(a) Problem the project solves

The Quip Network is solving coordination failures in quantum and high-performance computing: restricted talent, unclear returns on investment, integration friction, under-utilization, and post-quantum migration. A customer may identify a problem suited to quantum computation but still lack the information needed to buy a solution, including the method’s constraints, how to compare conflicting vendor claims, and how to measure quantum advantage against a tuned classical baseline. Most quantum vendors sell vertically integrated stacks, publish benchmarks that are not obviously comparable, and prevent solutions from porting easily between vendors. At the same time, quantum machines are capital-intensive, carry fixed costs at every utilization level, and create lost revenue during idle hours. The hardware that can address these coordination failures can also break much of the classical cryptography securing the internet, while waiting to rotate keys after the threat appears does not address advance collection of public keys, leaves unmigrated networks exposed to chain-wide reorganization attacks, and turns in-place upgrades into a multi-year coordination problem.

Quip Network solves these coordination problems by sharing a talent pool with open source solvers and infrastructure and providing easy onramps for new quantum devs, by clarifying ROI with a distributed ledger of paid benchmarks and an immutable history showing what consumers are willing to pay for, by reducing integration friction with a unified VM, API, and pricing schedule, under-utilization with a spot-priced, pre-emptive proof of useful work, and post-quantum migration with a quantum-resistant OTC swap protocol and account management system that unifies existing networks with a quantum-resistant account wrapper.

(b) Operational priorities

Quip expects to support ongoing development and operations through a combination of protocol-maintenance incentives, treasury funding, fixed emissions, and staged decentralization. Protocol developers maintain the runtime, execution VM, and Proof-of-Useful-Work parameters, add implementations as algorithms and hardware improve, and receive a share of fees from every solved block and proof. The protocol treasury receives a share to fund maintenance and development, and protocol fees are used to buy QUIP and place it into permanent liquidity positions rather than burning it. Network operations are also supported by a fixed annual emission of 40 million QUIP; the Quip Control Asset divides emissions among subnets, and holders direct emissions each epoch toward the subnets they want to fund. New problem classes must be proposed through structured subnet proposals, and a new problem class receives no emission until the proposal defines how the protocol will score its work and settle its claims. During Genesis and early phases, the Quip Foundation reviews proposals and deploys subnet infrastructure after checking market demand, technical feasibility, available hardware partnerships, and resource requirements. Over time, Quip decentralizes in stages: the Foundation gates Genesis, and permissionless subnets and the Control Asset take over emission routing after the mechanism proves itself.

(c) High-level project overview

The Quip Network is a decentralized high-performance computing protocol built around a spot compute clearinghouse, an open-source library of composable solvers, and a hybrid quantum-classical router and scheduler. Consumers bid for idle compute and use expert-submitted solvers, while operators compete for those bids with CPUs, GPUs, ASICs, and QPUs. The network routes each part of a job to suitable hardware, and the spot clearinghouse routes pre-emptable jobs to available machines, increasing utilization and giving smaller exploratory workloads access to otherwise idle capacity. Quip contracts register, escrow, and settle jobs by binding the consumer’s escrowed bid to a job specification; after a valid result, the contract releases payment, routes royalties, and collects the protocol fee. Each subnet represents a problem class with its own proof-of-useful-work template, verification tier, problem and solution formats, verification functions, and quality-scoring functions. Compute providers execute the work, return the required results, and publish proofs that upper layers can check cheaply. The verified result moves back up the stack for scoring, settlement, and delivery to the consumer. QUIP is the network’s native token and shared unit of compute credit.

(d) Primary token functions

QUIP is the network’s native token and shared unit of compute credit. Consumers can fund accounts with fiat or stablecoins and receive cloud credits, but when a job settles the system converts between credits and QUIP below the interface, consumers see bids and bills in credits, and the network settles in QUIP. QUIP also functions as the reward and fee asset for useful work: useful work at the compute layer triggers newly minted block rewards, most issuance goes to the winning miner, the invoked solver’s algorithm developer receives a royalty, the treasury receives a share, and a verified proof releases the consumer’s escrowed payment while minting the block reward. QUIP also supports governance and emission routing through the Quip Control Asset: in the canonical veQUIP implementation, holders lock QUIP in Interlock-enforced escrow to gain voting weight based on lock duration, voting weight decreases as the lock approaches expiry, and holders use that weight each epoch to direct emissions toward subnets; subnet stakeholders can also pay veQUIP voters through an explicit bribe market to direct issuance toward their problem class.

