Solana validators patch zero-day bug that could have led to unlimited minting of certain tokens
Quick Take
- The Solana Foundation announced that a recent zero-day vulnerability affecting confidential transfers on Solana has been patched after validators coordinated a network update.
- The bug, which was discovered on April 16 and fixed within two days, could have given an attacker unlimited control over certain Solana tokens.
A recent "zero-day" vulnerability affecting certain tokens on the Solana blockchain was patched after the Solana Foundation, which stewards the network, privately organized validators to deploy a critical fix.
According to the Foundation's post-mortem , the vulnerability was first identified on April 16, and was fully patched two days later following two fixes deployed to the network by a majority of Solana's validators. The validators were privately organized by the Solana Foundation, which did not seek to publicize the vulnerability before a fix could be made.
The severe vulnerability affected the ZK ElGamal Proof program, the system which verifies zero-knowledge proofs that power confidential transfers of certain tokens that follow Solana's Token-2022 standard. An attacker could have theoretically minted an unlimited number of tokens or stolen tokens from any user's account using sophisticated forged proofs.
Though the confidential transfers feature has been supported on Solana since October 2023 , the feature has seen little adoption. Though some reports indicate Paxos' USDP stablecoin leverages the feature, Paxos denied the reports in a statement to The Block. "Confidential transfers are currently not live on any Paxos-issued stablecoins," a spokesperson said. "Therefore this Solana patch did not impact Paxos nor its products."
"All funds are safe, and there is no known exploit of the potential vulnerability," the Foundation's post states. It is currently unclear who initially flagged the vulnerability and whether or not they will be entitled to a bug bounty; the Solana Foundation could not be immediately reached for comment.
Solana co-founder Anatoly Yakovenko defended the Foundation's efforts to coordinate the upgrade from critics on X. "It’s the same people to get to 70% [consensus] on ethereum," Yakovenko said . "All the lido validators (chorus one, p2p, etc..) binance, coinbase, and kraken."
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Regret Missing Toshi’s Spike? BTFD Coin’s Presale Is Live—And It Could Turn $5K into $450K by the Time It Hits Its $0.006 Target
BTFD Coin is still in Stage 15 of its meme coin presale, priced at $0.0002, with a forecast of $0.006 and a chance to triple holdings using the LAUNCH200 bonus code.BTFD Coin’s Referral Program: Earn Big by Spreading the WordToshi’s Rise Was Real—but the Entry Point’s Long Gone
Best Crypto Presales to Buy: 3 ICOs with 10x Potential
Nexchain: The AI-Powered Blockchain Built for Speed and ScaleBTC Bull Token: Riding Bitcoin’s Momentum with Leverage$SUBBD Token: Powering the No.1 AI Agent Creator PlatformConclusion
XP raises $6,2 million with Solana and NFTs
Heritage Distilling Adopts Crypto Payments
Heritage Distilling Company, Inc. (NASDAQ: CASK) is making a bold foray into the digital economy, becoming one of the first craft spirits producers to implement a formal Cryptocurrency Treasury Reserve Policy. Announced on May 15, the new strategy enables the Washington-based distiller to accept Bitcoin and Dogecoin as payment via its direct-to-consumer (DTC) e-commerce platform while holding these digital assets as part of its broader treasury management plan.
Trending news
MoreCrypto prices
More
