Most blockchain projects say they take security seriously. Fewer let outsiders check. Q-AMCHAIN, a post-quantum blockchain developed by Texas-based Ameritec IPS, now has a public record of its own. It is a code audit by CertiK, delivered on October 14 and posted on CertiK’s Skynet platform, where anyone can open it.
The report is worth a closer look, partly for what it found and partly for what it does not claim.
What the Auditors Looked At
According to the Skynet listing, the audit was requested on August 24 and revised on October 14, roughly seven weeks of back and forth between the auditors and the developers. CertiK’s team reviewed 145 files using manual review and static analysis. The file names visible on the listing, such as abi.go and auth.go, point to a codebase written largely in Go, a common choice for blockchain node software.
The review produced 79 findings. Five were rated critical, 11 high, 15 medium, 32 low and 16 informational. By the time the report was published, 78 had been marked resolved. The one exception is a low-severity coding issue listed as partially resolved.
The high and medium findings are mostly tagged as logical issues, the low ones as coding issues. CertiK’s centralisation overview, which looks for risks such as a single privileged key that could upgrade the system or move funds, shows none flagged.
How to Read Those Numbers
A long list of findings can look alarming at first glance, but security reviewers tend to read it differently. Audits exist to find problems before attackers do, and a large codebase going through its first review rarely comes back clean. What matters more is severity and follow-through.
Here, every critical and high-severity item was closed before publication. One of the critical findings falls under denial of service. That category matters for any network, because a successful attack can stall the chain even if no funds are stolen. Around the same time the report went live, Skynet upgraded the project’s security rating to BBB.
Why Post-Quantum Cryptography Raises the Stakes
Q-AMCHAIN’s pitch rests on cryptography. Most blockchains today sign transactions with elliptic-curve cryptography (ECC), and much of the internet still relies on RSA. A large enough quantum computer running Shor’s algorithm could in theory break both. On a public, permanent ledger, that quantum threat is not abstract: data signed or encrypted with today’s methods stays on record for a future attacker to decrypt.
Q-AMCHAIN says it uses lattice-based post-quantum cryptography (PQC) for identity, digital signatures and encryption, the same algorithm family behind the standards NIST finalised in August 2024. Its consensus layer, called Forest Protocol, is described as a leaderless, staked DAG model.
New cryptography means new code, and new code means new bugs. That makes an outside review more relevant for a project like this than for one reusing well-worn libraries.
What the Audit Does Not Tell You
A code audit is a snapshot. It covers the files in scope at the time and the issues the reviewers could find. It does not certify that the quantum-resistant design will hold up for decades, and it says nothing about parts of the ecosystem that sit outside the reviewed code. The Skynet page also shows no formal verification and no bug bounty programme for the project yet, two steps security-minded observers often look for as a network matures.
The Bigger Plan
The chain is meant to be the foundation for a wider set of products. Q-AMCHAIN’s roadmap lists the QB CURE wallet for 2026, followed by Q-Phone, Q-Meet and the Q-Pay payment gateway in 2027, all built on the same post-quantum approach. The details are on the project’s website, qamchain.com.
For now, the CertiK report gives outsiders something concrete to weigh: an itemised, public record of what was wrong and what was fixed. In a sector where security claims are easy to make and hard to check, that counts for something.