(e) Control surface reliance

Quip decentralizes governance and control in stages. The Foundation gates Genesis, and after the mechanism proves itself, permissionless subnets and the Control Asset take over emission routing. Vote-escrowed governance starts after the flagship phase proves the mechanism; the Quip Control Asset then begins routing emissions among subnets, and subnet proposals move from Foundation review to permissionless entry. Activation is milestone-based, depending on sustained flagship uptime, fee revenue, unique-user milestones, and clean-security milestones, rather than a calendar date. In Stage 2, the network expands to many subnets competing for emission, and under-performing subnets retire.

Labs / DevCo

Foundation

DAO / Onchain Governance

(a) IP ownership & control

No DAO currently exists, and no DAO will exist until the QUIP token is issued. Accordingly, the DAO does not currently own or control any IP, codebases, repositories, trademarks, or brands. PostQuant Labs, the DevCo, currently owns all project IP. It is the intention of PostQuant Labs to grant unlimited licenses to the project IP to the DAO and the Quip Foundation once those entities exist.

(b) Contract/admin powers

Contract and administrative authority is split between an early Foundation-gated phase and later vote-escrowed governance. During Genesis and early phases, the Quip Foundation gates Genesis, reviews every new subnet proposal, and deploys subnet infrastructure only after checking market demand, technical feasibility, available hardware partnerships, and resource requirements. This centralized period is intended to establish verification playbooks and trust while the mechanism remains unproven. The foundation council will consist of five members voting by simple majority and multisig attestation until the token holders vote to change this structure.

Subnet-creation authority is constrained by a required proposal template. A new problem class receives no emission until its proposal defines the computational domain, admissible claims, verification tier, verification function, quality rubric, expected hardware class, and initial difficulty; a proposal missing any required field cannot activate. After activation thresholds are met, subnet proposals become permissionless, each submission bonds a QUIP stake, and a subnet must attract veQUIP votes before it earns meaningful emissions. A low-quality proposal with no votes receives no allocation, moves toward retirement, and leaves the proposer to bear the cost.

The Quip Control Asset routes emissions among subnets each epoch. In one implementation, veQUIP commits QUIP to Interlock escrow and grants control weight that increases with lock duration and decreases as the lock approaches its end. Each epoch converts control weight directly into proportional emission: a subnet’s share of fixed per-epoch emission equals its share of all weight cast; if no one votes, subnets split emission equally, and rounding remainders go to the largest recipient. The Control Asset binds to a zero-knowledge identity credential and can apply per-identity limits, including quadratic decay in marginal control weight, to reduce capture by an actor splitting balances across wallets.

Retirement authority also runs through veQUIP. A subnet may be flagged for sustained low veQUIP allocation below a viability floor, persistently high failed validations or failed oracle adjudications, or work below the proposal’s quality bar. A subnet that receives no votes loses its emission. A flagged subnet receives a grace period to attract votes, improve verification rates, or restore quality, and unrecovered subnets move operators and open jobs to surviving compatible subnets so committed compute or work in progress is not stranded. A hard wind-down requires a governance action, deregisters the subnet contract, and reclaims its slot; that action uses the same time-weighted vote and the same Foundation-reviewed-to-permissionless progression as subnet creation.

Upgrade authority, administrator fee control, and governance-executor authority is disclosed for protocol and contract surfaces, and will follow Substrate OpenGov voting thresholds and decay curves until such time as the DAO votes to change it. The validator set and tokenholders will use their nominated proof of stake to vote changes, and there will be a decay curve for acceptance starting with 100% required at the initial proposal and decaying to 66% over time, implementing such changes as an onchain upgrade or parameter update. Substrate supports forkless on-chain upgrades, and Quip can use that mechanism to add hash-based account signatures, a post-quantum transaction format, and other quantum-resistant changes to consensus and transactions. Governance upgrades subnet specifications rather than editing them in place, so a live problem class can improve without changing orders already in progress. A Quip Account is scheme-agnostic and upgradeable only under explicit user consent designating a proxy pre-approved by the verifier.

No DAO exists as of filing. Until the Foundation exists, PostQuant Labs' 3-of-4 multisig holds the protocol administrator role, which controls fees only. No pause authority exists.

(c) Locked-token rights (conditional)

Locking exists through the Quip Control Asset, implemented as veQUIP, which has not been deployed yet. Holders lock QUIP in Interlock-enforced escrow to receive time-weighted control weight; longer locks grant more weight, and voting weight decreases as the lock approaches expiry. The escrowed position remains available for lending, borrowing, or use as collateral while locked, allowing holders to participate in governance without leaving the underlying capital idle.

