving is post-quantum by construction and has production implementations, and a shielded pool in Zcash Orchard semantics needs only a hash function inside the circuit. Qnero keeps the policy and rebuilds the machinery from hashes and lattices.
The base is an upstream post-quantum Substrate stack: ML-DSA-87 accounts, post-quantum Noise over ML-KEM for p2p, a 4-ary Poseidon commitment tree and a nullifier set. Field Goldilocks. Hash Poseidon at Quantus parameters, which an audit firm has reviewed. Proofs Plonky2 over FRI, at a conjectured 100 bits. Every primitive is hash-based or lattice-based.
One leaf proof is one shielded transfer
Up to 2 input notes, exactly 2 outputs, a public fee, and 26 public inputs fixed in the circuit layout. Per real input the circuit derives the address half from the spend key, recomputes the commitment, walks a 16-level Merkle path to the anchored header's tree root, and emits the nullifier. Outputs range-check to 62 bits, so the balance equation cannot wrap the field. Two recursive layers sit above: N leaf proofs make a private batch, the on-chain transaction unit, and n of those make a public batch.
Every figure on this site was measured on one workstation, 20 cores, WSL2. Read the walk-through.
What a block publishes
Private by default is a policy with edges, and the edges are public. A reader deciding what Qnero is should be able to find them in one place.
- A shield names its payer, its value and the leaf it created. The entry is the sharp edge: value that enters the pool that way is linked to the account it came from at the moment it enters.
-
A coinbase note publishes its value and its block. The recipient
sits inside an
innerthe chain cannot open, and no event or storage item names a block's author. - Every settled nullifier is public. The set records that some note was spent. It does not say which one.
- A settlement publishes each slot's two nullifiers, two commitments, both leaf indices and both ciphertexts. A payment and its change are therefore publicly a pair. Which of the two is which stays hidden, because the wallet draws the payment's output slot per spend.
The full list is on the how-it-works page,
taken from docs/CIRCUIT.md section 10.7.
Five projects, compared
Qnero is the youngest by a wide margin and the only one here with no audit of its own code, so read its column as a design three months old running on a testnet. Monero and Bitcoin hold the longest track records, years of mainnet under adversarial pressure, and QRL's legacy chain has run since 2018.
| Property | Qnero | Quantus | QRL | Monero | Bitcoin |
|---|---|---|---|---|---|
| Status (2026-09) | Public testnet since 2026-09-15, first commit 2026-09-11 | Mainnet since 2026-09-09 | Legacy mainnet since 2018; QRL 2.0 on testnet | Mainnet since April 2014 | Mainnet since January 2009 |
| Consensus | RandomX proof of work, stock rx/0, no stake |
QPoW, Poseidon2 nonce grinding, no stake | Legacy RandomX proof of work; QRL 2.0 proof of stake | RandomX proof of work since 2019 | SHA-256d proof of work, ASIC dominated |
| Privacy by default | Mandatory for user transfers, with no privileged origin the call filter fails to reach; shields, coinbase values and fees public | Optional; transfers transparent; rewards paid to wormhole addresses | Absent, fully transparent ledger | Mandatory for user payments, no opt-out; coinbase amounts and fees public | Absent, fully transparent ledger |
| What a quantum computer breaks | No curves in the path; residual exposure is lattice, ML-KEM, Poseidon2 (Grover-halved), FRI | No curves in the path; residual exposure is lattice, Poseidon2 (Grover-halved), FRI | No curves in the path; history was always public | Unspent outputs stealable; past rings resolved, amounts readable, recipients matched to known addresses | Every exposed key at once, Taproot included; the rest in the confirmation race |
| Block time | 120 seconds | 12 seconds | 60 seconds legacy; 60-second slots on QRL 2.0 testnet | 120 seconds | 10 minutes |
| Supply and emission | 21M QNR cap, upstream decay schedule; 2% placeholder allocation, may be removed; tail undecided | 21M QTC cap, geometric decay, 27% genesis vesting | 105M cap on legacy, flat reward since QIP-016 | No cap; perpetual tail of 0.6 XMR per block | 21M cap; halvings to zero, then fees |
| Audits | None of its own code; upstream Poseidon and chain reviewed; its RandomX engine unreviewed | Eiger: chain, Poseidon, earlier PoW; Neodyme: ML-DSA; Immunefi contest Aug 2026 | Red4Sec and X41 D-Sec 2018, Halborn; QRL 2.0 audits partial | Bulletproofs 2018, RandomX 2019, CLSAG 2020, Bulletproofs+ 2021 | Quarkslab 2025 on P2P, mempool and validation; open review since 2009 |
The rows leave out everything that takes years to acquire. Monero has carried real value under sustained attack since 2014, Bitcoin since 2009 and QRL's legacy chain since 2018, which is evidence of a kind no design document supplies. Decentralization, the count of independent implementations and node operators, exchange liquidity, wallet and hardware support, and the accumulated reading of the same consensus code by thousands of people all sit outside this table. Qnero has none of it yet, and a column of favourable properties is worth less than a decade of people trying to break the thing.
Qnero's column comes from this repository. The other columns come from each project's own source tree, documentation and audit material: quantus.com and the Eiger reports in the Quantus chain repository, theqrl.org and its audit summaries, getmonero.org with the Kudelski, X41 D-Sec, Quarkslab, Trail of Bits, JP Aumasson and Antony Vennard, and ZenGo X reports, and bitcoin.org, the bitcoin/bitcoin tree, BIPs 340 to 342 and the 2025 Quarkslab review.
Three things you can run
All three are pointed at the public testnet, and each of them will run against a local chain of your own just as well.
Qloak
A wallet that runs in a page. It creates a spending key there, seals it there, scans the chain there and proves a payment in a background worker. No server component and no account.
What it does and what it cannot do.
Open wallet.qnero.io testnet, live
silQ Road
A block explorer built for a chain where value is private by default, so it is as careful about what it declines to show as about what it shows. One static directory, one WebSocket, no server-side indexer.
The eight things it refuses to do.
Open explorer.qnero.io testnet, live
The node and the command-line wallet
qnero-node mines, settles and serves the stratum dialect xmrig speaks.
qnero-wallet holds the keys, rebuilds Merkle paths locally and proves
its own batches.