Solana signs with Ed25519. Quantum computers break it.

Vantax is a post-quantum security platform written in Rust, starting with Solana. It finds the keys and signatures a quantum computer breaks, adds NIST ML-DSA-87 around them, and enforces who is allowed to do what.

Follow @VantaxFounder on X View on GitHub Scan some code
Quantum-risk scanner Edit the code. Findings update as you type.

Browser demo using pattern matching on a few common primitives, including ones Solana code relies on. The full scanner covers 20 primitive families, is CamelCase-aware and comment-aware, walks directories and sets CI exit codes. Your code never leaves this page.

Why Solana first.

Every Solana transaction is authorized with Ed25519. Wallets, program upgrade authorities and validator keys all depend on a scheme that Shor's algorithm breaks on a large enough quantum computer.

Vantax cannot change Solana's base signatures. It works as a layer around them, and this part is in progress: scanner rules for Solana codebases, PQ-signed attestations and audit trails that sit next to programs, and guidance on hybrid verification.

Eleven crates. Each answers one question.

A flaw in one component never carries the authority of another. The scanner never holds a signing key, so it has none to leak.

Verify
vantax-core ML-DSA-87 signing, SHA3-512 → BLAKE3 → SHA3-512 hashing, domain-separated encoding. vantax-gateway the policy boundary. vantax-api the HTTP service.
Find
vantax-scanner locates classical crypto in your code and fails your CI. vantax-adapters Bitcoin, Ethereum, Solana and generic L1 integration.
Govern
vantax-identity credentials in four states, signed machine actions. vantax-sentinel detection through containment and evidence. vantax-bridge five-gate cross-chain authorization.
Build with
vantax-cli keys, signing, scanning and Shamir vaults. vantax-wasm signing in the browser. vantax-fairness commit-reveal randomness anyone can verify.

Rules the code enforces.

Each of these is refused in code, not left to configuration.

  • No signing oracle.The gateway signs only its own attestations, from a closed set, under a fixed domain tag. Customer keys stay with the customer.
  • A valid signature is not authority.Verification and authorization are separate checks. Revoking an issuer revokes everything it signed.
  • Humans own irreversible decisions.Sentinel suspends automatically. Revocation always escalates to a person, and protected identities are never contained automatically.
  • A threshold of one is refused.Bridge signers are counted by distinct fingerprint, and the circuit breaker never resets itself.
  • History survives rotation.Keys resolve by timestamp, so old signatures still verify. The audit log is hash-chained, so editing one entry breaks every entry after it.

Pre-release. Not yet audited.

Vantax has not had an independent third-party audit, and we say so up front. Do not use it to custody value until a review of your specific deployment is complete. The cryptography is NIST FIPS 204 ML-DSA-87, and the design, threat model and limits are written down in the whitepaper.