Locked-token holders use this control weight to route emissions among subnets each epoch. A subnet’s share of fixed per-epoch emission equals its share of all weight cast; if no one votes, subnets split emission equally. Holders can also participate in the explicit bribe market: a subnet or backer deposits QUIP for a specified subnet and epoch, and veQUIP holders who voted for that subnet claim the deposit in proportion to their contributed votes. The Control Asset binds to a zero-knowledge identity credential and can apply per-identity limits, such as quadratic decay in marginal control weight, to reduce capture by one actor.

Locked-token holders can influence which subnets receive emissions, vote on subnet proposals and retirements, and, after activation thresholds are met, participate in permissionless subnet entry. A new problem class receives no emission until its proposal defines how the protocol will score its work and settle its claims, and a proposal missing required fields cannot activate. A subnet must attract veQUIP votes before it earns meaningful emission. A subnet that receives no votes loses its emission, and a hard wind-down requires a governance action that deregisters the subnet contract and reclaims its slot.

Locked-token holders do not determine the total annual emission through this mechanism. After the pre-mine has fully vested, subnet emissions continue at 40 million QUIP per year, and Quip emits 40 million QUIP each year regardless of token price, network activity, or the number of subnets. Their voting allocates that fixed emission among subnets rather than changing the fixed emission amount. During Genesis and the early phases, the Quip Foundation reviews every proposal and deploys subnet infrastructure only after checking market demand, technical feasibility, available hardware partnerships, and resource requirements. Vote-escrowed governance starts after the flagship phase proves the mechanism; activation depends on sustained flagship uptime, fee revenue, unique-user milestones, and clean-security milestones, not on a calendar date.

These rights do not exist until the deployment of mainnet and the adoption of the Quip Control Asset by the DAO

(d) Current tokenholder governance rights and economic arrangements

Token holders do not currently have any governance rights, as there is no token to hold. Token holders have no presently operative economic rights or arrangements.

At Genesis and in early phases, the Foundation gates Genesis, reviews subnets, seeds the treasury’s first permanent liquidity positions, and permissioned operator entry uses hardware attestation and KYB where applicable. The staged governance design then moves to tokenholder emission routing after the flagship phase proves the mechanism; activation depends on sustained flagship uptime, fee revenue, unique-user milestones, and clean-security milestones, not on a calendar date. Tokenholder governance is organized through the Quip Control Asset, with veQUIP as the vote-escrow implementation. Holders lock QUIP through Interlock escrow to receive time-weighted control weight; control weight scales with lock duration and decays toward expiry. Each epoch, allocation is proportional to weight cast, with an equal-split fallback if no one votes. Concentration controls are ZK-KYC identity-bound and may use per-identity quadratic decay, though that decay and the control-weight curve are provisional.

Economic arrangements include a disclosed post-premine vesting supply point of 1,000,000,000 QUIP, allocated 40% emissions, 20% premine, 15% insiders, 15% builders, and 10% community. Annual emission is 40,000,000 QUIP on a fixed, flat schedule; implicit decay occurs because fixed emission is divided across a growing subnet set. Useful work triggers newly minted block rewards: most issuance goes to the winning miner, the invoked solver’s algorithm developer receives a royalty, and the treasury receives a share. Protocol fees buy back QUIP into permanent 50/50 liquidity positions, and treasury policy has no burn. Completed QuipSwap fees accrue to the treasury and fund permanent liquidity positions. The protocol also makes vote-buying an explicit permissionless market: a subnet or backer may deposit QUIP into a bribe contract for a specified subnet and epoch, and veQUIP holders who voted for that subnet claim the deposit in proportion to their contributed votes; this turns emission routing into a transparent auction and moves emission toward work buyers will pay most to fund.

(e) Control surface reliance

The protocol decentralizes in stages. The Foundation gates Genesis, and permissionless subnets and the Quip Control Asset are expected to take over emission routing after the mechanism proves itself. Vote-escrowed governance starts after the flagship phase proves the mechanism; at that point, the Quip Control Asset begins routing emission among subnets, surprisal and incentive markets open, and subnet proposals move from Foundation review to permissionless entry. Activation is milestone-based, depending on sustained flagship uptime, fee revenue, unique-user milestones, and clean-security milestones, rather than a calendar date. Stage 2 expands the network to many subnets competing for emission, while under-performing subnets retire. As quantum networking matures, mining pools are expected to connect the network’s compute into globally entangled capacity.

