Zano has rolled back approximately a month of blockchain history after a vulnerability involving Gateway Addresses allowed unauthorized ZANO and Freedom Dollar to enter circulation, according to its core team.
The Zano blockchain has been restarted at block 3,833,000, immediately before Hard Fork 6, which introduced the affected feature. The recovery requires participating nodes, miners, stakers, exchanges and other services to adopt the update, the team said Sunday.
The rollback invalidates a month of legitimate transactions along with the unauthorized tokens, meaning transactions made during that period will no longer appear on the recovered chain and may need to be reconciled. It also cannot reverse payments already settled on other blockchains. The team said it is working to account for any losses and will publish a reimbursement and claims process.
“Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply,” said Zanos head of marketing and growth Quinten van Welzen. “It would also tell every future attacker that exploited coins get to keep their value. No project survives that.”
Zano identifies Gateway Address exploit
Zano has not released a post-mortem at the time of publication, but confirmed the issue came from Gateway Addresses, a feature developed to make it easier for bridges, exchanges and payment services to integrate with Zano by letting them manage funds through a single account-style balance (similar to other blockchains).
Before Gateway Addresses, Zanos ordinary wallets tracked funds as separate transaction outputs (UTXOs), rather than a single account balance. Exchanges and other services had to scan the blockchain to identify incoming payments, track those outputs and select which ones to spend when processing withdrawals.
Zanos blockchain explorer shows the rollback taking place on Sunday. Source: Zano Explorer
Zano launched in May 2019 as a layer-1 blockchain focused on private payments. Its standard private transactions conceal senders, receivers, transferred amounts and asset types. While it has a native token, ZANO, the blockchain also allows users to deploy and mint custom digital assets. Freedom Dollar (fUSD) is one such token that operates on the Zano blockchain.
Related: Bitget CEO suspects North Korea behind $352M hack, citing IP clues
“Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which well have to earn back,” said van Welzen.
“But it restores the supply everyone signed up for, and it leaves a path to rebuild. Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more.”