Q-Asset
Built onStellar

Verifiable post-quantum authority for Stellar assets and treasuries

Protecting the keys behind every Stellar asset against quantum attacks.

Get startedRead the docs

Stellar is a trademark of the Stellar Development Foundation. Q-Asset is independent software, not affiliated with, sponsored or endorsed by the Stellar Development Foundation.

The authority gap

Securing one key does not secure the asset.

A Stellar asset can depend on several independent authorities: its issuer account, SAC administrator, upgrade keys and treasury controls. Securing one does not secure the others.

Stellar asset

mint · freeze · claw back

  • Route 1

    Protected

    SAC administrator

    ML-DSA signature · post-quantum

  • Route 2

    Vulnerable

    Issuer account

    Ed25519 signature · classical

One vulnerable key exposes the whole asset.

How Q-Asset works

From authority map to verifiable report.

Q-Asset looks at the complete authority structure of an asset, not a single wallet or signature.

  1. Authority-path
    analysis

    Maps issuer, SAC admin, upgrade and treasury paths, and flags where classical keys can bypass them.

  2. On-chain policy
    registry

    Records roles, signer weights, thresholds and policy revisions on Soroban, with events for auditability.

  3. Post-quantum
    authorization

    Requires ML-DSA approvals for supported administrative operations, through Soroban contract accounts.

  4. Reproducible security
    reports

    Tied to contract version, signers and ledger state: what is protected, tested and still exposed.

Built for Stellar

Works with classic issuer accounts, Stellar Asset Contracts and Soroban smart accounts. Built for CAP-87 native ML-DSA verification, with the Protocol 30 Testnet vote on November 3 and the Mainnet vote on November 23, 2026.

Roadmap

Reusable infrastructure for Stellar asset issuers.

  1. Broader authority assessment

    Support for more issuer and SAC configurations.

  2. Policy management

    Stronger revision controls and authenticated administrative changes.

  3. Reports and monitoring

    Reproducible reports, configuration monitoring and alerts.

  4. TypeScript SDK and operator interface

    Inspect authority paths, configure policies and review findings.

  5. Mainnet assessment workflow

    A qualified reference workflow, with security hardening and documentation.

Who it's for

For the teams that control Stellar assets.

  • Initial focus

    Real-world asset
    issuers

    See which keys can still mint, freeze or claw back your assets.

  • Initial focus

    Tokenization
    platforms

    Assess the issuer and SAC configuration of the assets you manage for clients.

  • Next

    Treasuries &
    custodians

    Apply approval policies to treasury operations through supported integrations.

  • Next

    Smart-account
    developers

    Use Q-Asset policies and reports through the TypeScript SDK.

Starting with issuers, growing with the ecosystem.

Inspect the evidence before you trust the claim.

The Q-Asset code is public. Explore it on GitHub.

View on GitHubRead the docs