The anticipated governance primitive is the Quip Control Asset, with veQUIP as its vote-escrow implementation. veQUIP uses Interlock-enforced escrow; control weight scales with lock duration and decays toward expiry. Per epoch, allocation is proportional to weight cast, with equal-split as the fallback if no one votes. The control-weight curve is provisional. Concentration controls are intended to be zero-knowledge-KYC identity-bound and to use per-identity quadratic decay; that decay is also provisional.

(f) Dissolution authority

No DAO currently exists, and no DAO will exist until the QUIP token is issued. Accordingly, no person or body currently holds authority to dissolve or wind up the DAO, and no dissolution or wind-up mechanism has been adopted.

(a) Entity

The Quip Foundation does not yet exist; attorneys are currently being consulted on its formation. It is the intention of the DevCo, PostQuant Labs, to form a British Virgin Islands (BVI) foundation that will issue the QUIP token. The BVI foundation will form a Wyoming Unincorporated Nonprofit Association (UNA) in parallel. Upon token issuance, the UNA will be converted into a Wyoming Decentralized Unincorporated Nonprofit Association (DUNA), and the BVI entity will transfer its assets and control to the DUNA.

(b) IP ownership & control

The Quip Foundation does not yet exist and does not currently own or control any IP, repositories, code, trademarks, or brand assets. PostQuant Labs owns all project IP until the Foundation and the DAO exist, at which point the IP will be transferred or licensed to them. It is the intention of PostQuant Labs to grant unlimited licenses to the Foundation and the DAO. Once formed, the Foundation is expected to gate Genesis, review subnets during Genesis and early phases, deploy subnet infrastructure after checking market demand, technical feasibility, available hardware partnerships, and resource requirements, and seed the treasury's first permanent liquidity positions.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

The Quip Foundation does not yet exist. Once formed, its powers are expected to be concentrated in Genesis and early network operation. The Foundation gates Genesis and, during Genesis and the early phases, reviews every subnet proposal; it deploys subnet infrastructure only after checking market demand, technical feasibility, available hardware partnerships, and resource requirements. Operator entry during Genesis is permissioned through hardware attestation and KYB where applicable. For treasury and protocol-controlled resources, the Foundation seeds the treasury’s first permanent liquidity positions during Genesis. For reward allocation, the Ising optimization and QVRF flagship subnets receive the full emission at launch; vote-escrowed governance starts after the flagship phase proves the mechanism, and the Quip Control Asset then begins routing emissions among subnets. After the network meets activation thresholds, subnet proposals become permissionless; activation depends on sustained flagship uptime, fee revenue, unique-user milestones, and clean-security milestones, and does not depend on a calendar date. The disclosed post-Genesis emission-routing method is that the Quip Control Asset routes emissions each epoch, each subnet’s share of fixed per-epoch emission equals its share of all weight cast, and if no one votes the subnets split emission equally.

(d) Powers over DevCo

The Quip Foundation does not yet exist. Once formed, the Foundation will not exert direct or indirect control over the decision-making of the DevCo, PostQuant Labs. The Foundation will have an arm's-length agreement with the DevCo and will contract with it on an at-will basis.

(e) Contract/admin powers

The Quip Foundation does not yet exist and currently holds no contract or admin powers, including no pause, upgrade, or governance-executor authority. All contract administration currently sits with PostQuant Labs as the deployer and multisig owner (see Section 5e), and will transfer to the Foundation and the DAO once those entities exist. Once formed, the Foundation is expected to gate Genesis, review every subnet proposal during Genesis and the early phases, and deploy subnet infrastructure only after checking market demand, technical feasibility, available hardware partnerships, and resource requirements; after activation thresholds are met, subnet proposals become permissionless.

(f) Current economic arrangements and distribution policies

The Quip Foundation does not yet exist. The Quip Foundation gates Genesis, and the genesis block launches the Sinnet and allocates QUIP. During Genesis, the Foundation reviews subnets and seeds the treasury’s first permanent liquidity positions. When all pre-mine allocations finish vesting, one billion QUIP will have been emitted, allocated as 40% subnet emissions, 20% public and foundation premine, 15% early investors, 15% builders, and 10% community programs. The Foundation receives 150,000,000 QUIP (15%), 100,000,000 at TGE and the rest monthly over 108 months after a 12-month cliff. Allocations for early investors and other team-aligned participants follow a cliff and linear vest, and subnet emissions enter circulation continuously from launch.

Ongoing emissions continue after the pre-mine has fully vested at 40 million QUIP per year, regardless of token price, network activity, or number of subnets. At launch, the two flagship subnets divide the full emission. The Quip Control Asset divides emissions among subnets; in the canonical implementation, veQUIP holders lock QUIP in Interlock-enforced escrow to gain voting weight and direct emissions each epoch. Each epoch converts control weight directly into proportional emission, a subnet’s share equals its share of all weight cast, and if no one votes, subnets split emission equally. Subnets or backers may deposit QUIP into bribe contracts for a specified subnet and epoch, and veQUIP holders who voted for that subnet claim the deposit in proportion to their contributed votes.

