Documentation

Last updated 5 November 2026. Mainnet beta: start with small amounts.

New to OPEQ? The step-by-step guide walks through every screen.

Overview

opeq is a wallet built to resist quantum computers. Your funds sit in an address that has no private key at all, and the code on chain moves them only after it checks a hash-based signature (WOTS+ in a Merkle tree, the same family as NIST's SLH-DSA). Nothing in any network protocol has to change.

Networks

Solana, plus four EVM networks: Ethereum, Base, Arbitrum and Robinhood Chain.

Apps

OPEQ Wallet for Chrome, and OPEQ USB, a wallet that runs from a USB drive on Windows. A devnet test wallet runs on this website.

One set of words

24 standard BIP39 words open your Solana wallet and your EVM account on every network.

Bridge

Move SOL, ETH and USDC between Solana and the EVM networks, always to your own address, with no OPEQ fee.

Optional multisig

Shared vaults that move funds only after several opeq wallets approve, on Solana and all four EVM networks.

Open source

Apache 2.0, at github.com/Sercan0x/opeq.

Why it matters

Every Solana and EVM account today is protected by an elliptic-curve signature: Ed25519 on Solana, secp256k1 on Ethereum, Base, Arbitrum and Robinhood Chain. Their safety rests on one assumption: you can't work out a private key from its public key.

Shor's algorithm

In 1994 Peter Shor showed that a large enough quantum computer solves exactly that problem. Ed25519, secp256k1 and every elliptic curve in use today fall to it.

Your address is the key

On Solana the address is the public key. Every wallet that has ever received a token has already published everything a quantum attacker needs. On EVM networks the address is a hash of the public key, but the key itself becomes public with the first transaction the address sends.

Migrations are slow

Nobody knows when such a machine arrives. Estimates range from five to twenty years. Moving a whole network to new signatures takes years too, so the work has to start before the threat is real.

Quantum computers do not break hash functions like SHA-256 in the same way. Grover's algorithm only halves the effective strength, which a long enough hash already absorbs. opeq builds its signatures from hashes alone.

Install and set up

Chrome extension

Install OPEQ Wallet from the Chrome Web Store. Choose Create, set a password of at least 10 characters, write down the 24 words and confirm three of them. The wallet opens in the toolbar popup or in a full tab.

USB edition (Windows)

1. Download OPEQ-USB.zip from GitHub and choose Extract All. It won't run from inside the zip.
2. Copy the OPEQ-USB folder to your USB drive. The encrypted wallet will live on the drive.
3. Double-click OPEQ. It first checks its own files against the release list on opeq.io and refuses to open a changed copy.
4. It opens in its own Chrome or Edge window with a throwaway profile that is deleted when you close it. Pull the drive out and the wallet locks and the window closes.

A USB drive that has been plugged into an untrusted computer can be changed by it. Use a drive with a write-protect switch if you can, and keep the launch check on.

Activate on Solana

A new wallet must be activated once. Send at least 0.01 SOL from any other wallet or exchange to the activation address shown in the wallet, then press Activate. About 0.0015 SOL pays the setup, 0.005 SOL stays on the fee key and the rest moves into your opeq wallet.

Set up on an EVM network

Pick the network in the network menu. Send a little ETH to the gas key address shown there, then press Set up. Setup takes up to three transactions and only happens once per network.

Try it on devnet

The devnet app on this website uses free test SOL and never touches mainnet funds.

Your wallet

24 recovery words

Every key is derived from them, so they stay valid after any number of rekeys. Type them only into the OPEQ Chrome extension or the OPEQ USB app, never on a website.

Password and lock

The wallet is encrypted with your password. It locks after 10 minutes without activity in Chrome and after 3 minutes on the USB edition. Showing the words always asks for the password again.

Fee key and gas key

Networks need a classical key to pay fees. opeq derives a small Ed25519 fee key (Solana) and a secp256k1 gas key (EVM) from your words. They hold only a little for fees, the wallet tops them up from inside its own signed transactions, and they have no power over your funds.

One-time keys and rekey

Each key signs once. A Solana key tree signs 688 transactions and an EVM tree 960; then the wallet moves to a fresh tree in one click. Your address, balances and words never change.

One active copy

You can recover your words on another device, but only one copy signs at a time. A recovered copy chooses Use on this device, which moves the wallet to a key tree only that device knows; every other copy then stops signing. This stops two devices from ever using the same one-time key.

No dApp connections

opeq signs only what you build inside the wallet. No website can connect to it or ask it for a signature, so wallet drainers and fake approval requests have nothing to hook into.

