Zano Inflation Bug Forces Blockchain to Wipe an Entire Day of History

Zano Prepares to Erase a Day

A blockchain built to make transactions difficult to see is preparing to deliberately erase about 24 hours of them. Zano said on Friday, Sept. 25, that an inflation bug involving its recently introduced Gateway Addresses left it with “no other choice” but to roll back the chain.

Users were told to immediately stop economic activity involving ZANO and Confidential Assets. The story is still developing, and there is no public postmortem explaining exactly what happened, how much was created or which transactions exploited the flaw.

The New Door Appears to Be the Problem

Gateway Addresses arrived with Hard Fork 6 at block 3,833,000 on Aug. 26, following more than a year of development. They were designed to make Zano easier for exchanges, bridges and decentralized exchanges (DEXes) to handle. Instead of forcing services to work entirely with Zano’s private UTXO system, a Gateway Address maintains a directly tracked balance that services can read.

Zano now says an inflation bug involves those addresses, meaning assets could apparently be created when they shouldn’t exist. Precisely how that happened isn’t confirmed. Outside observers have pointed toward code involving transactions crossing between gateway and confidential outputs, but Zano hasn’t publicly shared the vulnerable function. Any connection to recent code changes remains speculation.

One Day of History Goes Back on the Clock

If the rollback proceeds as announced, roughly 24 hours of accepted transactions will disappear from the canonical chain as participating miners, stakers and nodes adopt the revised history. That creates another problem. Legitimate transactions disappear too.

ZANO’s price took a hit after the news went viral. The price shed around 20% following the news and at press time it trades for $6.05 per unit. Zano says economic damages will be reimbursed, but it hasn’t yet published the target rollback height, patched binaries, reimbursement procedure, or the amount of unauthorized assets created. On a privacy-focused blockchain, even demonstrating precisely what someone lost during the erased window could prove complicated.

For now, Zano has offered the remedy before publishing the diagnosis. A day of blockchain history is headed for deletion, while the exact reason it became necessary is still being pieced together. At 6:29 p.m. ET on Friday evening, the Zano team updated users.

“Security update and coordinated upgrade,” Zano wrote on X. “The core team has identified a vulnerability in public Gateway Addresses that affects asset issuance, including fUSD. Transaction privacy is unaffected, and no spend keys or wallets are compromised. We will coordinate a network upgrade asap. It requires majority consensus to activate, so we ask node operators, pools, and exchanges to be ready to update. No action is needed from ordinary users beyond upgrading when the release is published. A full technical write-up will follow after the upgrade is in place.”

Editor’s note: This story’s final paragraph was updated to incorporate additional information from Zano concerning the inflation incident and the subsequent investigation.