Job settlement and useful-work rewards also direct resources to participants. Application developers earn a resale margin and a share of the builder allocation. Algorithm developers receive royalties on invocations. Protocol developers receive a share of fees from solved blocks and proofs. Compute providers earn block rewards and job fees for genuine compute. Validators earn network fees plus emissions, miners earn block rewards and job fees, and nominators stake QUIP behind validators and share the validator’s yield and slashing risk. Useful work triggers newly minted block rewards; most issuance goes to the winning miner, the invoked solver’s algorithm developer receives a royalty, and the treasury receives a share. One verified proof releases the consumer’s escrowed payment and mints the block reward, splitting the emission subsidy among the parties that completed the work.

Treasury and fee policy directs protocol fees into permanent liquidity. The treasury receives a share and converts it into permanent liquidity instead of burning it. Protocol fees are used to buy QUIP and place it in permanent, protocol-owned 50/50 liquidity positions; each purchase adds market depth, lowers the cost of trading QUIP, increases the treasury’s share of pool fees, and keeps the purchased QUIP in the market earning fees.

(a) Entity

The Primary DevCo is Hadamard Gate Incorporated, doing business as PostQuant Labs, a Delaware corporation organized under the Delaware General Corporation Law (Action of Incorporator dated December 14, 2024). Its initial board of directors consists of three members: Richard T. Carback III, Colton Dillion, and Darwin Lo. PostQuant Labs is the current developer and deployer of the Quip Network protocol.

(b) IP ownership & control

PostQuant Labs currently owns and controls all IP related to the Quip Network, including code, repositories, trademarks, and brand assets. PostQuant Labs will retain ownership of this IP until the Quip Foundation and the DAO exist; at that point, the IP will be transferred or licensed to those entities. It is the intention of PostQuant Labs to grant unlimited licenses to the DAO and the Foundation.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

No DAO or Foundation currently exists. Until they exist, PostQuant Labs, as the current deployer and multisig owner of the protocol contracts, holds administrative control over the testnet protocol, but the mainnet protocol, treasury, and token administration will be under the sole control of the Foundation; this control of the testnet protocol will transfer to the Foundation and the DAO once those entities exist. PostQuant Labs and its members are allocated 15% of the token supply (the Deployers allocation of 150,000,000 QUIP, subject to an 18-month cliff followed by 18 months of monthly vesting). Once governance is live, PostQuant Labs and its members may vote those tokens individually or collectively, on the same terms as any other tokenholder.

PostQuant Labs’ administrative control of the testnet relies on four validators operated by Postquant Labs and a series of 3/4 multisigs owning contracts on other chains.

PostQuant Labs currently has no powers over treasury actions or protocol-controlled resources such as revenue. PostQuant Labs currently has no powers over token administration or reward parameters. Postquant Labs has no unique applicable power over DAO governance, treasury actions, protocol-controlled resources, token administration, and reward parameters.

(d) Powers over Foundation

The Quip Foundation does not yet exist. Once formed, PostQuant Labs will have no power to direct or control the decision-making of the Foundation. The relationship between the Foundation and PostQuant Labs will be governed by an arm's-length agreement, under which the Foundation contracts with PostQuant Labs on an at-will basis.

(e) Contract/admin powers

PostQuant Labs, as the primary DevCo, is the current deployer of the protocol contracts and the owner of the multisig that administers them; the multisig signer threshold is 3/4. Per the Quip whitepaper (Section 12.1), the protocol administrator role controls only fees, and the signature verifier is a non-upgradeable contract pinned as an immutable, so no party can upgrade it. User accounts are upgradeable only with the explicit consent of the account holder. Runtime upgrades use Substrate's forkless on-chain upgrade mechanism, and subnet specifications are upgraded through governance rather than edited in place. Contract administration and multisig control will be transferred to the Quip Foundation and the DAO once those entities exist.

The DevCo has no pause authority, and no unique control over runtime upgrades, governance-executor authority, or subnet specification upgrades through governance beyond the standard rights granted to token holders.