Solana

Your opeq wallet is an ordinary Solana address that other programs see as a normal signer. It receives SOL and holds SPL and Token-2022 tokens. One signature authorizes a list of instructions to any programs, and mainnet swaps route through Jupiter. Before you sign a swap, the wallet checks every instruction against the quote and a pinned pool list and simulates the transaction.

Costs: the normal 5000 lamport fee, about 160,000 compute units for a transfer, plus the one-time activation. When priority fees apply, they scale with compute units.

EVM accounts

Every regular EVM address is an ECDSA key that a quantum computer could break once its public key has been seen. opeq gives you a smart-contract account instead. It holds your funds and moves them only after it checks a hash-based signature, the same scheme as on Solana, built on keccak256.

Same address

Your account has the same address on Ethereum, Base, Arbitrum and Robinhood Chain. Receive only on these four: funds sent to it on any other network can't be used.

Separate keys per network

Each network gets its own key trees, so a one-time key is never shared between networks.

What you can do

Send and receive ETH and ERC-20 tokens (add a token by its contract), receive NFTs, rekey, and use multisig. Some exchanges can't withdraw to smart-contract accounts: send a small test amount first.

Costs

About 170,000 to 200,000 gas per send. On Base, Arbitrum and Robinhood Chain that is usually a cent or less; on Ethereum it depends on the gas price.

Two sources

The wallet reads every network through two independent RPC sources and refuses to continue when they disagree.

Multisig

A multisig is optional. A normal wallet works exactly as before; a multisig is a separate shared vault that several opeq wallets control together, for example 2 of 3. Every owner is an opeq wallet or account, never a plain Ed25519 or ECDSA key, so every approval is a one-time hash-based signature from that owner's own wallet. Open it in the Multisig tab.

How to use it

1. Share your owner ID. On Solana each owner copies their owner ID from the Multisig tab; on EVM, their account address. It is public like an address and can't move funds. Every owner must be activated (Solana) or set up (EVM) on that network first.
2. Create. One owner pastes the other owners' IDs, picks how many approvals are needed and creates the vault. Check the confirmation: it lists every owner, the vault address and the cost.
3. Add. The other owners add the vault in their own wallet with the multisig ID (Solana) or vault address (EVM).
4. Fund. On Solana send SOL to the deposit address, never to the multisig ID. On EVM send to the vault address, only on the network where it was created.
5. Propose. Any owner proposes a payment. The proposal counts as that owner's approval.
6. Approve. Each other owner reviews it in their wallet, which shows the full action and warns about anything unusual, and approves with their own one-time signature.
7. Execute. Once enough owners approved, any owner executes it and the vault pays.

Owners

Up to 8 on Solana, up to 10 on EVM. Owner and threshold changes are proposals too, and they cancel every open proposal.

Lifetime

A proposal stays open for up to 30 days. The proposer can cancel it.

Rent (Solana)

Creating a vault and each proposal hold a little SOL as rent. Close a finished proposal to get its rent back. SOL sent to the multisig ID by mistake can be moved to the deposit address.

Same vault address on EVM

An EVM vault address depends only on its owners, threshold and nonce, so funds sent to it on another network can be recovered by creating the same vault there.

Upgrades

The Solana multisig program can be upgraded by the admin opeq wallet during the beta and will be locked after the external audit. The EVM multisig contracts are immutable.

Bridge

Move funds between Solana and Ethereum, Base, Arbitrum and Robinhood Chain from inside the wallet: the Bridge tab on Solana, the Bridge card on each EVM network. The bridge is run by Relay. OPEQ takes no fee; Relay's fee is shown before you sign.

How to use it

1. Set up the other side first. Funds always go to your own opeq address on the other network, so that account must exist: activated on Solana, Set up on an EVM network. The wallet tells you if it doesn't.
2. Pick the network, the asset and the amount. SOL, ETH and USDC between Solana, Ethereum, Base and Arbitrum; ETH only on Robinhood Chain. You can set how much the price may move before the bridge cancels, up to 3%.
3. Review. The confirmation shows what you send, what you receive and the minimum, your address on the other network, Relay's fee and the expected time.
4. Bridge. The wallet signs the deposit with a one-time key and follows the bridge until Relay reports it done, usually within seconds. The Relay request id is in the activity log, so you can look it up on relay.link.

What the wallet checks

Your own deposit

The wallet builds the deposit itself, to Relay's fixed deposit contract, with you as the depositor, and refuses if the deposit Relay suggests differs from it by a single byte.

