QNovaa Wallet Chrome extension security report

Most crypto wallets contain no post-quantum code at all. QNovaa runs it. Open PQ Lab and produce a real ML-DSA-44 signature — NIST FIPS 204, a finalised post-quantum standard — on your own device, keyed from your own recovery phrase. The wallet verifies it offline and shows it beside a classical ECDSA signature over the same message: 2,420 bytes against 65. Not a roadmap. Not a screenshot. Cryptography you run yourself and check with your own eyes. ONE SEED, EVERY ERA The twelve words you write down today already derive post-quantum keys. Same phrase, no new backup, no migration waiting for you later. That is not a slogan — it is the architecture. Every account carries a crypto-agility descriptor naming its scheme. The signing interface returns a bundle of signatures rather than a single one, so adding an algorithm is an addition, not a rewrite. Setup shows you the whole derivation as it happens: 128 bits of entropy, twelve words, one seed, then both keys. WHY IT MATTERS NOW A quantum computer that breaks today's signatures does not exist yet. When one does, every public key ever exposed on a blockchain becomes a target — and blockchains never forget. Coins sitting at an address whose public key is already published are exposed retroactively. The migration has to start before it is urgent, which means the engineering has to be real before the marketing is. WHAT YOU CAN DO TODAY • Create or import a wallet with a standard 12-word recovery phrase • Unlock with Touch ID / Windows Hello / a security key, backed by a passphrase you always set • Send BNB and BEP-20 tokens on BNB Smart Chain • View balances across BNB Chain, Ethereum and Polygon • Preview every transaction before you sign: the decoded action in plain language, the recipient, the amount, the maximum fee, and a simulation that tells you whether it would revert • A clear warning before granting any unlimited token approval • Incoming transfers, off by default until you turn them on Your keys never leave your device. Generated locally, encrypted with AES-256-GCM, unlocked with your passkey. The decrypted vault lives only inside a dedicated Web Worker and is destroyed the moment you close the popup. No account, no sign-up, no server that could hold your funds. PRECISELY WHAT SHIPS Post-quantum signing runs alongside ECDSA, not underneath it. Your funds are ECDSA-secured today. PQ Lab signs messages, not transactions — it holds no funds and has no address. Nothing post-quantum is verified on any blockchain by QNovaa, and it runs on BNB testnet only, enforced in the cryptographic core rather than by a setting. So we say quantum-READY, and we mean it literally. Anyone selling you "quantum-proof" for a wallet holding real money on a public chain today is describing something that does not exist. PERMISSIONS One permission: storage, so your encrypted vault survives a browser restart. No host permissions, no content scripts, no reading web pages, nothing exposed to the sites you visit. No analytics and no telemetry enabled by default. EARLY RELEASE The independent third-party security review has not happened yet — it is the gate before any post-quantum path touches real funds. Treat mainnet accordingly, and please do not store more than you would be comfortable losing while the wallet is this young. Full technical detail and the complete caveats list: https://qnovaa.com