(f) Current economic arrangements and distribution policies

Current programmatic economic arrangements include the following: when all pre-mine allocations finish vesting, 1,000,000,000 QUIP will have been emitted; the first billion is allocated 40% to subnet emissions, 20% to the public and foundation premine, 15% to early investors, 15% to builders, and 10% to community programs. Subnet emissions enter circulation continuously from launch, while allocations for early investors and other team-aligned participants follow a cliff and linear vest. The first billion is not a maximum supply; after the pre-mine has fully vested, subnet emissions continue at 40,000,000 QUIP per year, regardless of token price, network activity, or number of subnets. The Quip Control Asset routes emissions among subnets each epoch; each subnet’s share equals its share of all control weight cast, with an equal split if no one votes. Protocol fees are used to buy QUIP and place it in permanent, protocol-owned 50/50 liquidity positions, and the treasury policy has no burn. The treasury receives a share and converts that share into permanent liquidity. Application developers earn resale margins and a share of the builder allocation; algorithm developers receive royalties on solver invocations; protocol developers receive a share of fees from solved blocks and proofs; compute providers and miners earn block rewards and job fees; validators earn network fees plus emissions; nominators share validator yield and slashing risk; and liquidity providers earn fees and emissions on supplied liquidity. On order resolution, the order divides the reward among the winning solver or solvers, the builder whose specification was used, and the treasury.

The DevCo and its equity holders participate in this economic arrangement to the extent they are miners, validators, stakers, and smart contract deployers on equal footing with other network participants. In addition, PostQuant Labs and its members receive the Deployers allocation of 150,000,000 QUIP (15%), with an 18-month cliff and 18 months of monthly vesting. The protocol developer share of fees from solved blocks and proofs will be paid to a DAO-controlled wallet, and a developer committee elected by the DAO will direct those funds. PostQuant Labs does not receive this share directly; it may receive funds from this allocation only as determined by the DAO.

Status: an airdrop is planned but has not yet been executed. Target user segments: participants in the Quip Points program who contributed to the testing, development, and marketing of the Quip Network. Allocation method: airdropped tokens come from the Community allocation (100,000,000 QUIP, 10% of the first billion QUIP) and are allocated to eligible participants based on the Quip Points they earned. 5% of the Community allocation is released at TGE, with the remainder released over 120 months; user airdrops are conditional on the revenue performance of the network, emitting based on the proportion of miner, validator, and staker revenue earned from protocol emissions versus usage fees. The project commits to publishing the recipient wallet list in a public channel and to providing it to Blockworks quarterly until the initial TGE airdrop is fully completed.

(a) Date & component affected

No prior exploits or incidents affecting the native token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply as of 2026-10-23.

(b) Exploit vector summary

There have been no prior incidents directly affecting the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply as of a specific 2026-10-23 date

(c) Quantified impact

The quantified impact from prior token-related exploits or incidents is zero US dollars or asset equivalents. There has been no loss of funds and no prior incidents as of 2026-10-23.

(d) Remediation/response taken

There has been no remediation or response taken for any prior token-related incident as there have been no prior token-related incidents as of 2026-10-23.

(e) Current status

No exploits affecting tokenholders or protocol funds as of 2026-10-23.

(f) References

No post-mortem, advisory, or pull-request references for prior token-related incidents are disclosed in this filing.

(a) Regulatory, Legal & Tax Risks

Regulatory, legal, and access-control risk is material because the network routes work based on jurisdiction and compliance attributes. Operator registration records each operator’s jurisdiction and binding regulatory constraints, and the matching layer treats those items as routing predicates; sensitive problem classes, including cryptanalysis subnets and classified or dual-use workloads, are gated against export controls using zero-knowledge proof of identity and program provenance. The network also applies sanctions rules to both sides of a match before offering an order, and dispatch is designed so an operator does not receive a job it cannot lawfully run. As a result, changes in sanctions rules, export controls, jurisdictional eligibility, or other binding regulatory constraints could reduce the set of eligible operators, consumers, workloads, or routes available on the network.

User access may also depend on compliance credentials and operator-specific terms. A zero-knowledge identity credential carries the compliance facts needed for routing; when an operator or problem class requires verification, the credential attests the consumer’s identity and acceptance of the operator’s terms while revealing only the predicate required by the policy. Completing KYC or KYB gives a consumer access to more operators and jurisdictions, and consumers with confidentiality, jurisdiction, or quality requirements can request work only from operators they have vetted. These restrictions may limit access for users that cannot or do not complete required checks, and may create execution risk if a job cannot be matched to an eligible operator.

The network’s most sensitive planned workloads create additional legal and policy risk. The cryptanalysis subnet can break cryptography that protects active financial and communications infrastructure, and export-control and dual-use gates dispatch that work only to operators in jurisdictions where the work is permitted and to operators willing to permit such use. Results follow a coordinated disclosure process instead of unrestricted publication.