The order

Before signing, it checks Relay's order: the receiver is your own address, refunds go to you in the same asset, the amounts and minimum match your slippage, the deadline is valid, and there are no extra fees and no extra calls on the other network.

Trust

The deposit carries your quantum-resistant signature. Delivery on the other network is done by Relay and is not quantum-resistant: until Relay delivers you rely on Relay. Relay has committed to refund bridges that do not complete, to your own address on either network.

What is protected

Protected

Funds and tokens in your opeq wallet, your EVM account and any multisig vault. Every action needs a hash-based signature over the exact instructions or calls. The upgrade key of the Solana programs is also an opeq wallet. The EVM contracts have no owner and cannot be upgraded.

Not protected by opeq

The Ed25519 key that pays Solana fees and the secp256k1 gas key that pays EVM fees (both hold only a little, for fees). The validators and consensus of every network, which use classical cryptography and need their own migration.

Security level

Internal reviews

Repeated internal adversarial reviews looked at the program, the protocol, the cryptography and the client, and tried to prove every finding with working attack code. Everything they found is fixed and covered by tests.

Mainnet beta. Start with small amounts. The Solana wallet program and the Solana multisig program can still be upgraded by the developer; the multisig program will be locked for good after the external audit. The EVM contracts are immutable and have had internal reviews only.

The one rule: never reuse a key

Two different signatures from one key let an attacker forge a third. opeq is built around never letting that happen.

Counter first

The next key is reserved and saved before anything is signed. A crash just skips a key.

One tab at a time

A browser lock stops two tabs from signing with the same wallet at once.

Tamper check

The wallet record is authenticated with your password. Rolling back the counter or swapping the program address is detected.

Failed means burned

If a transaction fails, the client burns its key with a no-op so the failed signature can never run later.

Expiry

Every signature names a slot about a minute ahead. The program refuses anything later than 300 slots.

Recovery skips ahead

Restoring from words reads the on-chain counter and skips 64 keys, in case a lost device signed something that never landed.

How it works

On Ethereum, Base, Arbitrum and Robinhood Chain the same scheme runs inside a smart-contract account: the same ladders and tree, with keccak256 in place of SHA-256, and a small gas key paying the fees instead of the fee key.

Compared

Solana core developers have proposed a Falcon signature syscall (SIMD-0416). If it ships, opeq can add Falcon as a second signature type. It does not need to wait for it.

Solana specification

Everything needed to write an independent client or verifier.

Parameters

one-time signature

WOTS+, n = 16 bytes, w = 256, 16 message + 2 checksum chains

signature size

288 B (18 x 16)

merkle tree

height 10, 1024 leaves, auth path 160 Bleaves 0..1007 sign actions, 1008..1023 only rekeys

tweakable hash

F(x) = SHA256(pub_seed16 || ADRS8 || x)[0..16]

ADRS (8 bytes)

type u8 | a u8 | b u8 | 0 | index u32le

hash types

0 chain (a = chain, b = position, index = leaf)1 leaf (index = leaf)2 node (a = height, index = node)3 secret (client only)

checksum

sum(255 - d) over 16 digits, as 2 base-256 digits (max 4080)

tree seeds

sk = SHA256("opeq/tree/sk/v1" || master || epoch u32le)pub = SHA256("opeq/tree/pub/v1" || master || epoch u32le)[0..16]

master seed

32 bytes, shown as 24 BIP39 English words

account id

SHA256("opeq/id/v1" || pub_seed of tree 0 || root of tree 0)

addresses (PDAs)

state = ["s", account id], wallet = ["w", account id]

expiry

named by the signer, at most 300 slots ahead, checked on chain

Signed message

digest = SHA256(
    R (16 random bytes)
 || "opeq/exec/v1" || program id || account id
 || epoch u32 || leaf u32 || expiry slot u64
 || count u8
 || for each inner instruction:
       program id || meta count u8
    || for each account:
          pubkey || flags u8
          (flags: 1 = signer, 2 = writable)
    || data length u16 || data
 || salt u32
)[0..16]

Rekey uses "opeq/rekey/v1" and hashes the new public seed and new root instead of instructions. The client tries 2¹⁷ salts and keeps the one with the fewest verification steps.