Entity-level operational risk is concentrated during the early phases. During Genesis and the early phases, the Quip Foundation reviews every subnet proposal and deploys subnet infrastructure only after checking market demand, technical feasibility, available hardware partnerships, and resource requirements. During Genesis, operator entry is permissioned through hardware attestation and KYB where applicable, and the Foundation gates Genesis. The design later moves toward permissionless operator entry and permissionless subnet proposals after activation thresholds are met, with permissionless subnets and the Control Asset taking over emission routing after the mechanism proves itself.

Export-control risk also applies to the project's core technologies. Both quantum computing and cryptography are regulated in the United States under the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR), which treat certain cryptography and compute items as arms or controlled dual-use items. Changes in how these regimes classify or restrict quantum compute, cryptographic software, or related technical data could limit which operators, consumers, jurisdictions, and workloads the network can serve, require licenses or additional compliance controls, or restrict the distribution of software, technical data, or services by the project's entities.

(b) Protocol, Technology & Security Risks

Protocol, technology, and security risks include the following:

• The Sinnet is a sovereign Substrate layer-one whose runtime includes a useful-work mining pallet, a compute-job mempool for the spot market of bids and solutions, an on-chain XQVM execution pallet, and the Interlock protocol for cross-chain compute payments. Defects in those components could affect proof scoring and rewards, job routing, VM execution, or cross-chain payment settlement.
• The XQVM is designed to support attestation, reject malformed bytecode at the submission boundary, emit execution traces, and independently recompute claimed energy exactly, including on-chain where required. These controls reduce reliance on operator trust, but they depend on correct implementation of the static verifier, bytecode validation, trace generation, and energy recomputation.
• The Interlock uses hash locks and a reclaim path. EasyCrypt state-separating proofs are used for formal verification, and passive safety and fairness are proven, but the full active-adversary proof remains open. A hash lock cannot prove without spoofing that a counterparty committed and then abandoned a swap, and the protocol cannot slash a party that grief-locks funds in a denial-of-service attack. The current Interlock uses hash locks and leaves adaptor-based slashing to future work; no well-studied post-quantum construction for verifiably encrypted signatures or adaptor signatures exists today.
• Quip obtains bridgeless, custodian-free cross-chain payments by waiting for the most conservative counterparty network rather than using a permissioned validator set to shorten the wait. DAG-based optimistic transfers add latency, can finalize only when the slowest participating chain reaches finality, and remain exposed to reversal until the last leg’s timelock can no longer be contested.
• The asset surface depends on SHRINCS account key management. A stateful leaf must sign exactly once, and enforcement uses an on-chain leaf bitmap and lifetime spent-tree registries. Accounts rotate to a fresh tree before the budget is exhausted. The dedicated message-verification key is client-bounded, which makes client-side key tracking a continuing operational risk.
• Sinnet accounts and transactions use hybrid signatures combining a classical scheme with FN-DSA-512; the hybrid signature remains unforgeable while either component remains secure. This design addresses the risk that Quip’s quantum miners could eventually forge a single classical scheme and the risk that an unforeseen weakness in young post-quantum cryptography should not compromise the chain by itself. For repeated consensus signing, signatures are derived deterministically from the message and chain state and cached to prevent differential-fault attacks that affect naive randomized signing. A stock FN-DSA implementation has shown side-channel and fault weaknesses in long-lived, co-resident signers, so Quip admits only the deterministic, constant-time signing profile.
• Tier-two and tier-three validation introduce non-cryptographic correctness risks. Tier-two claims use reproducible benchmarks, and tier-three claims use oracle and prediction-market adjudication. Operators may collude on false benchmark reports, oracles may accept bribes or make errors, and a miner may game a naive quality threshold with low-diversity or pre-computed solutions. Surprisal markets add manipulation risk if an actor with private knowledge moves a market’s probability before resolution, inflating the reward multiplier.
• Mitigations for benchmark, oracle, and market failures include verifier and oracle collateral subject to slashing if a community appeal overturns a decision, random re-checks of accepted results by independent operators, quality scoring that rewards solution diversity and low latency, a Foundation-operated oracle for simple objective claims before moving toward reputation-weighted community oracles, cryptographic verification by default, human judgment for novel claims, and an insurance fund for oracle errors.
• Reorganization risk is distinct because the operators whose useful work secures the chain may eventually own enough hardware to build an alternative history faster than the honest majority. The Sinnet chooses the chain with the most total useful work, and heaviest-observed-subtree and uncle-block construction make work add weight even when it does not extend the main chain. During bootstrap, GRANDPA provides validator-voted finality, and under the honest-validator assumption a finalized block cannot be reorganized. Deep-reorganization resistance still requires honest operators to control a majority of total useful work, an honest validator supermajority to participate in finality, and validators to keep an honest local view of recent commitments.
• Concentration risk remains. Superconducting systems cost tens of millions, few operators own frontier QPUs, Stage 3 entanglement requires mining pools, and mining pools concentrate capacity by design. Mitigations include competition among CPUs, GPUs, ASICs, and QPUs, topology-aware difficulty adjustments, Control Asset identity binding with per-identity limits and quadratic decay, and a single-miner alert above approximately 75% of a subnet’s work.
• Privacy and confidentiality features for the quantum kernel remain incomplete. Future iterations will support blind quantum computation, but these methods are information-theoretically secure in principle and have only small experimental demonstrations; the document treats them as aspirational future work.

(c) Token Economics, Unlocks & Incentive Risks

QUIP is the network’s native token and shared unit of compute credit. The initial one billion QUIP is allocated 40% to subnet emissions, 20% to the public and foundation premine, 15% to early investors or insiders, 15% to builders, and 10% to community programs; early-investor and other team-aligned allocations follow a cliff and linear vest. The first billion is not a maximum supply. After premine vesting, subnet emissions continue at a fixed, flat rate of 40,000,000 QUIP per year, regardless of token price, network activity, or the number of subnets. As more subnets are added, that fixed annual emission is divided among more recipients, so issuance per subnet and QUIP emitted per unit of compute decline through “implicit decay.” Tokenholders therefore bear ongoing emission and allocation risk: the economic value of any subnet, miner, builder, or governance position depends on whether the network attracts enough useful compute demand for the fixed emission schedule and expanding subnet set.

Critical economic assumptions include sustained demand for compute, sufficient liquidity between local currencies and QUIP, enough fee revenue for protocol-owned liquidity, and operator willingness to accept QUIP-denominated rewards while paying fiat capital and operating expenses. Consumers may fund accounts with fiat or stablecoins and see bids and bills in credits, while the network settles in QUIP; application developers typically hold QUIP, handle conversion, bill customers in local currency, and keep a working QUIP balance. Protocol fees are used to buy QUIP and place it in permanent 50/50 liquidity positions, and fees from completed swaps fund those positions. If job demand, fees, or liquidity are insufficient, the buyback-into-liquidity mechanism has less revenue to deploy, operators face a sharper mismatch between fiat costs and QUIP rewards, and operators may enter only when expected rewards rise or leave when competition or lower rewards push expected returns below operating cost. Because rewards and consensus weight come from useful compute rather than node count, and because miners solve proofs of useful work and earn block rewards and job fees, reduced operator participation or weak economic demand can adversely affect the network’s useful-work security and utility.

Governance primarily controls reward allocation rather than a disclosed ability to change the fixed annual emission rate. The Quip Control Asset, implemented as veQUIP, routes emissions among subnets each epoch. Holders lock QUIP in Interlock-enforced escrow to gain time-weighted control weight; longer locks grant more weight, voting weight decreases as the lock approaches expiry, and each epoch converts control weight into proportional emission. If no one votes, subnets split emission equally. Governance also registers new subnets, moves proposals from Foundation review to permissionless entry after activation thresholds, and retires under-performing subnets. These powers can materially change which problem classes, miners, builders, and operators receive rewards.

The emission-routing market also creates governance and incentive risks. Quip makes vote-buying an explicit, permissionless bribe market: a subnet or backer deposits QUIP for a specified subnet and epoch, and veQUIP voters who supported that subnet claim the deposit in proportion to their votes. This turns emission routing into a transparent auction and can move emissions toward work that pays most to attract funding, but it also creates risks that well-funded subnet backers influence reward allocation, that bribe prices rather than long-term protocol value drive voting, and that emission moves away from economically important but less-funded work. The design includes time locks, identity-bound limits, provisional quadratic decay, provisional concentration caps, and cartel monitoring, but those controls are themselves provisional in important respects.

The treasury policy also affects holders. Protocol fees buy back QUIP into permanent 50/50 liquidity positions, and the disclosed treasury policy has no burn. This can add market depth, lower trading costs, and increase the treasury’s share of pool fees, but holders do not receive a burn-based reduction in supply from treasury fee use. Miner sales and put options are intended to help hardware partners manage the mismatch between fiat expenses and QUIP rewards, but these mechanisms also make operator economics dependent on treasury capital, guaranteed-price arrangements, and future reward claims.