Instructions and state

0 init    tag | pub_seed 16 | root 16 | lamports u64
          payer (s, w), state (w), wallet, system
1 exec    tag | leaf u32 | expiry u64 | salt u32 | R 16
          | sig 288 | path 160 | count u8 | inner...
          state (w), wallet (w), every account used
2 rekey   tag | leaf u32 | expiry u64 | salt u32 | R 16
          | sig 288 | path 160 | new pub_seed 16 | new root 16
          state (w), wallet

state account, 88 bytes
  0  magic "OPEQST01"      40  pub_seed (16)
  8  account id (32)       56  root (16)
 72  next leaf u32         76  epoch u32
 80  state bump, wallet bump, 6 zero bytes

costs
  SOL transfer       about 160,000 CU
  Raydium swap       about 200,000 CU
  base fee           5000 lamports
  transfer ix data   502 bytes of 1232

Error codes

EVM specification

networks

Ethereum (1), Base (8453), Arbitrum (42161), Robinhood Chain (4663)

account factory

0xa9993f90af137adc80c70814d27fe4ecc773b50b, same address on all four, no owner

one-time signature

WOTS+ as on Solana, n = 16 bytes, w = 256, 18 chains, with keccak256 instead of SHA-256

proof size

448 B (288 B signature + 160 B Merkle path)

merkle tree

height 10, 1024 leavesleaves 0..959 sign calls, 960..1023 only rekeys and device takeovers

trees

one identity tree fixes the address on every networkeach network gets its own key trees, so a key is never shared between networks

deadline

named by the signer, at most 1 hour ahead, checked on chain

gas key

secp256k1, derived from the 24 words, pays gas only

gas

about 170,000 to 200,000 per send

digest = keccak256(abi.encode(
    rnd (16 random bytes),
    keccak256("opeq/evm/exec/v1"),
    chain id, account address, epoch,
    leaf, deadline,
    keccak256(abi.encode(calls)),
    salt
))[0..16]

execute(calls, leaf, deadline, salt, rnd, proof 448 B)
rekey(new pub_seed, new root, leaf, deadline, salt, rnd, proof)

Multisig specification

Optional and separate from the wallet: a normal opeq wallet never needs it. Every owner is an opeq wallet or opeq account, so each approval is that owner's own hash-based signature. A proposal stores the full instructions or calls on chain, so every owner approves exactly what will run. Owner and threshold changes are proposals too, and they void every open proposal.

Solana program

3qjjDf8MdqDTFmBm3zJfKFqZKbZ5xgZM1ntGYVeqEuHBcode sha256 83ff2e876a98bccc62080f739792860c0b964355b9848c0cf6695dee28fc222cupgrade key: the admin opeq wallet, locked after the external audit

EVM factory

0x260e85a98575012b816605b0feacb6cfdde78cef on all four networks, immutable

owners

Solana: up to 8 opeq wallets, named by their owner ID (account id)EVM: up to 10 opeq accounts, checked by code hash

Solana addresses (PDAs)

multisig = ["m", creator, nonce 32]deposit address = ["v", multisig]proposal = ["p", multisig, proposer, config u32, seq u32]

EVM vault address

CREATE2 from (owners, threshold, nonce): the same on every network

proposal lifetime

at most 30 days

Solana instructions
0 create    threshold | nonce 32 | owners
1 propose   expires i64 | stored instructions
2 approve   id u64 | content hash 32
3 revoke    id u64 | content hash 32
4 cancel    id u64        (proposer only)
5 execute   id u64        (any owner, enough approvals)
6 close     id u64        (rent back to the proposer)
7 sweep     moves SOL sent to the multisig ID
            to its deposit address

EVM calls
propose(calls, expires)   approve(id, callsHash)
revoke(id, callsHash)     cancel(id)
execute(id, calls)        setOwners / setThreshold
                          (only through an executed proposal)

Send funds only to the deposit address on Solana, or to the vault address on the network it was created on. The multisig ID is for sharing with co-owners.

Addresses

Both Solana programs are reproducible from the source: the README shows the commands that print the hashes above.

Built from scratch

The program is written in sBPF v3 assembly through a hand-made Python assembler. There is no Rust, LLVM or Solana CLI anywhere. A custom sBPF emulator runs the program locally with Solana's compute-unit prices. Its count matched the live network to within 0.05%. Every change is checked against a reference model with differential fuzzing.

This website is plain JavaScript with no dependencies: SHA-256, WOTS+, BIP39, base58, program addresses and the transaction format are all written by hand. It loads nothing from third parties. The block hashes on this page are computed by the same SHA-256 the wallet uses.

The EVM contracts are plain Solidity with hand-written assembly for the hash chains, built and tested offline with Foundry. The keccak256, secp256k1 and transaction encoding in the wallet are written by hand too.

Roadmap

Questions